Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone number

The examples in this post are actual fraud attempts found by Malwarebytes Senior Director of Research, Jérôme Segura. Cybercriminals frequently use fake search engine listings to take advantage of our trust in popular brands, and then scam us. It often starts, as with so many attacks, with a...

D-Link DPH-400S/SE VoIP Phone 安全漏洞

D-Link DPH-400S/SE VoIP Phone is a VoIP phone from China AUO D-Link. A security vulnerability exists in D-Link DPH-400S/SE VoIP Phone version v1.01, which originates from hard-coded credentials and could lead to the disclosure of sensitive information...

CVE-2025-45784

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...

CVE-2025-45784

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...

CVE-2025-45784: Use of Hard-coded Credentials

D-Link DPH-400S/SE VoIP Phone v1.01 contains hardcoded provisioning variables, including PROVISUSERPASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extract these credentials using static analysis tools such as strings or xxd, potentially...

CVE-2025-45784

The D-Link DPH-400S/SE VoIP Phone (v1.01) contains hardcoded provisioning variables, specifically PROVIS_USER_PASSWORD , within its firmware binary. Due to this insecure storage of sensitive information, an attacker with access to the firmware image can use static analysis tools like strings or x...

Malicious code in eslint-plugin-panel-ops (npm)

Malware: Executes code on install, exfiltrates data via DNS to a suspicious domain. Contains a preinstall script and phone-home behavior. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc1ea7508e63005e73356cfdb457f0050ebb7ae1f04cb319592c30a140c4e2f2 Any computer th...

PT-2025-26164 · D Link · D-Link Dph-400S/Se Voip Phone

Name of the Vulnerable Software and Affected Versions: D-Link DPH-400S/SE VoIP Phone version 1.01 Description: The issue concerns hardcoded provisioning variables, including PROVIS USER PASSWORD, which may expose sensitive user credentials. An attacker with access to the firmware image can extrac...

Google bug allowed phone number of almost any user to be discovered

Google has fixed vulnerabilities that made it possible to retrieve the phone numbers of almost any Google user. The flaw was found in the flow that allows users to recover their Google account using a phone number. A cybersecurity researcher called Brutecat was able to figure out the phone number...

Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account

Google has stepped in to address a security flaw that could have made it possible to brute-force an account's recovery phone number, potentially exposing them to privacy and security risks. The issue, according to Singaporean security researcher "brutecat," leverages an issue in the company's...

A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account

Phone numbers are a gold mine for SIM swappers. A researcher found how to get this precious piece of information through a clever brute-force attack...

The vulnerability in the web interface for controlling microprogrammed IP phones of the Cisco Small Business SPA500 series allows attackers to perform cross-site scripting attacks.

The vulnerability in the web interface for managing microprogrammed IP phones of the Cisco Small Business SPA500 series is related to the lack of measures taken to neutralize HTML tags. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

SAMSUNG SMR 安全漏洞

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung cell phone applications. A security vulnerability exists in versions prior to SAMSUNG SMR Jun-2025 Release 1, which stems from an out-of-bounds write that could cause a local...

SAMSUNG Exynos 2400和SAMSUNG Exynos 1480 缓冲区错误漏洞

SAMSUNG Exynos 2400 and SAMSUNG Exynos 1480 are both cell phone chip processors from Samsung South Korea. A security vulnerability exists in the SAMSUNG Exynos 2400 and SAMSUNG Exynos 1480 that stems from a missing length check that could lead to out-of-bounds writes...

CVE-2025-44614

Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext...

Threat Actor Claims TikTok Breach, Puts 428 Million Records Up for Sale

Alleged TikTok Breach: Threat actor “Often9” claims to sell 428M user records, including emails, phones, and account details on dark web forum. TikTok is investigating!...

CVE-2025-44614

The Tinxy WiFi Lock Controller v1 RF is vulnerable to cleartext storage of sensitive information . The device stores user credentials and mobile phone numbers in plaintext, which may lead to information leakage. To mitigate this risk, it is recommended to restrict access to the device, avoid usin...

CVE-2025-44614: Cleartext Storage of Sensitive Information

Tinxy WiFi Lock Controller v1 RF was discovered to store users' sensitive information, including credentials and mobile phone numbers, in plaintext...

CVE-2025-48926

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses, passwords, and telephone numbers...

New warning issued over toll fee scams

Over a year ago the FBI warned about what was then a new form of smishing phishing via SMS scam: text messages that demanded payment for toll fees. The FTC sent out a similar warning in January, 2025. Then, in April another wave of toll fee scams began doing the rounds. Now the Departments of Mot...