2274 matches found
Elevating Cyber Threat Intelligence against Disinformation Campaigns with LLM-Based Concept Extraction and the FakeCTI Dataset
The swift spread of fake news and disinformation campaigns poses a significant threat to public trust, political stability, and cybersecurity. Traditional Cyber Threat Intelligence CTI approaches, which rely on low-level indicators such as domain names and social media handles, are easily evaded ...
Fake Security Plugin on WordPress Enables Remote Admin Access for Attackers
Cybersecurity researchers have shed light on a new campaign targeting WordPress sites that disguises the malware as a security plugin. The plugin, which goes by the name "WP-antymalwary-bot.php," comes with a variety of features to maintain access, hide itself from the admin dashboard, and execut...
North Korean Hackers Spread Malware via Fake Crypto Firms and Job Interview Lures
North Korea-linked threat actors behind the Contagious Interview have set up front companies as a way to distribute malware during the fake hiring process. "In this new campaign, the threat actor group is using three front companies in the cryptocurrency consulting industry – BlockNovas LLC...
Introducing ToyMaker, an initial access broker working in cahoots with double extortion gangs
In 2023, Cisco Talos discovered an extensive compromise in a critical infrastructure enterprise consisting of a combination of threat actors. From initial access to double extortion, these actors slowly and steadily compromised a multitude of hosts in the network using a combination of various...
Russian Host Proton66 Tied to SuperBlack and WeaXor Ransomware
Threat actors are exploiting bulletproof hosting service Proton66 for malicious activities, including campaigns from SuperBlack ransomware operators, Android…...
PT-2025-17845
Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions prior to September 2025 Description A critical remote code execution issue exists in the SAP NetWeaver Development Server, specifically within the Visual Composer tool's Metadata Uploader function. The flaw is caused by...
SuperCard X Android Malware Enables Contactless ATM and PoS Fraud via NFC Relay Attacks
A new Android malware-as-a-service MaaS platform named SuperCard X can facilitate near-field communication NFC relay attacks, enabling cybercriminals to conduct fraudulent cashouts. The active campaign is targeting customers of banking institutions and card issuers in Italy with an aim to...
SpyNote, BadBazaar, MOONSHINE Malware Target Android and iOS Users via Fake Apps
Cybersecurity researchers have found that threat actors are setting up deceptive websites hosted on newly registered domains to deliver a known Android malware called SpyNote. These bogus websites masquerade as Google Play Store install pages for apps like the Chrome web browser, indicating an...
Threat actors thrive in chaos
Welcome to this week's edition of the Threat Source newsletter. If there's one thing that threat actors love, it's chaos. Headlines in the news that provoke an emotional response make excellent phishing lures because the intense feelings invoked by a provocative subject line cause our critical...
2025 Ransomware: Business as Usual, Business is Booming
Getting an edge on your adversaries involves understanding their behaviors and their mindset. Rapid7 Labs took a look at internal and publicly-available ransomware data for Q1 2025 and added our own insights to provide a picture of the year thus far—and what you can do now to reduce your attack...
CISA and FBI Warn Fast Flux is Powering Resilient Malware, C2, and Phishing Networks
Cybersecurity agencies from Australia, Canada, New Zealand, and the United States have published a joint advisory about the risks associated with a technique called fast flux that has been adopted by threat actors to obscure a command-and-control C2 channel. "'Fast flux' is a technique used to...
One mighty fine-looking report
Welcome to this week's edition of the Threat Source newsletter. They say art is subjective, but have you ever seen a well-formatted bar chart? Van Gogh had Starry Night , but Talos' 2024 Year in Review available now! has color-coded data with perfect labels. True beauty. If you haven't yet had a...
CVE-2025-30406
Gladinet CentreStack through 16.1.10296.56315 fixed in 16.4.10315.56368 has a deserialization vulnerability due to the CentreStack portal's hardcoded machineKey use, as exploited in the wild in March 2025. This enables threat actors who know the machineKey to serialize a payload for server-side...
BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse
At least four different threat actors have been identified as involved in an updated version of a massive ad fraud and residential proxy scheme called BADBOX, painting a picture of an interconnected cybercrime ecosystem. This includes SalesTracker Group, MoYu Group, Lemon Group, and LongTV,...
CVE-2020-29010
An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS version 6.2.4 and below, version 6.0.10 and belowmay allow remote authenticated actors to read the SSL VPN events log entries of users in other VDOMs by executing "get vpn ssl monitor" from the CLI. The sensiti...
Abusing with style: Leveraging cascading style sheets for evasion and tracking
Cisco Talos has identified actors abusing Cascading Style Sheets CSS to 1 evade spam filters and detection engines, and 2 track users' actions and preferences. This blog is a follow-up to our previous report on how threat actors could abuse CSS using a technique called "hidden text salting" to...
PT-2025-14099
Name of the Vulnerable Software and Affected Versions CrushFTP versions 10.0.0 through 10.8.3 and versions 11.0.0 through 11.3.0 Description CrushFTP is affected by an authentication bypass issue that allows attackers to take over the crushadmin account, unless a DMZ proxy instance is used. This...
CVE-2025-24071
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network...
Malvertising campaign leads to info stealers hosted on GitHub
In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leadi...