Hackers Use Facebook Ads to Spread JSCEAL Malware via Fake Cryptocurrency Trading Apps

Cybersecurity researchers are calling attention to an ongoing campaign that distributes fake cryptocurrency trading apps to deploy a compiled V8 JavaScript JSC malware called JSCEAL that can capture data such as credentials and wallets. The activity leverages thousands of malicious advertisements...

Hackers Use Facebook Ads to Spread JSCEAL Malware via Fake Cryptocurrency Trading Apps

Cybersecurity researchers are calling attention to an ongoing campaign that distributes fake cryptocurrency trading apps to deploy a compiled V8 JavaScript JSC malware called JSCEAL that can capture data such as credentials and wallets. The activity leverages thousands of malicious advertisements...

CVE-2025-43260

This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7. An app may be able to hijack entitlements granted to other privileged apps...

CVE-2025-31275

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to launch any installed app...

Cybercriminals Use Fake Apps to Steal Data and Blackmail Users Across Asia’s Mobile Networks

Cybersecurity researchers have discovered a new, large-scale mobile malware campaign that's targeting Android and iOS platforms with fake dating, social networking, cloud storage, and car service apps to steal sensitive personal data. The cross-platform threat has been codenamed SarangTrap by...

Cybercriminals Use Fake Apps to Steal Data and Blackmail Users Across Asia's Mobile Networks

Cybersecurity researchers have discovered a new, large-scale mobile malware campaign that's targeting Android and iOS platforms with fake dating, social networking, cloud storage, and car service apps to steal sensitive personal data. The cross-platform threat has been codenamed SarangTrap by...

CVE-2025-53940 Quiet uses insecure, inconsistent verification on local backend token

Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6.1.0-alpha.4 and below, Quiet's API for backend/frontend communication was using an insecure, not constant-time comparison function for tok...

PT-2025-54448

Name of the Vulnerable Software and Affected Versions nebelhorn Blappsta Mobile App Plugin & Your native, mobile iPhone App and Android App versions through 0.8.8.8 Description The software contains a flaw related to improper input handling during web page generation, leading to a Reflected...

openjdk: Better Glyph drawing (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1;...

Malicious code in os-apps-ui-curvelibrary1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d69bf54e33d46b564e56a260b65d3c9b8d3a7202dfec0feb06e2930c0bc53dce The OpenSSF Package Analysis project identified 'os-apps-ui-curvelibrary1' @ 12.9.9 npm as malicious. It is considered malicious because: - The...

Microsoft Excel Unauthorized Access

The vulnerability of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise applications is related to reading data beyond the buffer limit of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

New Konfety Malware Variant Evades Detection by Manipulating APKs and Dynamic Code

Cybersecurity researchers have discovered a new, sophisticated variant of a known Android malware referred to as Konfety that leverages the evil twin technique to enable ad fraud. The sneaky approach essentially involves a scenario wherein two variants of an application share the same package nam...

Microsoft Office Buffer Overflow

The vulnerabilities of Microsoft Office packages, 365 Apps for Enterprise, and Microsoft PowerPoint presentation software are related to buffer overflows in dynamic memory. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

Microsoft Office Memory Use After Free

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise packages relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Fake Telegram Apps Spread via 607 Domains in New Android Malware Attack

Fake Telegram apps are being spread through 607 malicious domains to deliver Android malware, using blog-style pages and phishing tactics to trick users...

CVE-2025-6759: Citrix Virtual Apps and Desktops - Local Privilege Escalation (FIXED)

Overview During a Virtual Desktop Infrastructure VDI breakout assessment, Rapid7 identified a Local Privilege Escalation LPE vulnerability affecting Citrix Virtual Apps and Desktops. This issue was assigned CVE-2025-6759 and has a CVSS score of 7.3 High. Rapid7 observed a SYSTEM process handle wi...

Microsoft Office Memory Use After Free Code Execution

The vulnerability of Microsoft Office packages, Word, and 365 Apps for Enterprise lies in the ability to exploit memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Over 600 Laravel Apps Exposed to Remote Code Execution Due to Leaked APP_KEYs on GitHub

Cybersecurity researchers have discovered a serious security issue that allows leaked Laravel APPKEYs to be weaponized to gain remote code execution capabilities on hundreds of applications. "Laravel's APPKEY, essential for encrypting sensitive data, is often leaked publicly e.g., on GitHub,"...

Securing Data in the AI Era

The 2025 Data Risk Report: Enterprises face potentially serious data loss risks from AI-fueled tools. Adopting a unified, AI-driven approach to data security can help. As businesses increasingly rely on cloud-driven platforms and AI-powered tools to accelerate digital transformation, the stakes f...

Unspecified vulnerability in Huawei HarmonyOS and EMUI (CNVD-2025-16592)

Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A security vulnerability exists in Huawei HarmonyOS an...