MAL-2022-4839 Malicious code in nflx-spectator-jsconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 202e32ca9322d937e294bd61303e7d694cabc1ed9a69e237325a867444eda124 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1514 Malicious code in bfx-facs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a1774979dc7da22a1b17bfa58da15255dd1eea3106952833c0f6535a9d1af6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1086 Malicious code in argocd-diff-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51718ff427530768bc006e381b08ab59421bd7258c90823243b8039334322b18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5474 Malicious code in profile-nft-gamification (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37710620e91bbba317c045b70e448937826b6a44304c5e388dc97727a4b9da57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALPHV squeezes victim with dedicated leak site for employees and customers

Eyebrows were raised this week when the ALPHV ransomware group created a leak site dedicated to just one of its victims. The site was aimed at the employees and guests of a hotelier that had been attacked, and allowed them to see if their personal details had been leaked. The new tactic seems to ...

Photos of kids taken from spyware-ridden phones found exposed on the internet

A stalkerware-type app that boasts "the best free phone spying software on the market," has exposed the data it snooped on from the phones it was installed in. The data exposed by TheTruthSpy included GPS locations and photos on victims phones, and images of children and babies. This news, first...

Email compromise leads to healthcare data breach at Kaiser Permanente

At least 69,000 people have been impacted by a data breach at Kaiser Permanente, a long-running managed healthcare consortium. The latest in a long-running series of healthcare attacks, the road to stolen data began on April 5 this year with an email compromise. The direct path to data A...

Kaiser Permanente Exposes Nearly 70K Medical Records in Data Breach

Kaiser Permanente suffered a data breach due to email compromise on April 5 that potentially exposed the medical records of nearly 70,000 patients, the company revealed earlier this month. Attackers gained access to the emails of an employee at Kaiser Foundation Health Plan of Washington that...

MyEasyDocs Exposed 30GB of Israeli and Indian Students PII Data

By Waqas MyEasyDocs is a Chennai, India based online documents verification platform whose Microsoft Azure server exposed data of over… This is a post from HackRead.com Read the original post: MyEasyDocs Exposed 30GB of Israeli and Indian Students PII Data...

Apple’s passkeys attempt to solve the password problem

The recent Apple Worldwide Developers Conference WWDC revealed another teasing of what has been referred to as "the end of passwords forever". Passkeys are a "new biometric sign-in standard". Biometrics in security circles are used for things like identity cards, building access, and so on. This...

Privilege escalation

Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission...

Hacking Scenarios: How Hackers Choose Their Victims

Enforcing the "double-extortion" technique aka pay-now-or-get-breached emerged as a head-turner last year. May 6th, 2022 is a recent example. The State Department said the Conti strain of ransomware was the most costly in terms of payments made by victims as of January. Conti, a...

CVE-2022-30190 (Follina) vulnerability in MSDT: description and counteraction

At the end of May, researchers from the naosec team reported a new zero-day vulnerability in Microsoft Support Diagnostic Tool MSDT that can be exploited using Microsoft Office documents. It allowed attackers to remotely execute code on Windows systems, while the victim could not even open the...

Old Hacks Die Hard: Ransomware, Social Engineering Top Verizon DBIR Threats – Again

Ransomware and social engineering continue to dominate challenges facing cybersecurity professionals, according to Verizon’s 15th annual Data Breach Investigations Report DBIR. In general, the results of DBIR merely confirm well-established trends, such as the growing threats of ransomware – up 1...

Cybercriminals Expand Attack Radius and Ransomware Pain Points

AUTHOR: Melissa Bischoping is director, endpoint security research specialist at Tanium When ransomware strikes, security teams and business leaders are immediately faced with a flurry of questions, including: “Is the vulnerability patched?” “Does my vendor/supplier/customer’s compromise affect m...

Twitter Fined $150 Million for Misusing Users' Data for Advertising Without Consent

Twitter, which is in the process of being acquired by Tesla CEO Elon Musk, has agreed to pay $150 million to the U.S. Federal Trade Commission FTC to settle allegations that it abused non-public information collected for security purposes to serve targeted ads. In addition to the monetary penalty...

GHSA-4G82-3JCR-Q52W Malware in ctx

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of os.environ.items when instantiating Ctx objects. The captured environment variables were sent as a base64 encoded query...

Personal Data of Tens of Millions of Russians and Ukrainians Exposed Online

By Waqas The trove of data was leaked due to a misconfigured Elasticsearch server and in total it stored 870… This is a post from HackRead.com Read the original post: Personal Data of Tens of Millions of Russians and Ukrainians Exposed Online...

General Motors suffers credential stuffing attack

American car manufacturer General Motors GM says it experienced a credential stuffing attack last month. During the attack customer information and reward points were stolen. The subject of the attack was an online platform, run by GM, to help owners of Chevrolet, Buick, GMC, and Cadillac vehicle...

Chicago students lose data to ransomware attackers

Chicago Public Schools CPS disclosed on Friday that students may have had their data taken in a ransomware incident involving one of its vendors. The ransomware attack happened last December at Battelle for Kids BfK, based in Columbus Ohio, which develops services to provide innovation in schools...