New GEOBOX Tool Hijacks Raspberry Pi, Lets Hackers Fake Location

By Deeba Ahmed New Dark Web Tool GEOBOX, sold for $700 on Telegram and underground forums, hijacks Raspberry Pi, allowing cybercriminals to fake locations and evade detection. This is a post from HackRead.com Read the original post: New GEOBOX Tool Hijacks Raspberry Pi, Lets Hackers Fake Location...

New BunnyLoader Malware Variant Surfaces with Modular Attack Features

Cybersecurity researchers have discovered an updated variant of a stealer and malware loader called BunnyLoader that modularizes its various functions as well as allow it to evade detection. "BunnyLoader is dynamically developing malware with the capability to steal information, credentials and...

Cybercriminals Using Novel DNS Hijacking Technique for Investment Scams

A new DNS threat actor dubbed Savvy Seahorse is leveraging sophisticated techniques to entice targets into fake investment platforms and steal funds. "Savvy Seahorse is a DNS threat actor who convinces victims to create accounts on fake investment platforms, make deposits to a personal account, a...

Zscaler Internet Access 安全漏洞

Zscaler Internet Access is a cloud-native Security Service Edge SSE solution from Zscaler. Zscaler Internet Access suffers from a security vulnerability that stems from a mismatch between server name indications, which allows an attacker to hide their communications from legitimate traffic to eva...

CVE-2023-28807: Improper Certificate Validation

In Zscaler Internet Access ZIA a mismatch between Connect Host and Client Hello's Server Name Indication SNI enables attackers to evade network security controls by hiding their communications within legitimate traffic...

Using addPremium() to evade part of the fees from marginFrom

Lines of code Vulnerability details Vulnerability details When openPosition, we will charge a certain fee, the calculation formula is as follows: marginFrom + amountFromBorrowed FEEFACTOR / Base.BASISPOINT It will include marginFrom, which is mainly used to ensure enough collateralTo after swap,...

NKAbuse: A New Multiplatform Threat Exploiting the Blockchain Protocol

Summary: A novel malware called NKAbuse stands out as a new, Go-based, multi-platform threat. What makes this malware distinctive is its pioneering use of the peer-to-peer network connectivity protocol NKN New Kind of Network technology for data exchange. This utilization of NKN technology makes...

CVE-2023-20084

A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within a limited time window. This vulnerability is due to a timing issue that occurs between various software components. An attacker could...

New GootLoader Malware Variant Evades Detection and Spreads Rapidly

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using...

MAL-2023-8358 Malicious code in aws-consoler2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b37bd86b6f9bda9d03029c9d2fa09561b2b43cda7c3fddda1389c8e193c4a938 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-8351 Malicious code in aliababcloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 644686188e6f43d2dc595074d7644cba060e6a91b8de18713f4b551a76a6c3b7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-8367 Malicious code in python-aliyun-sdk-rds (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 56906386c88b620607253fc1d00a6d5d205c6a535a2ba12fc63108f09761300b Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

Blank Image Attack: Blank Images Used to Evade Anti-Malware Checks

By Deeba Ahmed The Blank Image Attack also bypasses VirusTotal detection. This is a post from HackRead.com Read the original post: Blank Image Attack: Blank Images Used to Evade Anti-Malware Checks...

New Syslogk Linux Rootkit Lets Attackers Remotely Command It Using "Magic Packets"

A new covert Linux kernel rootkit named Syslogk has been spotted under development in the wild and cloaking a malicious payload that can be remotely commandeered by an adversary using a magic network traffic packet. "The Syslogk rootkit is heavily based on Adore-Ng but incorporates new...

TrickBot malware now crashes researchers’ devices to evade analysis

By Deeba Ahmed Since the return of TrickBot malware researchers are observing additional features and capabilities which makes its detection and… This is a post from HackRead.com Read the original post: TrickBot malware now crashes researchers’ devices to evade analysis...

CVE-2021-45335

Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files...

PT-2021-7673 · Avast · Avast Antivirus

Name of the Vulnerable Software and Affected Versions: Avast Antivirus versions prior to 20.4 Description: The issue is related to the sandbox component in Avast Antivirus, which has an insecure permission by default. This could be exploited by a local user to manipulate the results of scans,...

New Malware Targets Windows Subsystem for Linux to Evade Detection

A number of malicious samples have been created for the Windows Subsystem for Linux WSL with the goal of compromising Windows machines, highlighting a sneaky method that allows the operators to stay under the radar and thwart detection by popular anti-malware engines. The "distinct tradecraft"...

Oh, what a boot-iful mornin’

In mid-April, our threat monitoring systems detected malicious files being distributed under the name "on the new initiative of the World Bank in connection with the coronavirus pandemic" in Russian with the extension EXE or RAR. Inside the files was the well-known Rovnix bootkit. There is nothin...

Fin7 Cybergang Retools With New Malicious Code

The Fin7 cybercrime group has ramped up its offensive capabilities by adding new malicious code to its malware arsenal. Researchers said that this is evidence that Fin7 is still a growing threat despite the arrest of several Fin7 members in 2018. The notorious group has adopted a new dropper samp...