CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

PT-2024-19302 · Apache · Apache Helix Front

Name of the Vulnerable Software and Affected Versions: Apache Helix Front UI versions all Description: The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects products that are no longer...

Russian Hackers Using Fake Brand Sites to Spread DanaBot and StealC Malware

Cybersecurity researchers have shed light on a sophisticated information stealer campaign that impersonates legitimate brands to distribute malware like DanaBot and StealC. The activity cluster, orchestrated by Russian-speaking cybercriminals and collectively codenamed Tusk, is said to encompass...

Dozens of Google products targeted by scammers via malicious search ads

In a previous blog, we saw criminals distribute malware via malicious ads for Google Authenticator. This time, brazen malvertisers went as far as impersonating Googles entire product line and redirecting victims to a fake Google home page. Clearly not afraid of poking the bear, they even used and...

Malicious code in jupihelp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7bb124c218cd3a0340ff934eafc0d4c9cbf322b2428d8a868ed28703aeb38426 Once run, downloads and install from sleipnirbrowser.org a suspicious executable pretending to be a webbrowser. This website appears to be a scam using some ki...

New Malware Hits 300,000 Users with Rogue Chrome and Edge Extensions

An ongoing, widespread malware campaign has been observed installing rogue Google Chrome and Microsoft Edge extensions via a trojan distributed via fake websites masquerading as popular software. "The trojan malware contains different deliverables ranging from simple adware extensions that hijack...

The top stories coming out of the Black Hat cybersecurity conference

Over the next two weeks, two of the largest cybersecurity conferences in the world will take place in Las Vegas: Black Hat and DEF CON. That means product announcements, buzzwords and stories about "X smart appliance could burn your house down!" or something like that. Over the next two weeks, Il...

The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM allows a perpetrator to influence the integrity of the protected information.

The vulnerability of the Fake Authentication Result Handler component in the DKIM-filtering software OpenDKIM is related to the lack of checks for sequence numbers during the deletion of fake fields. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protecte...

Magniber ransomware targets home users

If you’ve been following any news about ransomware, you may be under the impression that ransomware groups are only after organizations rather than individual people, and for the most part that’s true. However, Magniber is one ransomware that does target home users. And its back, with full force,...

ROS-20240806-07

A vulnerability in the Fake Authentication Result Handler component of OpenDKIM DKIM filter software is related to the lack of sequence number verification when deleting fake fields. Exploitation of the vulnerability could allow an attacker acting remotely to impact the confidentiality, integrity...

Social Media Malvertising Campaign Promotes Fake AI Editor Website for Credential Theft

We uncovered a malvertising campaign where the threat actor hijacks social media pages, renames them to mimic popular AI photo editors, then posts malicious links to fake websites...

Phishing Attack Steals Donations from Trump Voters Using Fake Websites

A phishing campaign targeting Donald Trump’s supporters has been launched involving fake donation websites. The campaigns origins are…...

MAL-2025-4214 Malicious code in deepseek-fake (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2cfb3844573548050acb7218fe4787055828a04e3c327179fe2f7423bb2f2e97 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in deepseek-fake (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2cfb3844573548050acb7218fe4787055828a04e3c327179fe2f7423bb2f2e97 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Indian Firm Linked to Fake DMCA Notices Silencing Journalists

Is critical journalism under attack? A recent exposé reveals a disturbing trend: Companies, in this case, an Indian…...

Malware Campaign Lures Users With Fake W2 Form

The following analysts contributed to the research: Evan McCann, Matt Smith, Ipek Solak, Jake McMahon Rapid7 has recently observed an campaign targeting users searching for W2 forms using the Microsoft search engine Bing. Users are subsequently directed to a fake IRS website, enticing them to...

A (somewhat) complete timeline of Talos’ history

A lot has happened in Talos 10 years of existence. And to celebrate our birthday, we wanted to look back on some of the major moments in Talos history. Heres an overview of some of the major events, cyber attacks, research breakthroughs and more that truly make Talos Talos. We hope this walk down...

Fake Hot Fix for CrowdStrike ”crowdstrike-hotfix.zip” Spreads Remcos RAT

Beware "crowdstrike-hotfix.zip"! This fake file spreads Remcos malware, targeting LatAm CrowdStrike users. Dont download it! Learn how to…...

SUSE CVE-2024-41003

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsetminmax corruption of fakereg Juan reported that after doing some changes to buzzer 0 and implementing a new fuzzing strategy guided by coverage, they noticed the following in one of the probes: ... 13: 79 r6 = u64 ...

U.S. Seizes Domains Used by AI-Powered Russian Bot Farm for Disinformation

The U.S. Department of Justice DoJ said it seized two internet domains and searched nearly 1,000 social media accounts that Russian threat actors allegedly used to covertly spread pro-Kremlin disinformation in the country and abroad on a large scale. "The social media bot farm used elements of AI...