CVE-2023-28929

Trend Micro Security 2021, 2022, and 2023 Consumer are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable file as an execution and/or persistence mechanism which could execute a malicious program each time the executable file is started...

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

A new phishing campaign codenamed MULTISTORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems. "The attack chain ends with the victim machine infected with multiple unique RAT remote access trojan malware instances, su...

ScarCruft Hackers Exploit Ably Service for Stealthy Wiretapping Attacks

The North Korean threat actor known as ScarCruft has been observed using an information-stealing malware with previously undocumented wiretapping features as well as a backdoor developed using Golang that exploits the Ably real-time messaging service. "The threat actor sent their commands through...

Critical 'nOAuth' Flaw in Microsoft Azure AD Enabled Complete Account Takeover

A security shortcoming in Microsoft Azure Active Directory AD Open Authorization OAuth process could have been exploited to achieve full account takeover, researchers said. California-based identity and access management service Descope, which discovered and reported the issue in April 2023, dubb...

New Condi Malware Hijacking TP-Link Wi-Fi Routers for DDoS Botnet Attacks

A new malware called Condi has been observed exploiting a security vulnerability in TP-Link Archer AX21 AX1800 Wi-Fi routers to rope the devices into a distributed denial-of-service DDoS botnet. Fortinet FortiGuard Labs said the campaign has ramped up since the end of May 2023. Condi is the work ...

Adversary-in-the-Middle Attack Campaign Hits Dozens of Global Organizations

"Dozens" of organizations across the world have been targeted as part of a broad business email compromise BEC campaign that involved the use of adversary-in-the-middle AitM techniques to carry out the attacks. "Following a successful phishing attempt, the threat actor gained initial access to on...

Malicious code in react-router-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 329da6645c0b4c1b67bd28d5bc5b0cde6725f995276a8a0e93bed30b180921ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Uncovers Banking AitM Phishing and BEC Attacks Targeting Financial Giants

Banking and financial services organizations are the targets of a new multi-stage adversary-in-the-middle AitM phishing and business email compromise BEC attack, Microsoft has revealed. "The attack originated from a compromised trusted vendor and transitioned into a series of AiTM attacks and...

Operation Triangulation: Zero-Click iPhone Malware

Kaspersky is reporting a zero-click iOS exploit in the wild: Mobile device backups contain a partial copy of the filesystem, including some of the user data and service databases. The timestamps of the files, folders and the database records allow to roughly reconstruct the events happening to th...

Barracuda Urges Replacing — Not Patching — Its Email Security Gateways

Its not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware -- as opposed to just applying software updates. But experts say that is exactly what transpired this week with Barracuda...

Malicious code in fc-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec30fba8ba38ae5e354c219234fb4dd78d71537718394caf3d584e896c5b0a42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8799cfe87a2f873a60fcdba6f9222954c10e21bd2b76282ce0fa8e689a45166b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 799f38ee085f9c2d790bf9c9e78379f22e3ad2e3de94ff31011bec69ee78196d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-persistence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ffca641672539520dd6ae1301f0c09f9fd69d642335c83b5db13bdf7240961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-360 Malicious code in fc-persistence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08ffca641672539520dd6ae1301f0c09f9fd69d642335c83b5db13bdf7240961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-customer-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2d285e54aa297d074fb908486497560ee5e7fa75c0c415eda550717a464d868 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fc-collabsible (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7cf2a1c7cafc2f63b3b6da7c03ad9e5bb35508693b37096982b17e947379aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in multivariate-experiments (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ad874c630ddc5086d622b1f450560f76c8b2d874591884b3265450f0aad747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gsattrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2958f45d2f7addf081dc9f6e0719b1e36a54ba2a40ba3bd8ccc0763cb7deacb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...