The vulnerability of Microsoft Edge browser, related to the absence of warnings for dangerous actions, allows attackers to carry out spoofing attacks.

The vulnerability of Microsoft Edge is related to the absence of warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to carry out spear-phishing attacks...

Angry Likho: Old beasts in a new forest

Angry Likho referred to as Sticky Werewolf by some vendors is an APT group we've been monitoring since 2023. It bears a strong resemblance to Awaken Likho, which we've analyzed before, so we classified it within the Likho malicious activity cluster. However, Angry Likho's attacks tend to be...

The vulnerability of Microsoft Edge browser, related to information representation errors in the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

Microsoft Edge’s vulnerability, related to improper security checks for standard elements, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge relates to improper security checks for standard elements. Exploiting this vulnerability can allow attackers to carry out spear-phishing attacks...

The vulnerability of the Microsoft Outlook for Android client, related to information representation errors in the user interface, allows a hacker to perform spear-phishing attacks.

The vulnerability of the Microsoft Outlook for Android client is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

The vulnerability of Microsoft Edge browser, related to information representation errors in the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

North Korean Hackers Exploit PowerShell Trick to Hijack Devices in New Cyberattack

The North Korea-linked threat actor known as Kimsuky has been observed using a new tactic that involves deceiving targets into running PowerShell as an administrator and then instructing them to paste and run malicious code provided by them. "To execute this tactic, the threat actor masquerades a...

Vulnerability of operating systems macOS, iOS, iPadOS, and the Safari browser, related to information representation errors in the user interface, allowing attackers to perform spear-phishing attacks

The vulnerabilities of operating systems such as macOS, iOS, iPadOS, and the Safari browser are related to information representation errors in the user interface. Exploiting these vulnerabilities can allow attackers to perform spear-phishing attacks remotely...

North Korean APT Kimsuky Uses forceCopy Malware to Steal Browser-Stored Credentials

The North Korea-linked nation-state hacking group known as Kimsuky has been observed conducting spear-phishing attacks to deliver an information stealer malware named forceCopy, according to new findings from the AhnLab Security Intelligence Center ASEC. The attacks commence with phishing emails...

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server packages lies in the lack of measures taken to protect the structure of web pages, allowing attackers to execute spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server and Microsoft SharePoint Enterprise Server packages is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to perform a spear-phishing attack remotely...

The vulnerability of Microsoft Edge browser (based on Chromium) relates to information representation errors in the user interface, allowing attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge based on Chromium is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

PT-2025-24329

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to June 2025 Description An issue exists in the WebDAV module where external control of file names or paths in Internet Shortcut Files allows an unauthorized remote attacker to execute arbitrary code. The flaw...

A week in security (January 13 – January 19)

Last week on Malwarebytes Labs: iMessage text gets recipient to disable phishing protection so they can be phished The new rules for AI and encrypted messaging, with Mallory Knodel Lock and Code S06E01 Insurance company accused of using secret software to illegally collect and sell location data ...

Russian Star Blizzard Targets WhatsApp Accounts in New Spear-Phishing Campaign

The Russian threat actor known as Star Blizzard has been linked to a new spear-phishing campaign that targets victims' WhatsApp accounts, signaling a departure from its longstanding tradecraft in a likely attempt to evade detection. "Star Blizzard's targets are most commonly related to government...

The vulnerability of the Swift Mailer module in the Drupal CMS system, related to the use of dangerous methods or functions, allows attackers to exploit it.

The vulnerability of the Swift Mailer module in the Drupal CMS system is related to the use of dangerous methods or functions. Exploiting this vulnerability could allow a malicious actor to execute a spear-phishing attack remotely...

Russia-Linked Hackers Target Kazakhstan in Espionage Campaign with HATVIBE Malware

Russia-linked threat actors have been attributed to an ongoing cyber espionage campaign targeting Kazakhstan as part of the Kremlin's efforts to gather economic and political intelligence in Central Asia. The campaign has been assessed to be the work of an intrusion set dubbed UAC-0063 , which...

The vulnerability of the Mozilla Firefox browser and the Thunderbird email client, related to authentication procedures that allow attackers to carry out spear-phishing attacks

The vulnerability of Mozilla Firefox browser and Thunderbird email client is related to deficiencies in authentication procedures, resulting from incorrect display of the domain name in the address bar. Exploiting this vulnerability allows attackers to perform spear-phishing attacks remotely...

Python-Based NodeStealer Version Targets Facebook Ads Manager

In this blog entry, Trend Micro’s Managed XDR team discuss their investigation into how the latest variant of NodeStealer is delivered through spear-phishing attacks, potentially leading to malware execution, data theft, and the exfiltration of sensitive information via Telegram...

APT29 Hackers Target High-Value Victims Using Rogue RDP Servers and PyRDP

The Russia-linked APT29 threat actor has been observed repurposing a legitimate red teaming attack methodology as part of cyber attacks leveraging malicious Remote Desktop Protocol RDP configuration files. The activity, which has targeted governments and armed forces, think tanks, academic...

Earth Koshchei Coopts Red Team Tools in Complex RDP Attacks

APT group Earth Koshchei, suspected to be sponsored by the SVR, executed a large-scale rogue RDP campaign using spear-phishing emails, red team tools, and sophisticated anonymization techniques to target high-profile sectors...