Coronavirus-Themed APT Attack Spreads Malware

An advanced persistent threat APT group is leveraging the coronavirus pandemic to infect victims with a previously unknown malware, in a recently discovered campaign that researchers call “Vicious Panda.” Researchers identified two suspicious Rich Text Format files RTF — a text file format used b...

Cookiethief: a cookie-stealing Trojan for Android

We recently discovered a new strain of Android malware. The Trojan detected as: Trojan-Spy.AndroidOS.Cookiethief turned out to be quite simple. Its main task was to acquire root rights on the victim device, and transfer cookies used by the browser and Facebook app to the cybercriminals' server...

New TrickBot Variant Updates Anti-Analysis Tricks

Researchers uncovered a new variant of the TrickBot malware that relies on new anti-analysis techniques, an updated method for downloading its payload as well as adopting minor changes to the integration of its components. TrickBot is a module-based malware that, while first identified as a banki...

Spear-Phishing Attack Lures Victims With 'HIV Results'

Recently discovered spear-phishing emails are using a unique “scare-factor” lure to convince victims to open attached malicious Microsoft Excel documents: Their HIV test results. Researchers are warning of a recent campaign involving emails claiming to come from Vanderbilt University Medical...

This Week in Security News: 10,000 Users Affected by Leak from Misconfigured AWS Cloud Storage and Massive U.S. Property and Demographic Database Exposes 200 Million Records

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about how the data of train commuters in the U.K. who were using the free Wi-Fi in Network Rail-managed stations was unintentionally...

TrickBot Adds ActiveX Control, Hides Dropper in Images

The TrickBot banking trojan has gotten trickier, with the addition of a Windows 10 ActiveX control to execute malicious macros in boobytrapped documents. Michael Gorelik, researcher at Morphisec Labs, said that at least two dozen documents have come to light in the last few weeks that use ActiveX...

File upload vulnerability in aitecms

AIT Content Management System aitecms is a customer information management system developed by php + MySQL the original dream core. aitecms there is a file upload vulnerability, the vulnerability is due to publish document module to upload pictures did not do the validation, the attacker can use...

Shanghai Gesi Network Technology Co., Ltd Format Factory suffers from dll installation hijacking vulnerability

Format Factory Format Factory was founded by Shanghai Format Factory Network Co., Ltd. in February 2008, is the Internet software for global users. Ltd. Format Factory has a dll installation hijacking vulnerability, which can be exploited by attackers to cause the user's computer to be...

Beijing Sogou Information Service Co., Ltd. dll hijacking vulnerability in Sogou Browser

Sogou High Speed Browser pioneered the "Web Follow" feature, which provides website content to users in the form of subscription. Sogou Browser has a dll hijacking vulnerability, which can be exploited by attackers to remotely control a user's computer or implant a Trojan horse...

Cheetah Mobile's Cheetah Browser suffers from dll hijacking vulnerability

Cheetah Browser is an easy-to-use browsing service that will bring you convenient help in a short period of time. Cheetah Mobile's Cheetah Browser has a dll hijacking vulnerability that can be exploited by attackers to cause a user's computer to be remotely controlled or implanted with a Trojan...

Baidu Input Method of Beijing Baidu Netcom Technology Co. Ltd. suffers from dll hijacking vulnerability

Baidu Input Method is an input method that integrates handwriting, voice, win10, strokes, mouse handwriting and mobile input method. Ltd. Baidu Input Method has a dll hijacking vulnerability, which can be exploited by attackers to cause a user's computer to be remote controlled or implanted with ...

Sogou Input Method of Beijing Sogou Information Service Co.

Sogou Input Method is a Chinese character input method tool launched in June 2006 by Sogou Sogou. Sogou Input Method has a dll hijacking vulnerability, which can be exploited by attackers to remotely control a user's computer or implant a Trojan horse...

Huawei EulerOS: Security Advisory for perl (EulerOS-SA-2020-1122)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Threat Roundup for February 14 to February 21

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 14 and Feb. 21. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

ObliqueRAT: New RAT hits victims' endpoints via malicious documents

By Asheer Malhotra. Cisco Talos has observed a malware campaign that utilizes malicious Microsoft Office documents maldocs to spread a remote access trojan RAT we're calling "ObliqueRAT." These maldocs use malicious macros to deliver the second stage RAT payload. This campaign appears to target...

Threat Roundup for February 7 to February 14

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 7 and Feb. 14. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics,...

Android Trojan xHelper uses persistent re-infection tactics: here’s how to remove

We first stumbled upon the nasty Android Trojan xHelper, a stealthy malware dropper, in May 2019. By mid-summer 2019, xHelper was topping our detection charts—so we wrote an article about it. After the blog, we thought the case was closed on xHelper. Then a tech savvy user reached out to us in...

Microsoft Patch Tuesday, February 2020 Edition

Microsoft today released updates to plug nearly 100 security holes in various versions of its Windows operating system and related software, including a zero-day vulnerability in Internet Explorer IE that is actively being exploited. Also, Adobe has issued a bevy of security updates for its vario...

Emotet Trojan now exploits WiFi networks to infect nearby devices

By Sudais Asif Emotet Trojan was recently found spreading its infection using Coronavirus as bait but now it is also exploiting vulnerable WiFi networks. This is a post from HackRead.com Read the original post: Emotet Trojan now exploits WiFi networks to infect nearby devices...

Phishing Campaign Targets 250 Android Apps with Anubis Malware

A new phishing campaign is attempting to deliver sophisticated malware that can completely hijack an Android mobile device to steal user credentials, install a keylogger and even hold a device’s data for ransom. The attacks are designed for mobile inboxes and leverage the Anubis malware, a...