Fake GTA 6 Demo Steals Passwords and Active Browser Sessions
A 1.1 MB fake installer delivers Vidar, launches installed browsers headlessly, and copies credentials and sessions that can remain useful after cleanup.
Read article →Page 5 of 10
Latest Articles
Attackers Exploit miniOrange SAML Flaws for WordPress Admin Access
Two exploited miniOrange SAML flaws can mint WordPress admin sessions. Seven independently versioned editions make ordinary update and vulnerability checks unreliable.
Read article →
Attackers Use Android Car Updaters to Install Proxy Botnet Malware
Kaspersky traced malware on DoFun-powered car displays from a trusted updater to ad fraud and a residential proxy. DoFun says it fixed the issue but published no fixed build.
Read article →
N-able Passportal Flaw Let Malicious Pages Read Entire Password Vaults
The browser extension exposed vault tokens to untrusted page messages. Version 3.49.6 adds origin, frame, and nonce checks; later builds supersede it.
Read article →
C2Looper Backdoor Uses GitHub to Control Infected Windows PCs
C2Looper shifted from one-second HTTP beacons to GitHub C2. Hunt its OneDrive DLL, JSON control files, debug marker, commands, hashes, and two IPs.
Read article →
Public Forminator Forms Let Attackers Upload PHP to WordPress Servers
Forminator through 1.56.1 trusts forged upload settings and misses dangerous pipe-delimited MIME keys. Update to 1.57.1 and check public upload paths for executable files.
Read article →
Microsoft Defender Driver Lets Admins Delete Security Tools at Boot
Check Point reproduced kernel file and registry operations through Defender's signed BTR.sys driver. Abuse needs admin rights; behavioral telemetry separates it from cleanup.
Read article →
Suspected Ransomware Operator Used Claude Code to Steal Data and Map Backups
Gambit observed Claude Code inside six intrusions. Hunt the test VPN account, rogue LDAP listeners, backup discovery, SQL staging, and firewall restores.
Read article →
Unpatched Microsoft Configuration Manager Lets Domain Users Run Code as SYSTEM
Patch the missing upload check, then audit who can still reach the three remaining weaknesses in the Configuration Manager exploit chain.
Read article →
Attackers Exploit Zimbra Mail Flaw to Run Server Commands
Attackers are exploiting a Zimbra SNMP flaw through crafted SMTP requests. Version 10.1.20 fixes it; exposed servers need log and file review.
Read article →
Elementor Pro Upload Flaw Lets Attackers Run Code on WordPress Sites
A blank file entry bypasses Elementor Pro upload checks on exposed forms. Version 4.2.2 fixes the flaw, but patched sites still need to hunt for PHP left behind.
Read article →
Crafted IKEv2 Traffic Exposes Windows Hosts to Remote Code Execution
CISA says attackers are exploiting a Windows IKE remote-code flaw; verify April fixed builds and restrict UDP 500 and 4500 until every exposed host is patched.
Read article →
Ransomware Crews Exploit Windows Task Host Flaw for SYSTEM Access
CISA now ties CVE-2025-60710 to ransomware. The local Windows flaw needs an existing foothold, then lets an attacker elevate to SYSTEM.
Read article →
CISA Flags Exploited Ray Flaw That Runs Code Through Firefox and Safari
A hostile page can rebind its hostname to a Ray dashboard, change Firefox or Safari's User-Agent header, and submit a shell command to the Jobs API.
Read article →
45 Million wp2shell Attempts Hit WordPress in One Week
Pantheon counted 45 million wp2shell attempts in one week. Defenders should verify current WordPress builds and review exposed sites for persistent access.
Read article →
Poisoned Rust Crates Ran Malware During Developer Builds
A compromised crates.io account poisoned three Rust packages. Builds ran a downloader; 2,285 arrayref downloads now require cache, lockfile, and host checks.
Read article →Showing 62–77 of 152