CISA added the Brotli flaw to its KEV catalog, and two honeypot operators logged attempts, including one that used a broken exploit.

The post CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts appeared first on SecurityWeek.

Running at system boot, it periodically polled the update domain to execute any code served, with full privileges.

The post Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover appeared first on SecurityWeek.

Small loader code injected into the stores served a payload to visitors or did nothing to avoid detection.

The post 953 Online Stores Infected in Long-Lasting Malware Campaign appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Russia’s APT28 hit NATO defense firms, PingCAP source code stolen, ShinyHunters negotiator probe.

The post In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware appeared first on SecurityWeek.

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments.

The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.

The post Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 appeared first on SecurityWeek.

Researchers say the developer’s account was compromised in March with a GlassWorm-linked loader.

The post Hijacked Developer Account Used to Plant Stealer in OVHcloud CLI appeared first on SecurityWeek.

At least three threat actors have been abusing Cairn for persistent access and financial theft.

The post AI Platform Cairn Abused to Hack Over 100 Organizations appeared first on SecurityWeek.

Attackers paired a genuine, signed copy of Siemens Software Center with malicious DLLs to infect Windows PCs via ClickFix lures.

The post Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks appeared first on SecurityWeek.

The services remain unavailable as the company continues remediation and security validation.

The post ConnectWise Suspends Cloud Services in Response to Cyberattack appeared first on SecurityWeek.

Defenders get 15 new detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics.

The post MITRE ATT&CK v20 Catalogs AI Abuse, MFA Bypass, Water Utility Attacks appeared first on SecurityWeek.

Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.

The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.

Delivered via phishing, the malware provides reconnaissance, remote execution, and data exfiltration capabilities.

The post CikaBika Bot RAT Uses Discord for C&C appeared first on SecurityWeek.

The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT.

The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.

Expanded plugin count allows the malware to monitor users’ location, stream live audio, and interact with authenticated browser sessions.

The post XWorm RAT Evolves Into Surveillance Platform appeared first on SecurityWeek.

Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry.

The post In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years appeared first on SecurityWeek.

Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices.

The post Pre-Baked Firmware Malware Hits Budget Android Devices in 150+ Countries appeared first on SecurityWeek.

Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.

The post US Disrupts Chinese State-Sponsored Hacking Tools appeared first on SecurityWeek.

Attackers are creating new accounts and deleting existing ones and passwords to prevent legitimate access.

The post FortiBleed Attackers Locking Victims Out of Fortinet Devices appeared first on SecurityWeek.

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign.

The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek.