⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Attackers create convincing fake websites for popular apps like CNN and Avast to trick Windows users into downloading a legitimate remote management tool called O&O Syspectr. This tool, once installed and linked to the attacker's account, gives them full remote control over the victim's computer.
Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN) that allowed communication between devices. They leveraged default credentials on a controller and pivoted from a compromised wind farm to shut down a steam turbine and water treatment system.
A supply chain attack targeted BdThemes WordPress plugins by poisoning a remote JSON data stream used for promotional banners. The injected cross-site scripting payload created rogue administrator accounts and installed a web shell, all without altering plugin source code.
This advisory describes a denial-of-service vulnerability in multiple F5 products, including BIG-IP Next and BIG-IP DNS. No patch exists, so F5 provides workarounds such as restricting upstream DNS servers and enabling DNS-over-TLS. Organizations should review the vendor advisory and apply mitigations.
Lures on compromised WordPress sites led to installation of Deno and a Python-based infostealerCategories: Threat ResearchTags: clickfix, Deno, WordPress