Latest Cybersecurity News and Articles

---

Advanced Phishing Attacks Put X Accounts at Risk

Advanced phishing attacks are putting X accounts, formerly known as Twitter, at risk. Even with two-factor authentication in place, researchers at eSentire have found that account takeovers are still possible.

---

Chrome Introduces One-Time Permissions and Enhanced Safety Check for Safer Browsing

Google has announced that it's rolling out a new set of features to its Chrome browser that gives users more control over their data when surfing the internet and protects against online threats. "With the newest version of Chrome, you can take advantage of our upgraded Safety Check, opt out of unwanted website notifications more easily and grant select permissions to a site for one time only,"

---

GSMA Plans End-to-End Encryption for Cross-Platform RCS Messaging

The GSM Association, the governing body that oversees the development of the Rich Communications Services (RCS) protocol, on Tuesday, said it's working towards implementing end-to-end encryption (E2EE) to secure messages sent between the Android and iOS ecosystems. "The next major milestone is for the RCS Universal Profile to add important user protections such as interoperable end-to-end

---

Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution

Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol. "A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a

---

US Hits Intellexa Spyware Maker With More Sanctions

The US has imposed further sanctions on Intellexa, the maker of the Predator spyware, targeting individuals and entities associated with the company due to its opaque corporate structure designed to evade accountability.

---

Update: PoC Exploit Released for Windows Hyper-V Zero-Day Vulnerability

This critical flaw, actively exploited in the wild, allows attackers to elevate privileges to SYSTEM level, posing a significant risk to organizations using Microsoft's Hyper-V virtualization technology.

---

GitLab releases security updates to fix 17 vulnerabilities

GitLab releases a security update for a critical flaw. Security leaders share advice on how organizations can secure against this vulnerability. 

---

EchoStrike: Generate Undetectable Reverse Shells, Perform Process Injection

EchoStrike features an interactive Python wizard for easy customization, various persistence techniques, binary padding for evasion, AES payload encryption, and dynamic binary download.

---

North Korean Hackers Target Cryptocurrency Users on LinkedIn with RustDoor Malware

North Korean hackers are using RustDoor malware to target cryptocurrency users on LinkedIn, posing as recruiters for legitimate decentralized finance (DeFi) companies like STON.fi.

---

Chrome Switching to NIST-Approved ML-KEM Quantum Encryption

Google is updating Chrome's post-quantum cryptography to defend against quantum computer attacks. The new encryption system, ML-KEM, replaces Kyber for enhanced security.

---

Supply Chain Attack on Google Cloud Composer Could Have Resulted in Remote Code Execution

Google has addressed a critical security flaw in Google Cloud Platform (GCP) Composer that could have allowed remote code execution via a supply chain attack known as dependency confusion.

---

Critical Vulnerability in AutoGPT Puts Over 166,000 Projects at Risk

A critical vulnerability, CVE-2024-6091 (CVSS 9. 8), has been found in AutoGPT, a popular AI tool with over 166,000 projects at risk. The flaw allows for OS Command Injection, potentially enabling unauthorized actions.

---

Rising Clipper Malware Attacks Target Cryptocurrency Users

The malicious software called ClipBankers can monitor clipboard activity and replace cryptocurrency addresses with those controlled by attackers, diverting digital asset transfers to rogue wallets.

---

Zero-Click Calendar Invite: Critical macOS Vulnerability Chain Uncovered

The vulnerability, tracked as CVE-2022-46723, enables attackers to manipulate files within the macOS Calendar app environment and execute remote code during system upgrades.

---

80% of critical infrastructure entities affected by email breaches

New research discusses the state of email security amongst critical infrastructure organizations.

---

23andMe Pledges $30 Million to the 6.4 Million People Affected by Data Breach

23andMe has pledged $30 million to compensate the 6.4 million people affected by a data breach in October 2023. The breach occurred when a hacker used stolen credentials to access a significant amount of account information, including health data.

---

Trends and Dangers in Open-Source Software Dependencies

A report by Endor Labs highlighted that, despite high remediation costs for dependency risks, function-level reachability analysis offers the best value for addressing vulnerabilities in open-source software.

---

Apple Drops Spyware Case Against NSO Group, Citing Risk of Threat Intelligence Exposure

Apple has filed a motion to "voluntarily" dismiss its lawsuit against commercial spyware vendor NSO Group, citing a shifting risk landscape that could lead to exposure of critical "threat intelligence" information.

---

6% of media websites have robust bot protection

Bot security was analyzed in a recent report by DataDome, finding that more than 65% of websites are unprotected against simple bot attacks.

---

Russia’s RT News Agency Has ‘Cyber Operational Capabilities,’ Assists in Military Procurement, State Department Says

Russia's RT news agency is involved in covert cyber operations to assist in military procurement and spread propaganda globally, according to the U.S. State Department. It has a cyber unit with operational capabilities linked to Russian intelligence.