2025-07-03 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-45424 n/a - n/a Incorr...
ictsec.pl
macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware
Executive Summary DPRK threat actors are utilizing Nim-compiled binaries and multiple attack chains in a campaign targeting Web3 and Crypto-related businesses. Unusually for macOS malware, the thr...
Silent Push Uncovers Chinese Fake Marketplace e-Commerce Phishing Campaign
Key Findings Silent Push Threat Analysts followed a tip from Mexican journalist Ignacio Gómez Villaseñor about a threat actor targeting “Hot Sale 2025,” an annual sales event similar to “Black Fri...
Qantas confirms customer data breach amid Scattered Spider attacks
Qantas, Australia’s largest airline, disclosed a cyberattack after hackers accessed a third-party platform used by a call centre, stealing significant customer data. The breach, linked to ongoing S...
June's Dark Gift The Rise of Qwizzserial
This research uncovers the previously unknown family of Android SMS stealers identified during our previous investigation on Ajina. This family is named Qwizzserial, after the common Java package n...
Gamaredon in 2024 Cranking out spearphishing campaigns against Ukraine with an evolved toolset
Key points of this blogpost: Gamaredon refocused exclusively on targeting Ukrainian governmental institutions in 2024, abandoning prior attempts against NATO countries. The group significantl...
Exposed JDWP Exploited in the Wild What Happens When Debug Ports Are Left Open
During routine monitoring, the Wiz Research Team observed an exploitation attempt targeting one of our honeypot servers running TeamCity, a popular CI/CD tool. Our investigation determined that the...
Data breach reveals Catwatchful ‘stalkerware’ is spying on thousands of phones
A security vulnerability in a stealthy Android spyware operation called Catwatchful has exposed thousands of its customers, including its administrator. The bug, which was discovered by security r...
Cl0p cybercrime gang's data exfiltration tool found vulnerable to RCE attacks
Security experts have uncovered a hole in Cl0p’s data exfiltration tool that could potentially leave the cybercrime group vulnerable to attack. The vulnerability in the Python-based software, whic...
Uncovering DPRK Remote Workers Detecting Hidden Threats Through Internet Telemetry
Large and widely recognizable organizations around the world may be unknowingly funding North Korea’s cyber operations, and having their Intellectual Property, operational workflows, and general da...
Okta observes v0 AI tool used to build phishing sites
Okta Threat Intelligence has observed threat actors abusing v0, a breakthrough Generative Artificial Intelligence (GenAI) tool created by Vercel, to develop phishing sites that impersonate legitima...
Large Language Models (LLMs) Are Falling for Phishing Scams What Happens When AI Gives You the Wrong URL?
Key Data When Netcraft researchers asked a large language model where to log into various well-known platforms, the results were surprisingly dangerous. Of 131 hostnames provided in response to nat...
Iran
The Iranian regime’s fundamental objective is to ensure the survival and security of the Islamic Republic, which was founded in 1979 following the Iranian Revolution. This shapes – directly or indi...
International Criminal Court hit with cyber attack during NATO summit
The International Criminal Court has been targeted by a “sophisticated” cyberattack and is taking measures to limit any damage. The ICC said the incident, which happened last week during the NATO ...
Houken seeking a path by living on the edge with zero-days
In September 2024, ANSSI observed an attack campaign seeking initial access to French entities’ networks through the exploitation of several zero-day vulnerabilities on Ivanti Cloud Service Applian...
Crypto Operation Using Fake Investment Platforms Dismantled in Spain
A sophisticated transnational scheme was uncovered involving a criminal ring operating from Madrid and Latvia. The fraud campaign was structured and disguised as a legitimate investment platform, l...
Critical Vulnerability in Microsens Devices Exposes Systems to Hackers
A series of critical vulnerabilities have been discovered in MICROSENS NMP Web+, a widely used network management platform for industrial and critical manufacturing environments, putting thousands ...
Can You Trust that Verified Symbol? Exploiting IDE Extensions is Easier Than it Should Be
TL;DR Investigated IDEs: Visual Studio Code (VSCode), Visual Studio, IntelliJ IDEA, and Cursor Flaw: Ability to create files that maintain verified symbols while adding malicious functionality Expl...
Using AI to identify cybercrime masterminds
Online criminal forums, both on the public internet and on the “dark web” of Tor .onion sites, are a rich resource for threat intelligence researchers. The Sophos Counter Threat Unit (CTU) has a te...
Sinaloa drug cartel hired a cybersnoop to identify and kill FBI informants
A major Mexican drug cartel insider grassed on his fellow drug-peddlers back in 2018, telling the FBI that a cartel “hacker” was tracking a federal official and using their deep-rooted access to th...