Kirsten Doyle

In a newly discovered phishing campaign, malicious actors are using malicious PDF files to target mobile device users in potentially more than 50 countries. Dubbed the “PDF Mishing Attack,” the campaign exploits the widespread trust in PDFs as a secure file format, revealing new vulnerabilities in mobile platforms. The phishing operation masquerades as the United States Postal Service (USPS) to gain the trust of users and fool recipients into downloading the malicious PDFs. Once opened, the hidden links redirect victims to phishing pages that are designed to steal credentials.   Exploiting Humans According to Zimperium’s zLabs team, who discovered the campaign,…

Homebrew, the popular open-source macOS and Linux package manager has become the latest victim of a malvertising campaign to distribute information-stealing malware. Security researcher Ryan Chenkie uncovered the scheme, which leverages fake Google ads to deliver malware that compromises user credentials, browser data, and cryptocurrency wallets. The Malware Behind the Campaign AmosStealer (Atomic), a notorious information-stealing malware designed to target macOS systems, is the malicious software at the center of this campaign. Sold as a subscription service for only $1,000 per month, AmosStealer has become a popular tool among malefactors targeting Apple users. It has also been spotted in other…

In a new and ongoing large-scale cyber campaign, Qualys researchers have uncovered a variant of the infamous Mirai botnet called the Murdoc Botnet. This variant exploits vulnerabilities in widely used AVTECH Cameras and Huawei HG532 routers, allowing malicious actors to compromise devices and build vast botnet networks for additional malicious activities. “The Mirai botnet was first publicly identified in late August 2016, and its effects are still felt today,” says Jason Soroko, Senior Fellow at Sectigo. “The threat actors have identified widespread entry points into enterprise and consumer networks, demonstrating that a single outdated or unpatched device can compromise an…

A concerning security flaw has been identified in OpenAI’s ChatGPT API, allowing malicious actors to execute Reflective Distributed Denial of Service (DDoS) attacks on arbitrary websites. This vulnerability, rated with a high severity CVSS score of 8.6, stems from improper handling of HTTP POST requests to the endpoint https://chatgpt.com/backend-api/attributions. A Reflection Denial of Service attack leverages a potentially legitimate third-party component to redirect attack traffic toward a targeted victim. The API lets users submit a list of hyperlinks via the urls parameter. However, due to poor input validation, the API fails to check for duplicate hyperlinks or enforce a limit…

Cybersecurity researchers from Sekoia have discovered a new Adversary-in-the-Middle (AiTM) phishing kit named “Sneaky 2FA,” targeting Microsoft 365 accounts. First discovered in December last year, this phishing kit has been active since at least October 2024 and is distributed as a Phishing-as-a-Service (PhaaS) through a Telegram bot called “Sneaky Log.” Subscribers receive an obfuscated version of the source code, allowing them to deploy the phishing kit independently. Bypassing 2FA This scourge has several key features: Readily Available for Purchase Elad Luz, Head of Research at Oasis Security, says this threat is particularly deceptive for several reasons. “The links in the phishing…

Today marks the enforcement of the Digital Operational Resilience Act (DORA), a regulation aimed at strengthening the financial sector’s defenses against cyber threats and operational risks. With its focus on ICT risk management, incident reporting, and operational resilience, DORA sets a new benchmark for compliance and preparedness across Europe’s financial institutions and beyond. But what does this mean for banks, financial service providers, and their extended networks? How are entities preparing to meet these robust standards, and what challenges lie ahead? Industry leaders share their insights, offering guidance on navigating this regulatory milestone while leveraging it as a catalyst for…

In an international effort, the US Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have successfully eliminated a sophisticated malware threat known as “PlugX” from over 4,200 computers across the United States. The malware, used by bad actors sponsored by the People’s Republic of China (PRC), has targeted global victims since 2014. The multi-month operation, which involved collaboration with French law enforcement and the cybersecurity company Sekoia.io, was authorized by court orders issued in the Eastern District of Pennsylvania. Hackers linked to the PRC, operating under the aliases “Mustang Panda” and “Twill Typhoon,” exploited the PlugX malware…

A sophisticated Python-based backdoor, potentially developed using AI, has been identified as a critical tool for RansomHub affiliates to infiltrate and maintain access to compromised networks. The discovery, made by Andrew Nelson, Principal Digital Forensics and Incident Response (DFIR) Consultant at GuidePoint Security, reveals new tactics being used by ransomware gangs. A Lucrative Model RansomHub, a Ransomware-as-a-Service (RaaS) operation that debuted in February 2024, has rapidly gained notoriety in the cybercrime ecosystem. Known for its generous affiliate payment structure and multi-platform capabilities, the group is a formidable threat to entities worldwide. RansomHub offers a generous 90/10 payment split, allowing affiliates…

As January reaches its midpoint, more cybersecurity experts have weighed in on what the year ahead holds for the industry. From the rapid advancement of artificial intelligence to evolving strategies in application security and a renewed focus on education and workforce training, 2025 promises to be a transformative year. Entities in every sector face a growing need to adapt to sophisticated threats, regulatory changes, and an increasingly interconnected digital ecosystem. In this article, we explore the predictions shared by leading voices in cybersecurity and the innovations shaping how we protect data, systems, and people in the year ahead. Dan Bridges,…

The Wiz Incident Response team is actively addressing multiple security incidents linked to CVE-2024-50603, a critical unauthenticated remote code execution (RCE) vulnerability in Aviatrix Controller. The vulnerability was discovered by Jakub Korepta of Securing. This flaw, rated the maximum CVSS score of 10.0, poses a severe risk of privilege escalation within AWS cloud environments. Entities using Aviatrix Controller are strongly advised to apply patches immediately. Data from Wiz indicates that approximately 3% of enterprise cloud environments use Aviatrix Controller. Of these, 65% have configurations enabling lateral movement to cloud administrative permissions—a concerning statistic given the potential for widespread damage. A High-Impact Security Threat This vulnerability…