CrowdCyber - Nostr Hypermedia

GhostPoster attacks hide malicious JavaScript in Firefox addon logos

A new campaign dubbed 'GhostPoster' is hiding JavaScript code in the image logo of malicious Firefox extensions counting more than 50,000...

CrowdCyber.com 2 months ago

Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices

Daily CyberSecurity

Sandworm’s Tactical Pivot: Russian GRU Abandons Zero-Days to Weaponize Misconfigured Edge Devices

Sandworm (APT44) has shifted tactics, favoring misconfigured edge devices over complex exploits to breach energy and telecom sectors via credential...

CrowdCyber.com 2 months ago

Browser Extension Harvests 8M Users' AI Chatbot Data

Dark Reading

Browser Extension Harvests 8M Users’ AI Chatbot Data

Urban VPN Proxy, which claims to protect users

CrowdCyber.com 2 months ago

NexusRoute Uncovered: Android RAT Impersonates Indian E-Challan via GitHub for UPI Fraud & Surveillance

Daily CyberSecurity

NexusRoute Uncovered: Android RAT Impersonates Indian E-Challan via GitHub for UPI Fraud & Surveillance

NexusRoute is a sophisticated Android RAT campaign impersonating Indian E-Challan/mParivahan via GitHub phishing. It steals UPI PINs and conducts s...

CrowdCyber.com 2 months ago

Most Parked Domains Now Serving Malicious Content

Most Parked Domains Now Serving Malicious Content – Krebs on Security

CrowdCyber.com 2 months ago

Critical FreePBX Flaw (CVE-2025-66039) Risks PBX Takeover via Authentication Bypass in ‘webserver’ Auth Mode

Daily CyberSecurity

Critical FreePBX Flaw (CVE-2025-66039) Risks PBX Takeover via Authentication Bypass in 'webserver' Auth Mode

A critical authentication bypass (CVSS 9.3) in FreePBX allows complete PBX takeover when the 'webserver' auth mode is enabled. Attackers can gain a...

CrowdCyber.com 2 months ago

Cellik Android malware builds malicious versions from Google Play apps

BleepingComputer

Cellik Android malware builds malicious versions from Google Play apps

A new Android malware-as-a-service (MaaS) named Cellik is being advertised on underground cybercrime forums offering a robust set of capabilities t...

CrowdCyber.com 2 months ago

New SantaStealer malware steals data from browsers, crypto wallets

BleepingComputer

New SantaStealer malware steals data from browsers, crypto wallets

A new malware-as-a-service (MaaS) information stealer named SantaStealer is being advertised on Telegram and hacker forums as operating in memory t...

CrowdCyber.com 2 months ago

Hackers exploit newly patched Fortinet auth bypass flaws

BleepingComputer

Hackers exploit newly patched Fortinet auth bypass flaws

Hackers are exploiting critical-severity vulnerabilities affecting multiple Fortinet products to get unauthorized access to admin accounts and stea...

CrowdCyber.com 2 months ago

5-Year Threat: Malicious NuGet Package Used Homoglyphs and Typosquatting to Steal Crypto Wallets

Daily CyberSecurity

5-Year Threat: Malicious NuGet Package Used Homoglyphs and Typosquatting to Steal Crypto Wallets

A malicious NuGet package (Tracer.Fody.NLog) stole crypto wallet data for 5 years using homoglyphs and typosquatting to evade detection. The .NET s...

CrowdCyber.com 2 months ago

Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files

Dark Reading

Flaw in Hacktivist Ransomware Lets Victims Decrypt Own Files

A new version of VolkLocker, wielded by the pro-Russia RaaS group CyberVolk, has some key enhancements but one fatal flaw.

CrowdCyber.com 2 months ago

CVE-2025-64669: Uncovering Local Privilege Escalation Vulnerability in Windows Admin Center https://www.reddit.com/r/netsec/comments/1pncz82/cve202564669_uncovering_local_privilege/

CrowdCyber.com 2 months ago

Apple Patches More Zero-Days Used in 'Sophisticated' Attack

Dark Reading

Apple Zero-Days Possibly Used in

Two Apple zero-day vulnerabilities discovered this month have overlap with another mysterious zero-day flaw Google patched last week.

CrowdCyber.com 2 months ago

PyStoreRAT Uncovered: Fileless RAT Hides in Fake GitHub Repos to Launch Invisible Attacks on Developers

Daily CyberSecurity

PyStoreRAT Uncovered: Fileless RAT Hides in Fake GitHub Repos to Launch Invisible Attacks on Developers

PyStoreRAT, a new fileless RAT, is spreading via fake GitHub repositories targeting developers. It executes as a JS implant via mshta.exe and inclu...

CrowdCyber.com 2 months ago

SoundCloud confirms breach after member data stolen, VPN access disrupted

BleepingComputer

SoundCloud confirms breach after member data stolen, VPN access disrupted

Audio streaming platform SoundCloud has confirmed that outages and VPN connection issues over the past few days were caused by a security breach in...

CrowdCyber.com 2 months ago

Hamas-Linked Hackers Probe Middle Eastern Diplomats

Dark Reading

Hamas-Linked Hackers Probe Middle Eastern Diplomats

Hamas

CrowdCyber.com 2 months ago

Critical OpenShift GitOps Flaw Risks Cluster Takeover (CVE-2025-13888) via Privilege Escalation to Root

Daily CyberSecurity

Critical OpenShift GitOps Flaw Risks Cluster Takeover (CVE-2025-13888) via Privilege Escalation to Root

A critical flaw (CVSS 9.1) in Red Hat OpenShift GitOps lets namespace admins gain root access to the cluster by manipulating ArgoCD CRs. This effec...

CrowdCyber.com 2 months ago

Critical pgAdmin RCE (CVE-2025-13780) Flaw Bypasses Fix, Allowing Server Takeover Via Malicious Database Restore

Daily CyberSecurity

Critical pgAdmin RCE (CVE-2025-13780) Flaw Bypasses Fix, Allowing Server Takeover Via Malicious Database Restore

A critical RCE flaw (CVSS 9.1) in pgAdmin bypasses security via a UTF-8 BOM parsing mismatch. It allows attackers to execute root commands during a...

CrowdCyber.com 2 months ago

VS Code Supply Chain Attack: 19 Extensions Used Typosquatting & Steganography to Deploy Rust Trojan

Daily CyberSecurity

VS Code Supply Chain Attack: 19 Extensions Used Typosquatting & Steganography to Deploy Rust Trojan

19 malicious VS Code extensions bypassed detection by hiding a Rust trojan in tampered node_modules and a fake banner.png using steganography. The ...

CrowdCyber.com 2 months ago

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

Daily CyberSecurity

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

GOLD SALEM (Storm-2603) is exploiting SharePoint via ToolShell then abusing the Velociraptor DFIR tool as a ransomware precursor. The group deploys...