12,194guides5,441members
8 Octporterneuman.mx: PowerShell and JavaScript files tied to the AveMaria remote access trojan, and what to do8 Octdonutclientsmods.xyz: fake DonutSMP Minecraft mods tagged SilentNet, and what to do if you ran one8 Octsqpengg.com: a server handing out crypted PowerShell scripts, and what to do if one ran on your PC8 Octdonutsmpcheats.org: fake Minecraft cheat mods with the SilentNet stealer, and what to do if you installed one8 Octmaciejbi.hosting24.pl: a hosting subdomain that served Remcos scripts and a stego picture, and what to do if your PC fetched them8 Oct87130921-60-20220830152356.webstarterz.com: an open folder serving Formbook and XWorm PowerShell scripts, and what to do if one ran8 Octficus.in: picture files hiding the Remcos remote access trojan, and what to do if a script fetched them8 OctOpenDrive virus: why web.opendrive.com shows up in malware alerts, and what to do if a file from it installed Remcos

The FBI and Secret Service warn that the FortiBleed credential-harvesting campaign is…

Malware news
· in brief

The FBI and Secret Service warn that the FortiBleed credential-harvesting campaign is still active and is targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. The agencies say attackers are scanning exposed devices, using stolen credentials, and may be passing access on to ransomware groups. Windows users in small offices should make sure their VPN and admin passwords are changed, active sessions are ended, and device logs are checked for suspicious activity.

The Hacker NewsFBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials

Source: thehackernews.com

Share
FacebookXLinkedInBy e-mailCopy link
SaveReport
1 comment

…

More in this rubric
all →
Malware news
· in brief

Malwarebytes Labs reports that attackers compromised infrastructure behind the .gh, .sl, and .as country-code domain namespaces and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. Google blocked the certificates in Chrome and worked with certificate authorities to revoke them. Windows users should keep their browser and operating system updated and never bypass certificate warnings.

Malwarebytes LabsAttackers hijack country-code domains to impersonate Google and other services

Source: malwarebytes.com

Share
FacebookXLinkedInBy e-mailCopy link
SaveReport
Malware news
· in brief

The Hacker News reports that 16 malicious Firefox extensions were found posing as Rabby and OKX Wallet tools to steal cryptocurrency wallet recovery phrases and private keys. The add-ons intercepted those secrets during wallet import flows and sent them to attacker-controlled Cloudflare Workers. Users who installed any of the extensions and entered a real recovery phrase or private key should assume compromise and move their assets from a clean system.

The Hacker News16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases

Source: thehackernews.com

Share
FacebookXLinkedInBy e-mailCopy link
SaveReport
Malware news
· in brief

The Hacker News reports that a malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, without a macro warning. The attack works only when Java support is enabled. LibreOffice has already fixed the flaw, and Apache OpenOffice users should turn off Java or avoid opening spreadsheets they do not trust.

The Hacker NewsLibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings

Source: thehackernews.com

Share
FacebookXLinkedInBy e-mailCopy link
SaveReport
5,441 members already hereReading, writing, commenting and voting. 0 verified · 166 joined this year
All membersJoin