Latest Cybersecurity News and Articles

---

Persistent Magento Backdoor Hidden in XML

Attackers are using a new method for malware persistence on Magento servers. Sansec discovered a cleverly crafted layout template in the database, which was used to automatically inject malware.

---

Cybercriminals Targeting Latin America with Sophisticated Phishing Scheme

A new phishing campaign has set its eyes on the Latin American region to deliver malicious payloads to Windows systems. "The phishing email contained a ZIP file attachment that when extracted reveals an HTML file that leads to a malicious file download posing as an invoice," Trustwave SpiderLabs researcher Karla Agregado said. The email message, the company said, originates from an email

---

Google Sues App Developers Over Fake Crypto Investment App Scam

Google has filed a lawsuit against two app developers for engaging in an "international online consumer investment fraud scheme" that tricked users into downloading bogus Android apps from the Google Play Store and other sources and stealing their funds under the guise of promising higher returns. The individuals in question are Yunfeng Sun (aka Alphonse Sun) and Hongnam Cheung (aka

---

Hackers Exploit Magento Bug to Steal Payment Data from E-commerce Websites

Threat actors have been found exploiting a critical flaw in Magento to inject a persistent backdoor into e-commerce websites. The attack leverages CVE-2024-20720 (CVSS score: 9.1), which has been described by Adobe as a case of "improper neutralization of special elements" that could pave the way for arbitrary code execution. It was addressed by the company as part of

---

Phishing Attacks Targeting Political Parties, Germany Warns

"An increase of attacks can currently be assumed, particularly in light of the upcoming European elections. These may include phishing attacks to publish stolen data or documents," a BSI spokesperson told Information Security Media Group.

---

New Red Ransomware Group (Red CryptoApp) Exposes Victims on Wall of Shame

Cybersecurity researchers at Netenrich have uncovered a new ransomware group called Red Ransomware Group (Red CryptoApp). This group operates differently from typical ransomware outfits, adding a twist to their extortion tactics.

---

New HTTP/2 DoS Attack can Crash Web Servers with a Single TCP Connection

Newly discovered HTTP/2 protocol vulnerabilities called "CONTINUATION Flood" can lead to denial of service (DoS) attacks, crashing web servers with a single TCP connection in some implementations.

---

Vietnamese Threat Actor Targeting Financial Data Across Asia

Vietnamese financially motivated hackers are targeting businesses across Asia in a campaign to harvest corporate credentials and financial data for resale in online criminal markets.

---

New Latrodectus Malware Replaces IcedID in Network Breaches

While similar to IcedID, Proofpoint researchers confirmed it is an entirely new malware, likely created by the IcedID developers. Latrodectus shares infrastructure overlap with historic IcedID operations.

---

Visa Warns of New JSOutProx Malware Variant Targeting Financial Organizations

First encountered in December 2019, JsOutProx is a RAT and highly obfuscated JavaScript backdoor that allows its operators to run shell commands, download additional payloads, execute files, capture screenshots, establish persistence, and more.

---

AI-as-a-Service Providers Vulnerable to PrivEsc and Cross-Tenant Attacks

New research has found that artificial intelligence (AI)-as-a-service providers such as Hugging Face are susceptible to two critical risks that could allow threat actors to escalate privileges, gain cross-tenant access to other customers' models, and even take over the continuous integration and continuous deployment (CI/CD) pipelines. "Malicious models represent a major risk to AI systems,

---

An MP who gives out colleagues’ numbers to blackmailers. Isn’t William Wragg just right for this Tory party? | Marina Hyde

The ‘senior Tory’ has issued a self-flagellating apology, but he still has the whip – and Sunak’s low bar sinks lowerWhere to start with Westminster’s latest scandal, which – without wishing to speculate on spoilers – I suggest you formally label as “developing”? Blowing his own cover in it is William Wragg, MP for Hazel Grove in Greater Manchester, and chair of the public administration and constitutional affairs committee. Aged 36, William is described as a “senior Tory” on the basis of something or other – possibly his predilection for calling for other politicians to resign on moral grounds. Mind you, these days being an MP since 2015 means you’ve seen five prime ministers. If anything, you’re a Tory grandee.Anyway, here follow the bare bones of what Wragg seems to have got himself mixed up in. Having connected with someone on Grindr, he began an exchange that led, in his own words, to his correspondent getting “compromising things on me”. Instead of going immediately to the police, as far as we know Wragg instead opted to start obliging his tormentor with the numbers of other MPs, Westminster staff and political journalists. These new targets were duly sent photos fairly early on in their own exchanges with their mystery correspondent, and – incredibly and yet entirely credibly – at least two MPs then responded by sending explicit pictures themselves.Marina Hyde is a Guardian columnistDo you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here. Continue reading...

---

Talent shortage is leading to automation and outsourcing

A new report discusses trends in automation and outsourcing within IT teams. 

---

Senior Tory MP to keep whip during sexting scandal investigation

Party source says William Wragg will not face suspension for now after giving phone numbers of colleagues to Grindr app contactUK politics – latest updatesA senior Conservative MP will keep the whip while the party investigates his role in a sexting scandal.A Conservative source said William Wragg, the Tory MP for Hazel Grove, would not be suspended from the party whip for now amid concerns that he is also a victim. Continue reading...

---

CISO Perspectives on Complying with Cybersecurity Regulations

Compliance requirements are meant to increase cybersecurity transparency and accountability. As cyber threats increase, so do the number of compliance frameworks and the specificity of the security controls, policies, and activities they include. For CISOs and their teams, that means compliance is a time-consuming, high-stakes process that demands strong organizational and

---

From PDFs to Payload: Bogus Adobe Acrobat Reader Installers Distribute Byakugan Malware

Bogus installers for Adobe Acrobat Reader are being used to distribute a new multi-functional malware dubbed Byakugan. The starting point of the attack is a PDF file written in Portuguese that, when opened, shows a blurred image and asks the victim to click on a link to download the Reader application to view the content. According to Fortinet FortiGuard Labs, clicking the URL

---

Bing Ad for NordVPN Leads to SecTopRAT

A very recent malvertising campaign was found impersonating the popular VPN software NordVPN. A malicious advertiser is capturing traffic from Bing searches and redirecting users to a decoy site that looks almost identical to the real one.

---

Fake Lawsuit Threat Exposes Privnote Phishing Sites

A cybercrook who has been setting up websites that mimic the self-destructing message service privnote.com accidentally exposed the breadth of their operations recently when they threatened to sue a software company.

---

Byakugan – The Malware Behind a Phishing Attack

In January 2024, FortiGuard Labs collected a PDF file written in Portuguese that distributes a multi-functional malware known as Byakugan. While investigating this campaign, a report about it was published.

---

New Wave of JSOutProx Malware Targeting Financial Firms in APAC and MENA

Financial organizations in the Asia-Pacific (APAC) and Middle East and North Africa (MENA) are being targeted by a new version of an "evolving threat" called JSOutProx. "JSOutProx is a sophisticated attack framework utilizing both JavaScript and .NET," Resecurity said in a technical report published this week. "It employs the .NET (de)serialization feature to interact with a core