Page 313 - Vulnerabilities News Today

minute read Share this article: Spear-phishing emails are spreading the NimzaLoader malware loader, which some say may be used to download Cobalt Strike. The TA800 threat group is distributing a malware loader, which researchers call NimzaLoader, via ongoing, highly-targeted spear-phishing emails. While previous Twitter analysis identified this loader as a mere variant of TA800’s existing BazaLoader malware, new research cites evidence that NimzaLoader is a disparate strain — ...

minute read Share this article: The security hole in the Plus Addons for Elementor plugin was used in active zero-day attacks prior to a patch being issued. The Plus Addons for Elementor plugin for WordPress has a critical security vulnerability that attackers can exploit to quickly, easily and remotely take over a website. First reported as a zero-day bug, researchers said it’s being actively attacked in the wild. The plugin, which has more than 30,000 active installations accor...

A hybrid Monero cryptominer and ransomware bug has hit 20,000 machines in 60 days. At its previous peak in February, the Monero Miner cryptocurrency ransominer was targeting more than 2,500 users a day, disguised as an antivirus installer. Now, the tricky hybrid malware is on the rise again, this time impersonating an ad blocker and OpenDNS service. In total, it has infected more than 20,000 users in less than two months, researchers at Kaspersky warned, in a report on Wednesday. Ransomining le...

While Microsoft has already revealed that a Chinese government-linked hacking group known as Hafnium is targeting its on-premises Exchange Server software, the MIT Technology Review now reports that at least

minute read Share this article: A never-before-seen malware-dropper, Clast82, fetches the AlienBot and MRAT malware in a savvy Google Play campaign aimed at Android users. A malware dropper that paves the way for attackers to remotely steal data from Android phones has been spreading via nine malicious apps on the official Google Play store, according to researchers. The malware is part of a campaign aimed at lifting victims’ financial information, but which also allows eventual ...

Apple pushed out security updates for a memory-corruption bug to devices running on iOS, macOS, watchOS and for Safari.

A phishing attack targeting Microsoft users leverages a bogus Google reCAPTCHA system. Microsoft users are being targeted with thousands of phishing emails, in an ongoing attack aiming to steal their Office 365 credentials. The attackers add an air of legitimacy to the campaign by leveraging a fake Google reCAPTCHA system and top-level domain landing pages that include the logos of victims’ companies. According to researchers, at least 2,500 such emails have been unsuccessfully sent to senior...

According to KrebsOnSecurity, the China-based espionage group exploited four vulnerabilities in Microsoft Exchange Server email software.The

According to KrebsOnSecurity, the China-based espionage group exploited four vulnerabilities in Microsoft Exchange Server email software.The

According to KrebsOnSecurity, the China-based espionage group exploited four vulnerabilities in Microsoft Exchange Server email software.The