News Gist .News

A recently discovered trio of vulnerabilities in VMware's virtual machine products can grant hackers unprecedented access to sensitive environments, putting entire networks at risk. If exploited, these vulnerabilities could allow a threat actor to escape the confines of one compromised virtual machine and access multiple customers' isolated environments, effectively breaking all security boundaries. The severity of this attack is compounded by the fact that VMware warned it has evidence suggesting the vulnerabilities are already being actively exploited in the wild.

Broadcom has released patches for three critical vulnerabilities in its VMware products, which are already being exploited in the wild. The bugs were described as VM escape flaws and affect all supported versions of VMware ESX, vSphere, Cloud Foundation, and Telco Cloud Platform. These issues were deemed severe enough to warrant immediate attention from users, who are urged to apply the fixes as soon as possible.

Microsoft has confirmed that its Windows drivers and software are being exploited by hackers through zero-day attacks, allowing them to escalate privileges and potentially drop ransomware on affected machines. The company patched five flaws in a kernel-level driver for Paragon Partition Manager, which were apparently found in BioNTdrv.sys, a piece of software used by the partition manager. Users are urged to apply updates as soon as possible to secure their systems.

A broad overview of the four stages shows that nearly 1 million Windows devices were targeted by a sophisticated "malvertising" campaign, where malware was embedded in ads on popular streaming platforms. The malicious payload was hosted on platforms like GitHub and used Discord and Dropbox to spread, with infected devices losing login credentials, cryptocurrency, and other sensitive data. The attackers exploited browser files and cloud services like OneDrive to steal valuable information.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

A massive cybercriminal campaign has been discovered utilizing outdated and vulnerable Windows drivers to deploy malware against hundreds of thousands of devices. The attackers leveraged a signed driver, allowing them to disable antivirus programs and gain control over infected machines. This campaign is believed to be linked to the financially motivated group Silver Fox, which is known for its use of Chinese public cloud servers.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

Misconfigured Access Management Systems (AMS) connected to the internet pose a significant security risk to organizations worldwide. Vulnerabilities in these systems could allow unauthorized access to physical resources, sensitive employee data, and potentially even compromise critical infrastructure. The lack of response from affected organizations raises concerns about their readiness to mitigate potential risks.

Malicious code seems to have been introduced into two popular VSCode extensions, "Material Theme - Free" and "Material Theme Icons - Free", which have gained millions of downloads. Microsoft quickly pulled the extensions from its marketplace after finding malicious code hiding inside, but the original developers claim they were never consulted. The developer's harsh reaction has caused more harm than good, with many users potentially affected by the sudden removal of the extensions.

Microsoft's Threat Intelligence has identified a new tactic from Chinese threat actor Silk Typhoon towards targeting "common IT solutions" such as cloud applications and remote management tools in order to gain access to victim systems. The group has been observed attacking a wide range of sectors, including IT services and infrastructure, healthcare, legal services, defense, government agencies, and many more. By exploiting zero-day vulnerabilities in edge devices, Silk Typhoon has established itself as one of the Chinese threat actors with the "largest targeting footprints".

2024 has been marked as a record-breaking year for ransomware attacks, with a 65% increase in detected groups and 44 new malware variants contributing to almost a third of undisclosed attacks. The healthcare, government, and education sectors were disproportionately affected, while emerging groups like LockBit and RansomHub accounted for a significant number of incidents, highlighting the growing sophistication of cybercriminals. As organizations face escalating financial and reputational risks, the need for proactive cybersecurity measures has never been more urgent.

Businesses are being plagued by API security risks, with nearly 99% affected. Report warns vulnerabilities, data exposure, and API authentication weaknesses are key issues that are causing trouble for businesses everywhere. Businesses can mitigate API risks before they can be exploited, researchers are saying.

Hackers are exploiting Microsoft Teams and other legitimate Windows tools to launch sophisticated attacks on corporate networks, employing social engineering tactics to gain access to remote desktop solutions. Once inside, they sideload flawed .DLL files that enable the installation of BackConnect, a remote access tool that allows persistent control over compromised devices. This emerging threat highlights the urgent need for businesses to enhance their cybersecurity measures, particularly through employee education and the implementation of multi-factor authentication.

Sophisticated, advanced threats have been found lurking in the depths of the internet, compromising Cisco, ASUS, QNAP, and Synology devices. A previously-undocumented botnet, named PolarEdge, has been expanding around the world for more than a year, targeting a range of network devices. The botnet's goal is unknown at this time, but experts have warned that it poses a significant threat to global internet security.

Security researchers spotted a new ClickFix campaign that has been abusing Microsoft SharePoint to distribute the Havoc post-exploitation framework. The attack chain starts with a phishing email, carrying a "restricted notice" as an .HTML attachment, which prompts the victim to update their DNS cache manually and then runs a script that downloads the Havoc framework as a DLL file. Cybercriminals are exploiting Microsoft tools to bypass email security and target victims with advanced red teaming and adversary simulation capabilities.

A software engineer for the Disney Company unwittingly downloaded malware on his computer that turned his life upside down. The malware gave outside attackers full access to his 1Password database and session cookies, allowing them to compromise his online accounts, including his employer's Slack channel. As a result, he lost his job after Disney's forensic examination reportedly showed that he had accessed pornographic material on his work laptop in violation of company policy.

A team of Google researchers has identified a significant exploit, named "EntrySign," affecting AMD's Zen 1 through Zen 4 processors, which allows users with local admin privileges to push custom microcode updates. This vulnerability, while requiring high-level access to exploit, poses serious implications for security, as it enables users to manipulate CPU behavior and potentially weaken system protections. AMD has issued a BIOS patch to address the issue, but many CPUs remain vulnerable until updated, highlighting the ongoing challenges of CPU security management.

Amnesty International said that Google fixed previously unknown flaws in Android that allowed authorities to unlock phones using forensic tools. On Friday, Amnesty International published a report detailing a chain of three zero-day vulnerabilities developed by phone-unlocking company Cellebrite, which its researchers found after investigating the hack of a student protester’s phone in Serbia. The flaws were found in the core Linux USB kernel, meaning “the vulnerability is not limited to a particular device or vendor and could impact over a billion Android devices,” according to the report.

Layer 7 Web DDoS attacks have surged by 550% in 2024, driven by the increasing accessibility of AI tools that enable even novice hackers to launch complex campaigns. Financial institutions and transportation services reported an almost 400% increase in DDoS attack volume, with the EMEA region bearing the brunt of these incidents. The evolving threat landscape necessitates more dynamic defense strategies as organizations struggle to differentiate between legitimate and malicious traffic.

Vishing has become a prevalent tactic for cybercriminals, with 442% increase in attacks compared to the first half of 2024, according to CrowdStrike's latest report. The security firm tracked at least six campaigns involving attackers posing as IT staffers to convince employees to set up remote support sessions or share sensitive information. Help desk social engineering tactics are often used, where scammers create a sense of urgency to trick victims into divulging credentials.

A recent discovery has revealed that Spyzie, another stalkerware app similar to Cocospy and Spyic, is leaking sensitive data of millions of people without their knowledge or consent. The researcher behind the finding claims that exploiting these flaws is "quite simple" and that they haven't been addressed yet. This highlights the ongoing threat posed by spyware apps, which are often marketed as legitimate monitoring tools but operate in a grey zone.

Stalkerware apps are notoriously creepy, unethical, and potentially illegal, putting users' data and loved ones at risk. These companies, often marketed to jealous partners, have seen multiple app makers lose huge amounts of sensitive data in recent years. At least 24 stalkerware companies have been hacked or leaked customer data online since 2017.

Recently, news surfaced about stolen data containing billions of records, with 284 million unique email addresses affected. Infostealing software is behind a recent report about a massive data collection being sold on Telegram, with 23 billion entries containing 493 million unique pairs of email addresses and website domains. As summarized by Bleeping Computer, 284 million unique email addresses are affected overall.

As recent news reminds us, malicious browser add-ons can start life as legit extensions. Reviewing what you’ve got installed is a smart move. Earlier this month, an alarm sounded—security researchers at GitLab Threat Intelligence discovered a handful of Chrome extensions adding code in order to commit fraud, with at least 3.2 million users affected. But the add-ons didn’t start as malicious. Instead, they launched as legitimate software, only to be later compromised or sold to bad actors.

The NHS is investigating claims that a software flaw at Medefer compromised patient data security, as the issue was discovered in November but may have existed for several years. Medefer has stated that no patient data breach occurred and that the flaw was promptly addressed, although cybersecurity experts have raised concerns about the company's response to the vulnerability. The situation underscores the critical importance of robust cybersecurity measures in handling sensitive medical information, especially within the healthcare sector.