3+ day, 18+ hour ago   (383+ words) MantaxOtax Android malware has combined file encryption with extensive surveillance, letting attackers steal messages, credentials and device data while restricting access to infected phones. In a technical write up published on September 9, Zimperium's zLabs team linked the malware to Indonesian…...

4+ day, 16+ hour ago   (454+ words) A team of researchers at Calif, a cybersecurity startup based in Palo Alto, California, has built a tool capable of hacking Android and iOS phones via a simple incoming call. The hacking tool, dubbed WeWorm, relies on the exploitation of…...

4+ day, 17+ hour ago   (455+ words) A ClickFix campaign has shifted from tricking users into running commands on their computers to persuading them to inject malicious JavaScript into their own browsers, in a scheme aimed at people willing to commit fraud. Cisco Talos said in research…...

1+ week, 4+ day ago   (405+ words) A phishing-as-a-service (PaaS) operation has continued generating new campaigns despite a coordinated takedown effort, with more than 700 new phishing pages identified within a month of the disruption. Group-IB said its researchers had tracked the Outsider Phishing Kit, operated by a…...

1+ week, 3+ day ago   (440+ words) A member of Serbia's student protest movement has been infected with NSO Group's Pegasus spyware through an iMessage zero-click exploit, according to a forensic investigation by the Citizen Lab and the SHARE Foundation. The Citizen Lab said it found high-confidence…...

1+ week, 3+ day ago   (425+ words) A P2P botnet thought to have been running for over two decades, has suffered significant disruption thanks to a US-led law enforcement operation. Carried out on August 31, the operation against the Sality botnet brought together authorities from Bulgaria, Hungary, Romania, and…...

2+ week, 5+ day ago   (371+ words) A phishing platform dubbed ZeroTokens allows attackers live visibility into victim sessions and the ability to change subsequent prompts in real time, allowing attacks to adapt in real time while targeting credentials and financial information. The platform allowed an operator…...

2+ week, 5+ day ago   (298+ words) Fake recruiter scams have been targeting corporate credentials on mobile devices, using full-screen login pages and pre-qualification checks to reject personal email addresses and focus on enterprise accounts. The August 24 research found that the campaigns had persisted across a range…...

2+ week, 5+ day ago   (310+ words) A large-scale malware-spreading scheme targeting Minecraft players has continued to evolve despite the takedown of the threat actor’s malicious infrastructure in July. In a new report, researchers at McAfee shared that over 6300 attempts to access malicious sites linked to the…...