Cybersecurity researchers have disclosed multiple critical security vulnerabilities in Chaos Mesh that, if successfully exploited, could lead to cluster takeover in Kubernetes environments. “Attackers need only minimal in-cluster network access to exploit these vulnerabilities, execute the platform’s fault injections (such as shutting down pods or disrupting network communications), and perform
According to research from two ethical hackers, Restaurant Brands International (RBI) has security flaws that could enable a malicious actor to remotely eavesdrop on orders in the drive-through.
A massive ad fraud and click fraud operation dubbed SlopAds ran a cluster of 224 apps, collectively attracting 38 million downloads across 228 countries and territories. “These apps deliver their fraud payload using steganography and create hidden WebViews to navigate to threat actor-owned cashout sites, generating fraudulent ad impressions andRead More »SlopAds Fraud Ring Exploits 224 Android Apps to Drive 2.3 Billion Daily Ad Bids
At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentialsRead More »Self-Replicating Worm Hits 180+ Software Packages
Vega provides security analytics and operations solutions designed to help organizations detect and respond to threats. The post Security Analytics Firm Vega Emerges From Stealth With $65M in Funding appeared first on SecurityWeek.
Tel Aviv, Israel-based Ray Security emerged from stealth with $11 million seed funding and a desire to change the way corporate data is protected. The funding was co-led by Venture Guides and Ibex Investors. The post Ray Security Emerges From Stealth With $11M to Bring Real-Time, AI-Driven Data Protection appearedRead More »Ray Security Emerges From Stealth With $11M to Bring Real-Time, AI-Driven Data Protection
The notorious cybercrime groups claim they are going dark, but experts believe they will continue their activities. The post Security Industry Skeptical of Scattered Spider-ShinyHunters Retirement Claims appeared first on SecurityWeek.
Cybersecurity researchers have warned of a new campaign that’s leveraging a variant of the FileFix social engineering tactic to deliver the StealC information stealer malware. “The observed campaign uses a highly convincing, multilingual phishing site (e.g., fake Facebook Security page), with anti-analysis techniques and advanced obfuscation to evade detection,” AcronisRead More »New FileFix Variant Delivers StealC Malware Through Multilingual Phishing Site
Neon Cyber argues that phishing, social engineering, and insider threats demand protections that follow users into the browser, where most attacks now begin. The post Neon Cyber Emerges From Stealth, Shining a Light Into the Browser appeared first on SecurityWeek.
Researchers devise Phoenix, a new Rowhammer attack that achieves root on DDR5 systems in less than two minutes. The post Rowhammer Attack Demonstrated Against DDR5 appeared first on SecurityWeek.
