ndpoint security company McAfee warns of five malicious Chrome extensions designed to track users’ browsing activity and inject code into ecommerce platforms.
Malicious Plugins Found on 25,000 WordPress Websites: Study
Researchers at Georgia Institute of Technology have identified malicious plugins on tens of thousands of WordPress websites.
Iranian Government Hackers Exploit Log4Shell in SysAid Apps for Initial Access
A threat group linked to the Iranian government appears to be the first to exploit the Log4Shell vulnerability in SysAid applications for initial access to the targeted organizations.
New ‘Agenda’ Ransomware Customized for Each Victim
Cybersecurity company Trend Micro is raising the alarm on a new ransomware family called Agenda, which has been used in attacks on organizations in Asia and Africa.
Written in the Golang (Go) cross-platform programming language, the threat has the ability to reboot systems in safe mode and to stop server-specific processes and services.
Musk Lawyers Seize on Twitter Whistleblower Revelations
Elon Musk’s lawyers jumped Wednesday on the revelations of a Twitter whistleblower to try to force the platform to surrender vast amounts of information for their fight to cancel the billionaire’s buyout bid.
Microsoft Details New Post-Compromise Malware Used by Russian Cyberspies
Microsoft this week published technical details on ‘MagicWeb’, a new post-exploitation tool used by Russia-linked cyberespionage group APT29.
Old, Inconspicuous Vulnerabilities Commonly Targeted in OT Scanning Activity
Data collected by IBM shows that old and inconspicuous vulnerabilities affecting industrial products are commonly targeted in scanning activity seen by organizations that use operational technology (OT). SecurityWeek has talked to several experts to find out what this data means and determine the threat posed by these security holes.
Backdoors Found on Counterfeit Android Phones
Russian cybersecurity firm Doctor Web has identified multiple backdoors on the system partitions of several Android devices that are counterfeit versions of popular phones.
Fake DDoS Protection Prompts on Hacked WordPress Sites Deliver RATs
Website security firm Sucuri is warning of an increase in fake distributed denial-of-service (DDoS) protection notifications that lead to the delivery of malware.
DDoS protection notifications are web pages that the browser serves to users when checks are performed to verify that the visitor is indeed a human and not a bot or part of a DDoS attack.
Google Blocks Record-Setting DDoS Attack That Peaked at 46 Million RPS
In June 2022, Google mitigated a Layer 7 distributed denial-of-service (DDoS) attack that peaked at 46 million requests per second (RPS).
Disclosed this week, this is the third HTTPS attack this year to reach tens of millions of RPS, after two lower-volume assaults were mitigated by Cloudflare.
