A naukri.com initiative
Hacking News
Securityaffairs
1h
58
Image Credit: Securityaffairs
CISA warns of RESURGE malware exploiting Ivanti flaw
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns of RESURGE malware, targeting a vulnerability in Ivanti Connect Secure (ICS) appliances.
- RESURGE malware exploits the CVE-2025-0282 flaw in Ivanti Connect Secure appliances and has been used in attacks.
- The malware creates web shells, bypasses integrity checks, and facilitates credential harvesting and privilege escalation.
- CISA provides details about the malicious Linux shared object file 'libdsupgrade.so' and the log-tampering variant of 'SPAWNSLOTH' associated with the RESURGE malware.
Read Full Article
3 Likes
Hackingblogs
10h
253
Image Credit: Hackingblogs
Vroom Leaked 30000+ Australians Bank Detail Are Exposed And ID’S Leaked
- Australia's car loan marketplace Vroom by YouX experienced a security breach in which 27,000 driver's licenses, Medicare cards, and partial credit card information were made public.
- The breach involved a non-password-protected Amazon S3 database that contained personal information such as bank statements, employment data, and Medicaid cards.
- The exposed data poses risks of identity theft and fraud, and cybercriminals could potentially use the information for phishing scams or creating fake accounts.
- To prevent similar incidents, cybersecurity researcher Jeremiah Fowler suggests implementing data minimization policies, active monitoring, and anomaly detection systems.
Read Full Article
15 Likes
Securityaffairs
11h
126
Image Credit: Securityaffairs
Sam’s Club Investigates Alleged Cl0p Ransomware Breach
- Sam's Club, a Walmart-owned membership warehouse club chain, is investigating the alleged Cl0p ransomware security breach.
- The Cl0p ransomware group listed Sam's Club among its victims, accusing the company of ignoring security.
- Sam's Club announced that it is actively investigating the matter, but has seen no evidence of a breach.
- In December 2024, the Cl0p ransomware group claimed to have breached multiple companies through the Cleo file transfer software vulnerability.
Read Full Article
7 Likes
Hackersking
18h
82
Image Credit: Hackersking
How To Use Remote Access Trojan AndroRAT | All Errors Solved
- AndroRAT is a free software that allows remote control of Android devices.
- It can be used responsibly in penetration testing.
- Before using AndroRAT, you need a computer running Windows or Linux, JDK, and a port forwarding service.
- AndroRAT can be used to generate a malicious APK, gain remote access, and perform various actions on the target device.
Read Full Article
4 Likes
Securityaffairs
1d
319
Image Credit: Securityaffairs
FBI and DOJ seize $8.2 Million in romance baiting crypto fraud scheme
- The U.S. DOJ seized over $8.2 million in USDT stolen through ‘romance baiting’ scams.
- Fraudsters tricked victims into fake investments promising high returns.
- The FBI used blockchain intelligence to trace the flow of funds through various platforms and networks.
- The seizure provides restitution for victims as the FBI traces additional addresses.
Read Full Article
19 Likes
Securityaffairs
1d
327
Image Credit: Securityaffairs
Experts warn of the new sophisticate Crocodilus mobile banking Trojan
- The new Android trojan Crocodilus exploits accessibility features and targets users in Spain and Turkey.
- Crocodilus uses overlay attacks, keylogging, and remote access to steal banking and crypto credentials.
- The trojan supports advanced keylogger capabilities and a wide range of bot and RAT commands.
- Crocodilus is linked to the threat actor 'sybra' and poses a significant threat to banks and cryptocurrency wallets.
Read Full Article
19 Likes
Medium
1d
265
Image Credit: Medium
The Dark Truth About Instagram: Why You Need to Make Your Account Hacking-Proof
- Being a content creator on Instagram comes with the risk of having your account hacked, and recovery is difficult.
- To make your Instagram account hacking-proof, using an Authenticator App for 2FA is recommended.
- Additionally, it is essential to avoid logging into Instagram from unofficial apps or sketchy websites
- Regular security checkups, using unique and complex passwords, and being cautious of phishing emails are also important preventive measures.
Read Full Article
15 Likes
Securityaffairs
2d
277
Image Credit: Securityaffairs
Crooks are reviving the Grandoreiro banking trojan
- Crooks are reviving the Grandoreiro banking trojan.
- Grandoreiro is a modular backdoor with various capabilities including keylogging, command execution, and web-injects.
- The trojan has been active since 2016 and initially targeted Brazil but expanded to Mexico, Portugal, and Spain.
- The recent phishing campaigns use VPS hosting, obfuscation, and malicious ZIP files to evade detection and steal credentials.
Read Full Article
16 Likes
Idownloadblog
2d
341
Image Credit: Idownloadblog
Ian Beer publishes in-depth analysis of BLASTPASS zero-click iMessage exploit from 2023
- Google Project Zero researcher Ian Beer has published an in-depth analysis of the BLASTPASS zero-click iMessage exploit.
- The exploit allowed attackers to compromise iPhones and iPads without any user input, by sending malicious images via iMessage.
- Beer's analysis highlights the need for sandboxing to treat all incoming attacker-controlled data as untrusted, rather than simply trusting file extensions.
- While the BLASTPASS exploit has been patched by Apple, the analysis suggests similar attacks may continue to be developed in the future.
Read Full Article
20 Likes
Securityaffairs
11h
154
Image Credit: Securityaffairs
Security Affairs newsletter Round 517 by Pierluigi Paganini – INTERNATIONAL EDITION
- FBI and DOJ seize $8.2 Million in romance baiting crypto fraud scheme
- Experts warn of the new sophisticate Crocodilus mobile banking Trojan
- Russian authorities arrest three suspects behind Mamont Android banking trojan
- Mozilla fixed critical Firefox vulnerability CVE-2025-2857
Read Full Article
9 Likes
Hackernoon
1d
3
Image Credit: Hackernoon
Hallucination by Design: How Embedding Models Misunderstand Language
- Text embeddings are crucial for converting words and sentences into numerical vectors to capture their meaning, used widely in NLP systems.
- Despite their prevalent use, there's a lack of comprehensive understanding of how embedding models operate practically, leading to errors and suboptimal user experiences.
- Issues like missing negations, numerical illiteracy, insensitivity to capitalization, and the handling of spaces and references pose significant challenges in embedding model behavior.
- Industries such as Retail, Medical Care, and Finance can benefit significantly from addressing and understanding these embedding model flaws.
- The article highlights various problematic scenarios, including issues with case sensitivity, numerical distinctions, negations, spaces, references, counterfactuals, and ranges.
- The author outlines a testing framework to evaluate how embedding models handle different text variations and emphasizes the importance of real-world testing before deployment.
- Recommendations include building safeguards for critical blind spots, combining multiple techniques, and being transparent with users about the system limitations.
- Understanding that embedding models interpret language through statistical patterns rather than human-like comprehension is crucial for improving system performance.
- Acknowledging and designing around these inherent blind spots in embedding models can lead to more effective and reliable language processing systems.
- Further investigation into other cases of model limitations and their implications will be covered in the subsequent post by the author.
- The article emphasizes the importance of recognizing and addressing the limitations of embedding models to enhance the efficiency and reliability of language processing systems.
Read Full Article
Like
Gizchina
1d
176
Image Credit: Gizchina
Hackers Steal Data and Blackmail U.S. Hospitals in Oracle Breach
- Hackers breached Oracle's servers, stole sensitive patient data, and blackmailed several US medical institutions.
- The breach highlights security concerns in the healthcare sector and the need for improved security protocols for patient records.
- Oracle notified affected firms and authorities are investigating the ransom demands.
- The incident emphasizes the importance of collaboration between healthcare and technology companies to protect patient data and privacy.
Read Full Article
10 Likes
Guardian
1d
320
Image Credit: Guardian
Birthday freebies: how to cash in on UK retailers’ gifts and discounts
- Signing up for loyalty programs and newsletters can help access freebies and discounts from retailers on your birthday.
- Various retailers offer free treats on birthdays with certain conditions, such as Greggs providing a free treat through their app.
- Beauty brands like Space NK and Rituals offer free gifts for birthdays upon joining their loyalty programs.
- Hotel Chocolat and Lindt provide discounts or free chocolates on birthdays through their membership programs.
- Restaurants like Burger King and Zizzi offer free meals or discounts on birthdays upon joining their rewards programs.
- Fashion retailers like H&M and Nike provide discounts on birthdays through their membership programs.
- Signing up for these programs may lead to data collection and potential privacy risks.
- Experts recommend using caution, creating separate email addresses for sign-ups, and being aware of terms and conditions.
- Taking steps like strong passwords, reading terms, and controlling app permissions can help protect personal information.
- Uninstalling unnecessary apps is advised to prevent ongoing data collection without consent.
Read Full Article
19 Likes
Idownloadblog
2d
315
Image Credit: Idownloadblog
Technical analysis by Verichains confirms sandbox escape use by certain banking apps to detect TrollStore, jailbreak apps
- Certain banking apps in the Apple App Store are using 0-day sandbox escape technique to detect unfavorable apps on users' devices.
- Finance security firm Verichains conducted an analysis and identified at least two banking apps using this technique: BIDV SmartBanking and Agribank.
- The apps are exploiting a private iOS API to check for the presence of certain apps, including popular package manager apps, jailbreak apps, and TrollStore.
- Using private APIs without user consent violates Apple's guidelines and risks app removal from the App Store.
Read Full Article
18 Likes
Securityaffairs
2d
216
Image Credit: Securityaffairs
Mozilla fixed critical Firefox vulnerability CVE-2025-2857
- Mozilla has addressed a critical vulnerability, CVE-2025-2857, in its Firefox browser for Windows.
- The vulnerability, which is similar to the one exploited in Chrome as a zero-day, could allow a sandbox escape.
- The flaw impacted Firefox and Firefox ESR, and was fixed in versions 136.0.4, 115.21.1, and 128.8.1.
- Mozilla is not aware of any active attacks exploiting the vulnerability at this time.
Read Full Article
13 Likes
For uninterrupted reading, download the app