Daily News - Fevereiro (02/02 - 08/02) - 06 Semana de 2025

Information & Cyber Security, Privacy and Hacking News --- Daily Updates !! Weekly Resume...

05/02

0-Day Vulnerabilities in Microsoft Sysinternals Tools Allow Attackers To Launch DLL Injection Attacks on Windows

5 great Chrome-like browsers that put your privacy first

A Threat Actor Claims to be Selling 7,687,248 Records from Waze

A Threat Actor Claims to be Selling Access to an Unidentified Commercial and Residential Construction Organization in Taiwan

A Threat Actor Claims to be Selling Alteka Consulting Ltd

AMD fixes bug that lets hackers load malicious microcode patches

Apple’s macOS Kernel Vulnerability Let Attackers Escalate Privileges – PoC Released

AsyncRAT Campaign Uses Python Payloads and TryCloudflare Tunnels for Stealth Attacks

Chinese Hackers Attacking Linux Devices With New SSH Backdoor

CISA Adds Actively Exploited Linux Kernel Vulnerability to Known Exploited Vuln Catalog

CISA Adds Apache, Microsoft Vulnerabilities to Its Database that Are Actively Exploited in the Wild

CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog, Urges Fixes by Feb 25

CISA Releases Guidance to Protect Firewalls, Routers, & Internet-Facing Servers

CISA Releases Nine Advisories Detailing Vulnerabilities and Exploits Surrounding ICS

CISA tags Microsoft .NET and Apache OFBiz bugs as exploited in attacks

Critical Netgear Vulnerabilities Let Attackers Execute Remote Code

Critical Veeam Backup Vulnerability Let Attackers Execute Arbitrary Code to Gain Root Access

Cross-Platform JavaScript Stealer Targets Crypto Wallets in New Lazarus Group Campaign

Crypto-stealing iOS, Android malware found on App Store, Google Play

Cybercrime gang exploited VeraCore zero-day vulnerabilities for years (CVE-2025-25181, CVE-2024-57968)

Cybercriminals Eye DeepSeek, Alibaba LLMs for Malware Development

Cybercriminals Use Go Resty and Node Fetch in 13 Million Password Spraying Attempts

Deepseek in hot seat as nations gather at Paris AI Summit

Destructive Attacks on Financial Institutions Surge

Ex-Google engineer accused of stealing AI secrets for Chinese companies

Five Eyes Launch Guidance to Improve Edge Device Security

Google just changed the rules on AI ethics – guess what’s back in play?

GrubHub third-party breach exposes partial payment info

Hackers Exploit GPU Vulnerabilities to Take Complete Control of Your Device

Hackers Exploiting A Six-Year-Old IIS Vulnerability To Gain Remote Access

Hackers Exploits ADFS to Bypass MFA & Gain Access to Critical Systems

Hackers spoof Microsoft ADFS login pages to steal credentials

Hackers Using AI Agents To Validate Stolen Credit Cards

Hackers Using Fake Microsoft ADFS Login Pages to Steal Credentials

How attackers abuse S3 Bucket Namesquatting — And How to Stop Them

How to turn on Private DNS Mode on Android - and why it's a must for security

International Civil Aviation Organization (ICAO) and ACAO Breached: Cyberespionage Groups Targeting Aviation Safety Specialists

Lulzsec Arabs Defaced Multiple Websites

MacOS infostealers rising sharply: stolen data putting enterprises at risk

Major data leak at Valley News Live exposes 1.8 million records of job applicants

Mobile Malware Targeting Indian Banks Exposes 50,000 Users

More destructive cyberattacks target financial institutions

Multiple IBM Cloud Pak Vulnerabilities Let Attackers Execute Remote Code

Navigating the Future: Key IT Vulnerability Management Trends

New Veeam Flaw Allows Arbitrary Code Execution via Man-in-the-Middle Attack

NorthBay Health reports data breach impacting over 569,000 individuals

Online food ordering and delivery platform GrubHub discloses a data breach

OpenNHP: Cryptography-driven zero trust protocol

Python packages posing as DeepSeek contain nasty surprise

Ransomware Payments Decline 35% as Victims Resist Demands

Red Wolf Cyber Team Targeted the Website of UMANG - Unified Mobile Application for New Age Governance

Silent Lynx Using PowerShell, Golang, and C++ Loaders in Multi-Stage Cyberattacks

Sophisticated Phishing Campaign Targets Ukraine’s Largest Bank

Sophos Acquires Secureworks for $859 Million

Spain arrests suspected hacker of US and Spanish military agencies

SparkCat campaign target crypto wallets using OCR to steal recovery phrases

Swap EOL Zyxel routers, upgrade Netgear ones!

The API security crisis and why businesses are at risk

Threat Actors Exploiting DeepSeek’s Rise To Fuel Cyber Attacks

Threat Actors Leveraging Free Email Services To Attack Govt & Education Entities

TinyZero – Researchers Replicated DeepSeek’s R1-Zero Model for Just $30

U.S. CISA adds Microsoft .NET Framework, Apache OFBiz, and Paessler PRTG Network Monitor flaws to its Known Exploited Vulnerabilities catalog

Use payment tech and still not ready for PCI DSS 4.0? You could face stiff penalties

XRP Ledger goes offline but speculators don't seem to care

Weaponized Go Package Module Let Attackers Gain Remote Access To Infected Systems

Why honeypots deserve a spot in your cybersecurity arsenal

04/02

3 SOC Challenges Solved by Threat Intelligence

7-Zip MotW bypass exploited in zero-day attacks against Ukraine

8 steps to secure GenAI integration in financial services

A new phishing campaign is exploiting Microsoft’s legacy ADFS identity solution to steal credentials and bypass MFA

Abandoned AWS S3 Buckets Can be Reused to Hijack Global Software Supply Chain

AI-Powered Cyber Warfare, Ransomware Evolution, and Cloud Threats Shape 2025 Cyber Landscape

Aim for crypto-agility, prepare for the long haul

AMD SEV-SNP Vulnerability Allows Malicious Microcode Injection with Admin Access

Apache Cassandra Vulnerability Let Attackers Gain Access to the Data Centers Remotely

Apple Service Ticket Portal Vulnerability Exposes Millions of Users Data

AsyncRAT Abusing Python and TryCloudflare For Stealthy Malware Delivery

Beware of Fake DeepSeek PyPI Packages That Delivers Malware

Bitcoin scammers sending MMS with 3GP videos: old format surprisingly effective

California man steals $50 million using fake investment sites, gets 7 years

Canadian Charged for Stealing $65 Million in Crypto from KyberSwap and Indexed Finance

Canadian National Charged for Stealing $65 Million in Crypto

Casio and Others Hit by Magento Web Skimmer Campaign

Casio UK site compromised, equipped with web skimmer

Casio UK Web Store Hacked to Inject Customer Credit Card Stealing Scripts

Coinbase faces heavy fire as users duped for millions in social engineering scams

Community Health Center reports data breach affecting over 1 million patients

Critical Microsoft Accounts Authentication Bypass Vulnerability Let Attackers Gain Remote Access

Critical Windows OLE Zero-Click Vulnerability Let Attacker to Execute Arbitrary Code

Crypto phishing losses dropped 56% to $10.2m: ScamSniffer

Cybercriminals are using AI to target macOS in 2025

DaggerFly-Linked Linux Malware Targets Network Appliances

Dangerous Google AI phishing attack threatens 2.5 billion Gmail users

Data Breach Shakes Schools Using PowerSchool Software

FlexibleFerret Malware Attacking macOS Users, Evading XProtect Detections

Google Ads Phishing Campaign Targets Microsoft Advertisers with Sophisticated Techniques

Google Patched Linux Kernel RCE Vulnerability In Android Allow Attackers Gain Read/Write Access

Google Patches 47 Android Security Flaws, Including Actively Exploited CVE-2024-53104

GrubHub Data Breach – Customers Phone Numbers Exposed

GrubHub data breach impacts customers, drivers, and merchants

Hacker attack on Alltours: A security incident and its impact on customers and companies

Hackers Exploiting 7-Zip Zero-Day Vulnerability to Deploy SmokeLoader Malware

Hackers Hide Malware in Fake DeepSeek PyPI Packages

Hackers Using HTTP Client Tools To Takeover Microsoft 365 Accounts

How threat actors use Command and Control (C2) and data exfiltration as part of double extortion

Kenya data breach: fingers point to Moldovan firm, B2Bhint

Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access

Man charged with stealing $65 million by exploting DeFI protocols vulnerabilities

Microsoft Azure AI Face Service Elevation of Privilege Vulnerability Let Attackers Gain Network Access

Microsoft Patches Critical Azure AI Face Service Vulnerability with CVSS 9.9 Score

Microsoft SharePoint Connector Flaw Could've Enabled Credential Theft Across Power Platform

Multiple Dell PowerProtect Vulnerabilities Let Attackers Compromise System

Navigating public sector cyber risk amidst new legislation

New Attack Technique to Bypassing EDR as Low Privileged Standard User

New Tiny FUD Attacking macOS Users Bypassing Antivirus and Security Tools

North Korean ‘FlexibleFerret’ Malware Hits macOS with Fake Zoom, Job Scams

North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS

Online lottery service warns users of fraud and phishing scams

Over 1M profiles accessed in Middletown-based Community Health Center data breach

Phishing alert: how to protect your accounts against cyber attacks in Monaco

PoC Exploit Released for Active Directory Domain Services Privilege Escalation Vulnerability

Powerschool data breach impacts millions globally

Ransomware attack locks energy contractor out of financial systems for six weeks

Ransomware attack targets the New York Blood Center

Researchers Uncovers New Methods To Defend AI Models Against Universal Jailbreaks

Researchers unearth more North Korean malware variants attacking macOS

Roundcube XSS Vulnerability Let Attackers Inject Malicious Files

Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411)

Scammers break hearts, leaving lonely online daters penniless

Sophisticated Phishing Attack Bypasses Microsoft ADFS MFA

SpyCloud Pioneers the Shift to Holistic Identity Threat Protection

Surge in Infostealer Attacks Threatens EMEA Organizations' Data Security

Taiwan Bans DeepSeek AI Over National Security Concerns, Citing Data Leakage Risks

Tata Technologies reports ransomware incident; client services unaffected

TD Bank reports data breach involving unauthorized access to sensitive customer information

Texas to Establish Cyber Command Amid “Dramatic” Rise in Attacks

Threefold Increase in Malware Targeting Credential Stores

ValleyRAT Attacking Org's Accounting Department With New Delivery Techniques

What is a Ransomware scam and how you can protect yourself?

What you can do to prevent workforce fraud

Why logs aren’t enough: Enhancing SIEM with AI-driven NDR

03/02

5 Best Infrastructure as Code (IaC) Vulnerability Scanning Tools in 2025

10 Best Web Application Firewall (WAF) – 2025

39% of IT leaders fear major incident due to excessive workloads

768 CVEs Exploited in 2024, Reflecting a 20% Increase from 639 in 2023

768 CVEs Exploited in the Wild in 2024

768 Vulnerabilities Exploited in the Wild in 2024: A 20% Year-Over-Year Surge

Alibaba Cloud Storage Service Vulnerability Allows Unauthorized Data Uploads

APT37 Hackers Abusing Group Chats To Attack Via Malicious LNK File

Arm Mali GPU Kernel Driver 0-Day Vulnerability Actively Exploited in the Wild

Aussie government targets Terrorgram online network with sanctions

BadDNS: Open-source tool checks for subdomain takeovers

BeyondTrust Zero-Day Breach – 17 SaaS Customers API Key Compromised

Booking.com's CISO on Strengthening Security as Cyber-Attacks Target Travel Sector

British PM scrapped ‘dangerously obvious’ email after Russian hacking

British Prime Minister Keir Starmer's Personal Email Allegedly Hacked by Russian Operatives

ChatGPT Announces Deep Research That Handles Complex Tasks Faster Than Humans

CISA Warns of Backdoor Vulnerability in Contec Patient Monitors

Cisco Finds DeepSeek R1 Highly Vulnerable to Harmful Prompts

Coyote Malware Expands Reach: Now Targets 1,030 Sites and 73 Financial Institutions

Crazy Evil gang runs over 10 highly specialized social media scams

Crazy Evil Gang Targets Crypto with StealC, AMOS, and Angel Drainer Malware

DeepSeek: A fleeting challenger? Or a looming threat?

DeepSeek AI tools impersonated by infostealer malware on PyPI

DeepSeek exposes 2 databases containing 1m records

DeepSeek ‘incredibly vulnerable’ to attacks, research claims

DeepSeek’s popularity exploited to push malicious packages via PyPI

Devil-Traff – New Malicious Bulk SMS Portal That Fuels Phishing Attacks

DOJ, Dutch police take down group selling phishing tools to cybercriminals

Elon Musk ’s DOGE team granted ‘full access’ to sensitive Treasury systems. What are the risks?

European Police: Data Volumes and Deletion Hindering Investigations

FBI and Global Task Force Dismantle Cracked and Nulled, Seizing Millions in Stolen Dat

Globe Life data breach may have affected 850,000 more patients than previously thought

Globe Life Ransomware Attack – 850,000+ Users Personal & Health Data Exposed

Hackers Abusing AWS & Microsoft Azure To Launch Large-Scale Cyber Attacks

Hallucinating AI vs intuitive AI – which will win?

Help! We're drowning in email spam, it's about to get worse and there's nothing we can do to stop it

High-profile X Accounts Targeted in Phishing Campaign

How AI can revolutionize vulnerability research

How Builder.ai is Democratizing AI for the Next Billion Users

How to use iCloud Private Relay for enhanced privacy

Inside the North Korean Lazarus Group’s global data exfiltration operation

IntelBroker claims third data leak of Hewlett Packard Enterprise

Justice Department Disrupts Cybercrime Network Selling Hacking Tools to Organized Crime Groups

Law enforcement seized the domains of HeartSender cybercrime marketplaces

Linux 6.14 Released – 500,000 Lines of Code Modified

MediaTek Chipsets WLAN Vulnerabilities Exposes Million of Devices to Remote Attacks

Microsoft Advertisers Account Hacked Using Malicious Google Ads

Microsoft Announces AI Avatar for Teams Meeting

Microsoft Defender ditches privacy protection feature, leaving users without VPN

Microsoft kills off Defender 'Privacy Protection' VPN feature

Mizuno USA says hackers were able to breach networks, steal data for months

New Malware Campaign Mimic Tax Agencies Attacking Financial Organizations

New Phishing Attack Hijacking High-Profile X Accounts To Promote Phishing Sites

New Process Hollowing Attack Vectors Uncovered in Windows 11 (24H2)

New Windows 11 (x64) Modern Kernel Race Conditions Uncovered – PoC Released

NVIDIA GPU Display Driver Vulnerability Lets Attackers Steal Files Remotely – Update Now

Online gaming safety for kids: learn how to protect your children

Only 3% of organizations have a dedicated budget for SaaS security

Over a million patients potentially hit after another US healthcare provider hit by cyberattack

Paragon spyware campaign targeting journalists disrupted by WhatsApp

Parrot 6.3 Released With Improved Security & New Hacking Tools

Patient monitors may have some worrying security flaws

PyPI Introduces Archival Status to Alert Users About Unmaintained Python Packages

Taiwan bans government departments from using DeepSeek AI

Tata Technologies confirms ransomware attack, says investigation still ongoing

Texas is the first state to ban DeepSeek on government devices

The CISO's role in advancing innovation in cybersecurity

The Expert View: Combatting Cyber-Threats at Scale

The hidden dangers of a toxic cybersecurity workplace

The total cost of DeepSeek’s AI models exceeded $1.5 billion, report estimates

UK Announces “World-First” AI Security Standard

U.S Community Health Center Hacked – 1 Million Patients Data Stolen

Warning: Email scammers impersonating the Australian Cyber Security Centre

What Cybersecurity Can Teach Us About the Human Body

What Is Attack Surface Management?

WhatsApp users targeted by alleged zero-click attack by spyware-maker Paragon

When you ask an app “not to track” it tracks you anyway, and the data is sold

02/02

Marriott And Otelier Face Major Data Breach Settlements

Massive Healthcare Data Breach Affects 190 Million Americans

Medical Records Stolen As 1 Million Patients Hit By Healthcare Hack

PyPI adds project archiving system to stop malicious updates

Ransomware attack hit Indian multinational Tata Technologies

Ransomware Targets Tata Technologies Amid Rising Cyber Threats in India

Two PSNI officers arrested in fraud probe into data breach security payments

US seizes 39 domains tied to cybercrime group in Pakistan

Using Quick-Text Replies Can Expose You to Smishing Scams—Here's How

Daily News - Janeiro (26/01 - 01/02) - 05 Semana de 2025