î ‚Jul 25, 2025î „Ravie LakshmananMalware / Cloud Security Researchers have uncovered two separate malware campaigns that exploit vulnerabilities and misconfigurations in cloud environments to distribute cryptocurrency miners. The first campaign, named Soco404, and the second one, named Koske, have been identified …
The Kathmandu center of excellence provides SecurityPal with a cost-effective solution that allows for human involvement while remaining competitive in pricing. Find out more about how this center benefits SecurityPal by reading the full article.
î ‚Jul 23, 2025î „Ravie LakshmananSoftware Integrity / DevSecOps Google recently unveiled the launch of a groundbreaking initiative known as OSS Rebuild to enhance the security of open-source package ecosystems and mitigate software supply chain attacks. Matthew Suozzo from the Google Open …
114 Google has recently fixed a critical zero-day vulnerability in its Chrome browser that allowed for sandbox escape. The company has released the patch for Chrome on Desktop and Android devices along with several other bug fixes. It is important …
Google Patched Chrome Zero-Day That Allowed Sandbox Escape Read More »
î ‚Jul 21, 2025î „Ravie LakshmananThreat Intelligence / Authentication Cybersecurity researchers have uncovered a new attack method that allows threat actors to weaken Fast IDentity Online (FIDO) key protections by tricking users into approving authentication requests from fake company login portals. FIDO …
PoisonSeed Hackers Bypass FIDO Keys Using QR Phishing and Cross-Device Sign-In Abuse Read More »
î ‚Jul 20, 2025î „Ravie LakshmananZero-Day / Vulnerability A critical security vulnerability in Microsoft SharePoint Server has been weaponized as part of an “active, large-scale” exploitation campaign. The zero-day flaw, known as CVE-2025-53770 (CVSS score: 9.8), is a variant of CVE-2025-49706 (CVSS …
î ‚Jul 18, 2025î „Ravie LakshmananSurveillance / Mobile Security Cybersecurity experts have brought to light a mobile forensics tool known as Massistant utilized by law enforcement agencies in China to extract data from confiscated mobile devices. The tool, believed to be an …
î ‚Jul 18, 2025î „Ravie LakshmananBotnet / Network Security Google recently took legal action in New York federal court against 25 unidentified individuals or entities in China for allegedly operating the BADBOX 2.0 botnet and residential proxy infrastructure. The BADBOX 2.0 botnet …
Google Sues 25 Chinese Entities Over BADBOX 2.0 Botnet Affecting 10M Android Devices Read More »
The Taiwanese semiconductor industry has been targeted by spear-phishing campaigns carried out by three Chinese state-sponsored threat actors. “Targets of these campaigns ranged from organizations involved in the manufacturing, design, and testing of semiconductors and integrated circuits, wider equipment and …
