Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Telegram Introduces Serverless Runtime for Bots, Bringing Deployment, Application Logic, and Data Under One Platform

  Telegram has rolled out Telegram Serverless, a managed serverless runtime that enables developers to deploy bot backends directly to Teleg...

All the recent news you need to know
Malware attacks
CAPTCHA CAPTCHA Security ClickFix ClickFix Attacks Cyber Attacks Hacker attack Hacker group Malware attacks

Russian Sandworm Hackers Adopt ClickFix Technique to Target Ukrainian Organizations

 

Ukraine’s Computer Emergency Response Team (CERT-UA) has issued an advisory after detecting that Russia’s advanced persistent threat (APT) group Sandworm has been using the ClickFix social engineering technique to target devices of interest. ClickFix is a relatively new method that has gained popularity among threat actors in the past year. It involves hosting CAPTCHA pages that mislead users into pasting PowerShell commands that execute malicious scripts on the targeted device.  

According to the advisory, Sandworm began using the technique in the spring of 2026 and has been using it continuously through the summer. CERT-UA researchers found ten websites hosting CAPTCHA pages that redirected users to web pages with malicious PowerShell commands. The commands downloaded Visual Basic scripts and other malicious files, which in turn deployed several malware families known to be used by Sandworm. One of the malware samples detected by CERT-UA is a Python backdoor called FreakyPoll. 

It gained initial access to the targeted system via the described technique and provided remote access to the attackers. The first-stage malware samples have been observed collecting information about the target system to determine its value. For example, the GHETTOVIBE Visual Basic script has been seen attempting to self-perpetuate by storing itself in the Windows Startup folder. Meanwhile, the SCOUTCURL PowerShell script has been collecting information about the operating system, installed software, files, and browser data and exfiltrating the data to the attackers’ infrastructure. 

If the target was valuable, the threat actors used other malware samples to gain persistent access to the system. For example, FluidLeech, a fake antivirus software, and LoadLoop, a loader, were also used in the attacks. CERT-UA researchers have also detected that the actors have been using a custom tool called SMARTAXE to improve the infrastructure used to host CAPTCHA pages. The tool has been observed calling Ethereum smart contracts to retrieve lists of domain names, which the attackers then used to compromise other websites and host malicious CAPTCHA pages. 

Besides using the ClickFix technique, CERT-UA has detected that Sandworm has been using several other methods to compromise devices. The first method, tracked under the name CowardDuck, involves compromising Android devices via malicious apps that steal files from the devices and exfiltrate the data to the attackers’ servers. In the past, Sandworm has been using pirated software to deliver malware to targeted systems and has been using social engineering techniques over the Signal messenger to trick users into installing fake apps.  

The advisory recommends that website administrators and hosting providers scan their websites for web shells and unauthorized extensions. Moreover, the administrators should check whether their websites have been modified to host CAPTCHA pages misleading users into pasting the malicious PowerShell commands.
Read more »
Zero‑Day RCE
Fastjson JSON U.S. Firms Vulnerabilities and Exploits Zero‑Day RCE

Fastjson Zero‑Day RCE Actively Targeting U.S. Companies

 

Hackers are abusing a critical Fastjson zero‑day remote code execution (RCE) flaw to compromise U.S. organizations by simply sending malicious JSON data to vulnerable Java applications. The attacks center on a vulnerability tracked as CVE‑2026‑16723 in Fastjson 1.x, an open‑source JSON parsing library widely used in Java and Spring Boot applications. 

The flaw affects versions 1.2.68 through 1.2.83 and is exploitable under default configurations, meaning attackers do not need user interaction, elevated privileges, or special deserialization gadgets to gain code execution on target servers. Threat intelligence firm ThreatBook first observed the malicious activity, with Imperva later confirming broad exploitation against firms in financial services, healthcare, computing, retail, and other industries. 

Technically, the issue lies in Fastjson’s type‑resolution logic, which performs attacker‑controlled resource lookups before enforcing AutoType restrictions. Security researchers from FearsOff showed that by abusing @type processing in Spring Boot “fat‑JAR” deployments, they could load and execute attacker‑supplied classes even when AutoType is disabled and without relying on traditional gadget chains. Alibaba’s advisory stresses that the vulnerability is exploitable on the most common Spring Boot executable JAR model launched via java -jar, and that specifying concrete classes for deserialization does not reliably mitigate the bug because payloads can hide inside generic Object or Map fields. 

What makes this zero‑day particularly dangerous is the combination of wide adoption, ease of exploitation, and lack of a direct patch for Fastjson 1.x. Imperva notes that most observed attacks currently hit U.S. organizations, with early signs in Singapore and Canada, and expects the campaign to expand globally as exploit code circulates. Fastjson 1.x is no longer actively maintained, and Alibaba has explicitly signaled that this branch is unlikely to receive a security fix, leaving thousands of applications exposed unless they are re‑engineered. 

Security vendors recommend that organizations immediately inventory applications using Fastjson 1.x and enable SafeMode via the appropriate JVM flag to hard‑block dangerous polymorphic deserialization paths. Longer term, developers are urged to either migrate to Fastjson2—which uses an allowlist‑first model and does not rely on the vulnerable @JSONType semantics—or replace Fastjson with other actively maintained JSON libraries. Until such changes are rolled out, defenders should deploy strict web application firewall rules to filter suspicious JSON payloads, monitor logs for exploitation attempts, and treat exposed services as high‑risk assets that may already be compromised.
Read more »
Vatican Click To Pray App
API Security Vulnerability Broken Access Control Click To Pray Security Flaw Cyber Security IDOR vulnerability Phishing Risk User Data Exposure Vatican App Data Leak Vatican Click To Pray App

Vatican ‘Click to Pray’ App Security Flaw Exposed Data of 700,000 Users


Approximately 700,000 personal data of Vatican users were reportedly exposed due to a critical security vulnerability in Click to Pray, causing concerns about data privacy and phishing. An independent security researcher BobDaHacker discovered in January 2026 that the backend API lacked basic authentication and access controls, leading to the discovery of the flaw. 

Researchers indicate that anyone could retrieve user information by simply altering sequential user ID numbers in API requests, thereby making sensitive data publicly accessible without authorization. It has been identified as an Insecure Direct Object Reference (IDOR) flaw, a type of access control weakness that can allow unauthorized users to manipulate object identifiers in order to gain access to restricted data. 

Using the exposed API endpoint, the researcher reported that no authentication was required, thus anybody with knowledge of the endpoint could access user records directly through a web browser, without requiring advanced technical knowledge. The information exposed was reported to include first and last names, email addresses, dates of birth, preferred language, and account information. However, cybersecurity experts caution that, even though financial information was not disclosed, email addresses combined with personal information can significantly increase the risk of targeted phishing scams and social engineering attacks. 

Additionally, the exposed records revealed the country of origin of each user, his account status, and the level of privileges he or she possessed, including whether the account belongs to an administrator or a regular user. Research findings identified that the platform's staff accounts were among the lowest-numbered user IDs, which made internal accounts accessible via the same vulnerable API. Other security flaws were also identified by the researcher. 

By assigning sequential user IDs to newly created accounts, automated requests were able to access the entire user database. Additionally, the API did not contain rate limits, which allowed attackers to collect a large number of user records without restrictions. Additionally, the validation hash used to verify emails was stored in plain text, thus providing another potential attack vector. 

Further, the researchers indicated that the vulnerable endpoint could be exploited without specialized tools, since user IDs were assigned sequentially. This allowed attackers to automate requests to enumerate the database and gather user information at a large scale. Due to the absence of authorization checks, the vulnerability represents a fundamental failure in access control rather than a sophisticated attack. 

In accordance with the disclosure, the researcher attempted to inform multiple contacts related to the application of the vulnerabilities immediately after discovery. However, despite several requests for responses, the issues were not resolved for nearly six months. Security journalist Nate Nelson of Dark Reading also contacted the developers, but did not receive a response. 

The vulnerability was independently tested prior to publication by cybersecurity publication Dark Reading. As stated in the publication, the Pope's Worldwide Prayer Network, which operates the platform, as well as La Machi Communication for Good Causes, the agency responsible for developing the application, were also contacted, but no response was received before the issue became public. 

According to the researcher, the vulnerabilities were addressed only after they were made public through media coverage. Although the researcher followed responsible disclosure practices, no formal acknowledgement was provided for the vulnerabilities. There are reportedly nearly 720,000 registered accounts on Click to Pray by July 2026, making the exposure significant despite the app's niche target audience. 

According to researchers, many faith-based application users might not be aware of cybersecurity threats, thus making them attractive targets for online scams and phishing attacks. As a result of this incident, fundamental API security measures such as authentication, authorization, rate limiting, and safe handling of sensitive information need to be implemented. Furthermore, the incident emphasizes the importance of maintaining effective vulnerability disclosure programs and responding promptly when security researchers uncover security flaws. 

Security experts point out that the incident highlights one of the most common vulnerabilities in application security. There is no doubt that broken access control is one of the most critical risks in OWASP's Top 10. Issues with IDOR vulnerabilities persist across organizations of all sizes when developers implement authentication procedures without properly enforcing authorization procedures. 

Organizations collecting personal information, including commercial businesses, nonprofit organizations, and religious institutions, should implement robust security controls and maintain effective vulnerability disclosure processes as a result of this incident. Keeping user information secure is an integral part of every organization that has been given personal information.

Click to Pray illustrates that no organization is exempt from cybersecurity risks. Using strong access controls, secure API practices, and responding to vulnerabilities promptly remain essential for protecting user data and maintaining public trust in digital platforms.
Read more »
VPNs
compromised credentials Cyber Security Emails MFA Phishing ransomware software Sophos VPNs

Phishing and Compromised Identities Replace Software Exploits as Leading Ransomware Entry Ooint, Sophos Reports





Phishing campaigns, malicious emails and compromised credentials have overtaken software vulnerability exploitation as the leading entry points for ransomware attacks, according to Sophos' State of Ransomware 2026 report, signalling that threat actors are placing greater focus on stealing identities than breaking into unpatched systems.

The report is based on responses from 2,158 IT and cybersecurity leaders across 17 countries whose organisations experienced ransomware attacks during the previous year. While ransomware groups continue to encrypt data in a large share of incidents, the findings point to a clear change in how attackers gain their initial foothold inside enterprise networks.

Malicious email accounted for 26% of ransomware attacks, making it the most common root cause identified by respondents. Phishing followed closely at 24%, while compromised credentials were responsible for another 23% of incidents. In comparison, exploited vulnerabilities accounted for 18% of attacks, a sharp decline from 32% reported in the previous edition of the survey.

Taken together, email-based attacks and stolen credentials were responsible for nearly three-quarters of reported ransomware intrusions, showing that attackers are increasingly relying on social engineering and identity compromise instead of searching for vulnerable internet-facing systems.

Sophos also found that 67% of organisations described the ransomware incident as the most serious identity-related attack they encountered during the past 12 months. Across the surveyed organisations, almost four out of five ransomware attacks originated through compromised identities, placing user accounts and authentication systems at the centre of modern ransomware operations.

The findings also challenge a common assumption about multifactor authentication. Sophos reported that MFA had already been deployed in 97% of attacks where compromised credentials were identified as the root cause, yet attackers still succeeded in gaining access.

According to the company, the figures do not mean MFA has become ineffective. Instead, they point to weaknesses in deployment and the growing sophistication of credential theft techniques. Some organisations may have protected only part of their infrastructure, leaving legacy systems, remote access services or administrative interfaces outside MFA coverage. Those gaps can provide attackers with alternative routes into corporate environments.

Attackers have also refined methods for bypassing authentication protections. Adversary-in-the-middle phishing kits can intercept authentication sessions, while stolen browser cookies and authenticated session tokens allow attackers to access accounts without repeatedly triggering MFA challenges. MFA fatigue attacks, where users are bombarded with repeated authentication requests until one is approved, continue to be used against organisations relying on push-based authentication.

Among organisations using MFA, one-time passwords, push notification applications and passkeys were the most widely deployed authentication methods. FIDO2 security keys ranked behind those options despite offering one of the strongest defences against phishing because authentication is tied to legitimate websites and cannot be replayed through fake login pages.

Although software vulnerabilities no longer ranked as the leading ransomware entry point, Sophos cautioned that organisations should not reduce their focus on patch management. Instead, the report recommends pairing vulnerability remediation with stronger identity security controls to reduce opportunities for attackers to obtain valid credentials.

To reduce the risk of email-driven intrusions, Sophos recommends deploying advanced email filtering alongside domain authentication technologies including DMARC, DKIM and SPF. These controls help organisations verify legitimate senders, detect spoofed domains and prevent fraudulent emails from reaching employees. The company also recommends regular phishing awareness training to help users identify increasingly convincing social engineering campaigns.

Beyond email security, Sophos advises organisations to strengthen identity protection through Identity Threat Detection and Response (ITDR), enforce MFA across every access point and routinely review both human and machine identities to remove unnecessary privileges, dormant accounts and outdated credentials that could be abused during an attack.

Chet Wisniewski, director and global field chief information security officer at Sophos, said organisations with stronger ransomware resilience typically rely on multiple defensive layers rather than a single security control. Network segmentation can slow lateral movement after an initial breach, Zero Trust Network Access (ZTNA) reduces dependence on traditional VPNs, and continuous threat detection gives security teams more opportunities to identify malicious activity before ransomware spreads across the network.

The report also found that ransomware operators successfully encrypted data in 56% of reported attacks. Although median ransom demands and payments have fallen compared with previous years, the findings show that attackers continue to achieve their primary objective once they obtain access. For defenders, protecting identities has become just as important as patching software, with user accounts, credentials and authentication systems now representing the most frequently targeted path into enterprise environments. 

Read more »
Malware attacks
Browser VPN Security Critical Infrastructure Cyber Attacks Cyber Security Ransomware Attacks Cybersecurity measures Malicious Software Malware attacks

US Treasury Sanctions VPN Provider Linked to Ransomware Operations

 

The United States Department of the Treasury has taken unprecedented steps by sanctioning a virtual private network (VPN) service provider and its administrator for the first time ever. The VPN was used by ransomware groups to disguise their digital footprints and launch attacks on businesses in the United States. The Treasury’s Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS) and its Ukrainian administrator, Dmytro Rashevskyi. 

In addition, the OFAC sanctioned Belarusian national Yegeniy Vladimirovich Silayev for allegedly selling cryptors – software used to camouflage ransomware and other malicious computer programs. According to the Treasury, ransomware groups that use the services of 1VPNS have already generated billions of dollars in losses for businesses and critical infrastructure in the United States. The victims of such attacks include hospitals, local governments, banks, and other organizations. 

The Treasury alleges that First VPN Service has been operating since 2014 and has been marketing itself on hacker forums as a privacy-focused provider that does not store any information on its users and does not respond to any legal requests. In addition, investigators allege that Rashevskyi used the nicknames Maksim Sorin and Roman Chabanenko to sign up for hosting services from other companies that had declined to provide services to First VPN Service due to illegal activities. 

Furthermore, the Treasury alleges that First VPN Service has been used to mask the Internet Protocol (IP) address of users who utilize the service to conceal their tracks on the web. In addition, the accused used the VPN to hide the origin of ransomware distribution, attack infrastructure, and exfiltrate data during cyber-espionage and ransomware operations. 

Silayev, who is not affiliated with First VPN Service, has been accused of selling encryption and obfuscation tools that enable malicious software to elude detection by cybersecurity software, thus increasing the software’s success rate. The sanctions imposed on the individuals and entities involved prevent them from accessing any property or funds in the United States or controlled by Americans. 

In addition, Americans are generally prohibited from dealing with them, and entities owned at least 50% by the sanctioned individuals or entities are also banned. According to the Treasury, the sanctions will disrupt ransomware cybercriminals’ ability to operate and deter organizations from supporting ransomware groups by continuing to offer their services. 

The action taken by the OFAC comes after an international law enforcement operation that dismantled First VPN Service in May 2026. During the operation, European authorities and the FBI searched 33 servers, one surface web domain, and one Tor domain, as well as a Ukrainian residence. 

In addition, investigators identified individuals who purchased the service from the company. The recent sanctions imposed by the Treasury on First VPN Service and its administrator follow the Treasury’s sanctions against the infrastructure of the 911 S5 botnet, which disrupted hundreds of thousands of computers using free VPN applications that doubled as anonymous proxy servers for cybercriminals in 2024.
Read more »
Infostealer
Cyber Fraud Fake Repositories GitHub Impersonation Attacks Infostealer

GitHub Fake Repos Spread Malware in New Infostealer Campaign

 

Cybersecurity researchers have uncovered a large-scale campaign in which hundreds of GitHub repositories were made to look like legitimate software projects while actually distributing malware. 

According to the report, the attackers created 292 fake repositories that impersonated security tools, developer utilities, macOS apps, games, and other popular software categories. Each repository included a polished README file that pushed visitors toward a download link on a separate malicious page. The tactic works because GitHub is widely trusted by developers and everyday users alike, making it an ideal place for criminals to hide harmful payloads behind a familiar interface. 

The campaign is linked to a new variant of the BoryptGrab infostealer family, which is designed to silently collect sensitive data once installed. Researchers say the malware targets passwords, cookies, payment information, browser sessions, and wallet credentials from 19 browsers and 32 cryptocurrency wallets. It also steals data from Telegram, Discord, Steam, Windows Credential Manager, and other applications. One particularly concerning detail is that the malware can bypass Chrome’s App-Bound Encryption by using code injection, showing that the operators built the payload to defeat modern browser protections. 

The attack appears to have begun in the last days of June, and most of the malicious repositories have now been removed. Even so, researchers noted that several dozen redirectors or related pages were still active at the time of reporting. That means users searching for free downloads or copies of premium tools could still stumble onto a fake repository or a spoofed landing page. The scale of the operation shows how quickly attackers can abuse open-source platforms when they know users are likely to trust project names, readmes, and download buttons without deeper verification. 

For users and organizations, the lesson is simple: treat any unsolicited GitHub download with caution. Always verify that a project comes from the official developer or vendor, and avoid installing software from repositories that rely on hidden ZIP files or external download pages. Security teams should also monitor for unusual browser credential theft, wallet activity, and suspicious outbound connections tied to newly installed software. In a threat landscape where attackers can make malicious code look polished and professional, careful source verification is one of the best defenses available.
Read more »
Subscribe to: Posts (Atom)

Featured