ADMIN.FOUNDATION

  • Single Click on CAPTCHA Triggers Destructive Akira Ransomware Attack on Malicious Website

    ·

    , ,

    A sophisticated Akira ransomware attack orchestrated by the Howling Scorpius group recently left a global data storage and infrastructure company grappling with massive operational disruption all triggered by a single, seemingly innocent click on a website CAPTCHA. The compromise underscores a harsh reality: deploying advanced security tools does not guarantee security coverage or effective threat […]

    The post Single Click on CAPTCHA Triggers Destructive Akira Ransomware Attack on Malicious Website appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Teams Adds Option to Report Misidentified Threat Messages

    ·

    , ,

    Microsoft Teams is rolling out a new feature that allows users to misreport messages flagged as security threats. The capability, rolling out by the end of November 2025, targets organizations using Microsoft Defender for Office 365 Plan 2 or Microsoft Defender XDR to improve threat detection accuracy. The feature addresses a common security challenge: false […]

    The post Microsoft Teams Adds Option to Report Misidentified Threat Messages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Nova Stealer Targets macOS Users, Swaps Legit Apps to Steal Crypto Wallets

    ·

    , ,

    A sophisticated new macOS malware campaign dubbed “Nova Stealer” has emerged, targeting cryptocurrency users through an elaborate scheme that replaces legitimate wallet applications with malicious counterparts designed to harvest sensitive recovery phrases and wallet data. The threat, identified through analysis of artifacts that reference its build process, demonstrates a modular architecture that enables remote updates […]

    The post Nova Stealer Targets macOS Users, Swaps Legit Apps to Steal Crypto Wallets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Sneaky 2FA Phishing Kit with BitB Technique Attacking Users to Steal Microsoft Account Credentials

    ·

    , ,

    The Sneaky2FA phishing service has recently added a dangerous new capability to its toolkit that makes stealing Microsoft account credentials even easier for attackers.

    Push Security analysts and researchers have identified this threat operating in the wild, using a sophisticated technique called Browser-in-the-Browser (BITB) to trick users into handing over their login information.

    This development represents a troubling evolution in phishing attacks that continues to threaten organizations worldwide.

    Phishing-as-a-Service kits like Sneaky2FA have become increasingly popular in criminal circles because they lower the barrier to entry for anyone wanting to launch advanced attacks.

    These platforms operate on Telegram with fully licensed, obfuscated versions of source code that attackers can deploy independently.

    The competitive environment within the cybercriminal marketplace has driven innovation at an alarming pace, creating an arms race where attackers constantly develop new ways to bypass security controls and steal credentials.

    Push Security analysts and researchers identified the latest Sneaky2FA variant after detecting unusual activity, suggesting the tool had gained new technical capabilities.

    BITB functionality

    The addition of BITB functionality represents a significant tactical shift for the platform, combining multiple layers of deception to maximize the chances of successful credential theft.

    When users encounter this phishing attack, they first see what appears to be a legitimate Adobe Acrobat Reader document requiring them to sign in with their Microsoft account.

    After clicking the sign-in button, an embedded browser window appears, displaying what looks like an authentic Microsoft login page.

    The user is prompted to 'Sign in with Microsoft' as part of the phishing lure (Source - Push Security)
    The user is prompted to ‘Sign in with Microsoft’ as part of the phishing lure (Source – Push Security)

    However, this pop-up window is actually a fake contained within the attacker’s page. The browser window automatically adapts its appearance to match the visitor’s operating system and browser type, making the deception even more convincing to unsuspecting users.

    The technical sophistication behind this attack involves multiple evasion mechanisms designed to prevent security tools from detecting it. Before users even see the phishing page, they must pass a Cloudflare Turnstile bot protection check.

    The HTML and JavaScript code is heavily obfuscated to avoid pattern-matching detection. Additionally, the phishing domains use random 150-character URL paths and operate on compromised or old-looking websites.

    Attackers frequently rotate these domains, using them briefly before abandoning them and deploying new ones, creating a constantly moving target for traditional defenses.

    This innovation in phishing techniques demonstrates how attackers continue adapting their methods to bypass modern security controls.

    Users should remain vigilant when encountering unexpected requests to verify their identity online, particularly when pop-up windows appear requesting sensitive credentials.

    Organizations must implement detection systems capable of analyzing live pages in real time rather than relying solely on traditional defenses that examine domain reputation or static signatures.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post New Sneaky 2FA Phishing Kit with BitB Technique Attacking Users to Steal Microsoft Account Credentials appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs

    ·

    Singapore, Singapore, November 19th, 2025, CyberNewsWire The collaboration advances enterprise grade application security into decentralized ecosystems, uniting Checkmarx’s AppSec expertise with Web3 specialization by CredShields. CredShields, a leading Web3 security firm, has partnered with Checkmarx, the global leader in agentic AI-powered application security testing, to work with AI-driven smart contract audits, vulnerability research, and blockchain […]

    The post CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs

    ·

    Singapore, Singapore, November 19th, 2025, CyberNewsWire

    The collaboration advances enterprise grade application security into decentralized ecosystems, uniting Checkmarx’s AppSec expertise with Web3 specialization by CredShields.

    CredShields, a leading Web3 security firm, has partnered with Checkmarx, the global leader in agentic AI-powered application security testing, to work with AI-driven smart contract audits, vulnerability research, and blockchain security tooling from CredShields to work alongside the Checkmarx application security platform.

    As the application security market accelerates toward an expected US $55 billion by 2029, decentralized architectures introduce new attack surfaces that traditional AppSec programs are not designed to address.

    Nearly half of the largest DeFi breaches trace back to smart contract flaws, and in 2025 to date, losses from cryptocurrency service hacks already surpass US $2.1 billion and are projected to climb further.

    Research further indicates that up to 89% of smart contracts contain vulnerabilities, highlighting the need for Web3-native security standards alongside legacy security frameworks.

    Through this agreement, Checkmarx is adding CredShields as a Web3 security partner to provide customers with dedicated support for decentralized environments.

    The collaboration combines Checkmarx’s enterprise AppSec leadership with deep expertise in smart contract auditing, vulnerability assessment, and blockchain security research from CredShields, enabling organizations to extend their existing DevSecOps programs into Web3 with minimal friction.

    “This partnership represents a natural evolution in the AppSec landscape,” said Shashank, Co-founder of CredShields.

    “Together with Checkmarx, we’re delivering a seamless layer of security that protects enterprise systems, decentralized applications, and smart contracts with the same rigor and intelligence.”

    The partnership will focus on:

    • Comprehensive security coverage for decentralized applications, smart contracts, and wallets
    • AI-assisted vulnerability detection and manual audits powered by CredShields’ proprietary systems
    • Joint contributions to global security frameworks, including OWASP Smart Contract Security Standards and Smart Contract Top 10
    • Enterprise enablement to integrate Web3 security into existing DevSecOps pipelines

    “As enterprises extend their digital footprint into Web3, new attack surfaces emerge,” said Scott Sieper, Director of Product Management at Checkmarx.

    “Partnering with CredShields enables us to bring our deep AppSec expertise to blockchain environments and help organizations innovate with confidence while maintaining the same rigorous security standards they expect from Checkmarx.”

    Checkmarx and CredShields aim to redefine enterprise application security for the decentralized era, ensuring that innovation and security evolve in parallel as organizations adopt blockchain at scale.

    For more information about securing code at the speed of AI and the Checkmarx One platform, users can visit the website.

    About CredShields

    CredShields is a Web3 security firm specializing in manual smart contract audits, AI-powered vulnerability detection, and security automation across blockchain ecosystems.

    A contributor to the OWASP Smart Contract Top 10, CredShields protects leading protocols and enterprises through full-spectrum decentralized security solutions.

    Users can watch the demo: https://lnk.credshields.com/checkmarx-demo

    Contact

    CredShields

    marketing@credshields.com

    The post CredShields Joins Forces with Checkmarx to Bring Smart Contract Security to Enterprise AppSec Programs appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • EdgeStepper Implant Reroutes DNS Queries to Deploy Malware via Hijacked Software Updates

    ·

    The threat actor known as PlushDaemon has been observed using a previously undocumented Go-based network backdoor codenamed EdgeStepper to facilitate adversary-in-the-middle (AitM) attacks. EdgeStepper “redirects all DNS queries to an external, malicious hijacking node, effectively rerouting the traffic from legitimate infrastructure used for software updates to attacker-controlled infrastructure

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ServiceNow AI Agents Can Be Tricked Into Acting Against Each Other via Second-Order Prompts

    ·

    Malicious actors can exploit default configurations in ServiceNow’s Now Assist generative artificial intelligence (AI) platform and leverage its agentic capabilities to conduct prompt injection attacks. The second-order prompt injection, according to AppOmni, makes use of Now Assist’s agent-to-agent discovery to execute unauthorized actions, enabling attackers to copy and exfiltrate sensitive

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft Integrated Azure Firewall With AI-powered Security Copilot

    ·

    , ,

    Microsoft has enhanced its cloud security capabilities by integrating Azure Firewall with Security Copilot, an AI-powered security solution designed to help security teams work faster and more efficiently.

    This integration allows security analysts to investigate malicious network traffic using simple, natural-language questions rather than complex technical queries.

    Security Copilot is a generative AI tool that assists security professionals in handling critical tasks such as incident response, threat hunting, intelligence gathering, and security posture management.

    The solution operates at machine speed and scale, significantly boosting security team productivity by providing an assistive copilot experience through natural language interactions.

    Enable the Azure Firewall integration in Security Copilot
    Enable the Azure Firewall integration in Security Copilot

    Azure Firewall is Microsoft’s cloud-native network firewall security service that protects Azure workloads with built-in high availability and scalability.

    The new Security Copilot integration helps analysts investigate malicious traffic intercepted by the Intrusion Detection and Prevention System (IDPS) feature across their entire firewall group.

    Security teams can access this integration through two experiences: the standalone Security Copilot portal or the embedded Azure Copilot experience within the Azure portal.

    Retrive the top IDPS signature hits for a given AZURE FireWall
    Retrieve the top IDPS signature hits for a given AZURE FireWall

    Both options allow users to ask questions in plain English rather than writing complicated database queries. The integration offers several powerful security operations features.

    Analysts can retrieve top IDPS signature hits for specific firewalls and get enriched threat profiles for security signatures.

    Perform fleet-wide searches across tenants, subscriptions, or resource groups to track threats across all firewalls.

    Additionally, Security Copilot generates recommendations for securing environments using Azure Firewall’s IDPS feature and helps teams understand best practices and protection strategies without manually searching through documentation.

    Generate recommendations to secure your environment using Azure Firewall’s IDPS feature
    Generate recommendations to secure your environment using Azure Firewall’s IDPS feature

    To use this integration, organizations must configure Azure Firewall to send resource-specific structured logs for IDPS to a Log Analytics workspace.

    Users need appropriate Role-Based Access Control permissions to access firewalls and associated workspaces. The service requires Security Compute Units (SCUs), which organizations can adjust based on their needs.

    This integration represents Microsoft’s continued investment in AI-powered security tools that make advanced threat detection and response accessible to security teams of all skill levels.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Microsoft Integrated Azure Firewall With AI-powered Security Copilot appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Critical SolarWinds Serv-U Vulnerabilities Let Attackers Execute Malicious Code Remotely as Admin

    ·

    , , ,

    SolarWinds has released security patches addressing three critical remote code execution vulnerabilities in Serv-U that could allow attackers with administrative privileges to execute arbitrary code on affected systems.

    The vulnerabilities disclosed in Serv-U version 15.5.3 pose significant risks to organizations that rely on the file transfer software for secure data exchange.

    Multiple Pathways to Remote Code Execution

    SolarWinds’ three critical vulnerabilities stem from logic errors, broken access controls, and path restriction bypasses within Serv-U’s core functionality.

    Attackers exploiting these flaws require administrative access but can leverage them to gain unauthorized code-execution capabilities on the server.

    CVE IDVulnerability TitleDescriptionCVSS ScoreSeverity
    CVE-2025-40547Logic Abuse – RCELogic error allowing malicious actors with admin privileges to execute code9.1Critical
    CVE-2025-40548Broken Access Control – RCEMissing validation process enabling code execution for privileged users9.1Critical
    CVE-2025-40549Path Restriction BypassPath bypass vulnerability allowing arbitrary code execution on directories9.1Critical

    On Windows deployments, CVSS scores are rated as medium severity because services typically run under less-privileged accounts by default. In contrast, Linux systems remain at critical severity levels.

    The vulnerabilities highlight a standard attack pattern: abuse of elevated privileges combined with insufficient validation mechanisms.

    Organizations running older Serv-U versions face heightened risk, particularly as Serv-U 15.4.1 reached end-of-life on December 16, 2024, with 15.4.2 and 15.5 following suit in mid-2025 and 2026, respectively.

    SolarWinds recommends immediate patching to Serv-U 15.5.3 or later. The updated release includes multiple security enhancements beyond CVE fixes, including support for ED25519 public key authentication.

    Enhanced IP blocking functionality for file share guests, and account lockout mechanisms to prevent brute-force attacks.

    Additional security improvements in version 15.5.3 include X-Forwarded-For protection against IP spoofing and mandatory minimum password length requirements.

    HTTP Strict Transport Security (HSTS) enablement, file upload size limits, and upgraded Angular framework to version 19. These layered defenses provide defense-in-depth protection against exploitation attempts.

    SolarWinds, unable to immediately upgrade, should prioritize restricting administrative access. Implementing network segmentation and deploying intrusion detection signatures for Serv-U traffic patterns.

    Continuous monitoring of authentication logs for suspicious administrative activities remains critical during the transition period.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Critical SolarWinds Serv-U Vulnerabilities Let Attackers Execute Malicious Code Remotely as Admin appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶