TECHZONE™

Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks https://thehackernews.com/2025/02/chinese-hackers-exploit-mavinjectexe-to.html The Chinese state-sponsored threat actor known as Mustang Panda has been observed employing a novel technique to evade detection and maintain control over infected systems. This involves the use of a legitimate Microsoft Windows utility called Microsoft Application Virtualization Injector (MAVInject.exe) to inject the threat actor's malicious payload into an external process, waitfor.exe,

New FrigidStealer Malware Targets macOS Users via Fake Browser Updates https://thehackernews.com/2025/02/new-frigidstealer-malware-targets-macos.html Cybersecurity researchers are alerting to a new campaign that leverages web injects to deliver a new Apple macOS malware known as FrigidStealer. The activity has been attributed to a previously undocumented threat actor known as TA2727, with the information stealers for other platforms such as Windows (Lumma Stealer or DeerStealer) and Android (Marcher). TA2727 is a "threat actor that uses fake

Debunking the AI Hype: Inside Real Hacker Tactics https://thehackernews.com/2025/02/debunking-ai-hype-inside-real-hacker.html Is AI really reshaping the cyber threat landscape, or is the constant drumbeat of hype drowning out actual, more tangible, real-world dangers? According to Picus Labs’ Red Report 2025 which analyzed over one million malware samples, there's been no significant surge, so far, in AI-driven attacks. Yes, adversaries are definitely continuing to innovate, and while AI will certainly start playing a

Juniper Session Smart Routers Vulnerability Could Let Attackers Bypass Authentication https://thehackernews.com/2025/02/juniper-session-smart-routers.html Juniper Networks has released security updates to address a critical security flaw impacting Session Smart Router, Session Smart Conductor, and WAN Assurance Router products that could be exploited to hijack control of susceptible devices. Tracked as CVE-2025-21589, the vulnerability carries a CVSS v3.1 score of 9.8 and a CVS v4 score of 9.3. "An Authentication Bypass Using an Alternate Path or

Winnti APT41 Targets Japanese Firms in RevivalStone Cyber Espionage Campaign https://thehackernews.com/2025/02/winnti-apt41-targets-japanese-firms-in.html The China-linked threat actor known as Winnti has been attributed to a new campaign dubbed RevivalStone that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024. The activity, detailed by Japanese cybersecurity company LAC, overlaps with a threat cluster tracked by Trend Micro as Earth Freybug, which has been assessed to be a subset within the APT41

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials https://thehackernews.com/2025/02/new-xerox-printer-flaws-could-let.html Security vulnerabilities have been disclosed in Xerox VersaLink C7025 Multifunction printers (MFPs) that could allow attackers to capture authentication credentials via pass-back attacks via Lightweight Directory Access Protocol (LDAP) and SMB/FTP services. "This pass-back style attack leverages a vulnerability that allows a malicious actor to alter the MFP's configuration and cause the MFP

Cybercriminals Exploit Onerror Event in Image Tags to Deploy Payment Skimmers https://thehackernews.com/2025/02/cybercriminals-exploit-onerror-event-in.html Cybersecurity researchers have flagged a credit card stealing malware campaign that has been observed targeting e-commerce sites running Magento by disguising the malicious content within image tags in HTML code in order to stay under the radar. MageCart is the name given to a malware that's capable of stealing sensitive payment information from online shopping sites. The attacks are known to

Microsoft Uncovers New XCSSET macOS Malware Variant with Advanced Obfuscation Tactics https://thehackernews.com/2025/02/microsoft-uncovers-new-xcsset-macos.html Microsoft said it has discovered a new variant of a known Apple macOS malware called XCSSET as part of limited attacks in the wild. "Its first known variant since 2022, this latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies," the Microsoft Threat Intelligence team said in a post shared on X. "These enhanced features add to

South Korea Suspends DeepSeek AI Downloads Over Privacy Violations https://thehackernews.com/2025/02/south-korea-suspends-deepseek-ai.html South Korea has formally suspended new downloads of Chinese artificial intelligence (AI) chatbot DeepSeek in the country until the service makes changes to its mobile apps to comply with data protection regulations. Downloads have been paused as of February 15, 2025, 6:00 p.m. local time, the Personal Information Protection Commission (PIPC) said in a statement. The web service remains

Roeland Nusselder: AI will eat all our energy, unless we make it tiny | Starmus highlights https://www.welivesecurity.com/en/we-live-science/roeland-nusselder-ai-will-eat-all-our-energy-unless-we-make-it-tiny-starmus-highlights/ Left unchecked, AI's energy and carbon footprint could become a significant concern. Can our AI systems be far less energy-hungry without sacrificing performance?

How scammers are exploiting DeepSeek's rise https://www.welivesecurity.com/en/cybersecurity/scammers-exploiting-deepseek-hype/ As is their wont, cybercriminals waste no time launching attacks that aim to cash in on the frenzy around the latest big thing – plus, what else to know before using DeepSeek

This month in security with Tony Anscombe – January 2025 edition https://www.welivesecurity.com/en/videos/month-security-tony-anscombe-january-2025-edition/ DeepSeek’s bursting onto the AI scene, apparent shifts in US cybersecurity policies, and a massive student data breach all signal another eventful year in cybersecurity and data privacy

Untrustworthy AI: How to deal with data poisoning https://www.welivesecurity.com/en/business-security/untrustworthy-ai-data-poisoning/ You should think twice before trusting your AI assistant, as database poisoning can markedly alter its output – even dangerously so

Brian Greene: Until the end of time | Starmus highlights https://www.welivesecurity.com/en/we-live-science/brian-greene-until-end-time-starmus-highlights/ The renowned physicist explores how time and entropy shape the evolution of the universe, the nature of existence, and the eventual fate of everything, including humanity

Going (for) broke: 6 common online betting scams and how to avoid them https://www.welivesecurity.com/en/scams/going-for-broke-common-online-betting-scams/ Don’t roll the dice on your online safety – watch out for bogus sports betting apps and other traps commonly set by scammers

The evolving landscape of data privacy: Key trends to shape 2025 https://www.welivesecurity.com/en/business-security/evolving-landscape-data-privacy-key-trends-shape-2025/ Incoming laws, combined with broader developments on the threat landscape, will create further complexity and urgency for security and compliance teams

PlushDaemon compromises supply chain of Korean VPN service https://www.welivesecurity.com/en/eset-research/plushdaemon-compromises-supply-chain-korean-vpn-service/ ESET researchers have discovered a supply-chain attack against a VPN provider in South Korea by a new China-aligned APT group we have named PlushDaemon

Under lock and key: Protecting corporate data from cyberthreats in 2025 https://www.welivesecurity.com/en/business-security/under-lock-key-protecting-corporate-data-cyberthreats-2025/ Data breaches can cause a loss of revenue and market value as a result of diminished customer trust and reputational damage

UEFI Secure Boot: Not so secure https://www.welivesecurity.com/en/videos/uefi-secure-boot-not-so-secure/ ESET researchers uncover a vulnerability in a UEFI application that could enable attackers to deploy malicious bootkits on unpatched systems

Under the cloak of UEFI Secure Boot: Introducing CVE-2024-7344 https://www.welivesecurity.com/en/eset-research/under-cloak-uefi-secure-boot-introducing-cve-2024-7344/ The story of a signed UEFI application allowing a UEFI Secure Boot bypass