TECHZONE™

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API https://thehackernews.com/2025/01/severe-security-flaws-patched-in.html Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure. The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May 2024. Two of the three shortcomings reside in Power Platform's OData Web API Filter, while the third vulnerability is rooted in the FetchXML

Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them https://thehackernews.com/2025/01/cross-domain-attacks-growing-threat-to.html In the past year, cross-domain attacks have gained prominence as an emerging tactic among adversaries. These operations exploit weak points across multiple domains – including endpoints, identity systems and cloud environments – so the adversary can infiltrate organizations, move laterally and evade detection. eCrime groups like SCATTERED SPIDER and North Korea-nexus adversaries such as FAMOUS

Malicious Obfuscated NPM Package Disguised as an Ethereum Tool Deploys Quasar RAT https://thehackernews.com/2025/01/malicious-obfuscated-npm-package.html Cybersecurity researchers have discovered a malicious package on the npm package registry that masquerades as a library for detecting vulnerabilities in Ethereum smart contracts but, in reality, drops an open-source remote access trojan called Quasar RAT onto developer systems. The heavily obfuscated package, named ethereumvulncontracthandler, was published to npm on December 18, 2024, by a user

Three Russian-German Nationals Charged with Espionage for Russian Secret Service https://thehackernews.com/2025/01/three-russian-german-nationals-charged.html German prosecutors have charged three Russian-German nationals for acting as secret service agents for Russia. The individuals, named Dieter S., Alexander J., and Alex D., have been accused of working for a foreign secret service. Dieter S. is also alleged to have participated in sabotage operations as well as taking pictures of military installations with an aim to endanger national security.

New "DoubleClickjacking" Exploit Bypasses Clickjacking Protections on Major Websites https://thehackernews.com/2025/01/new-doubleclickjacking-exploit-bypasses.html Threat hunters have disclosed a new "widespread timing-based vulnerability class" that leverages a double-click sequence to facilitate clickjacking attacks and account takeovers in almost all major websites. The technique has been codenamed DoubleClickjacking by security researcher Paulos Yibelo. "Instead of relying on a single click, it takes advantage of a double-click sequence," Yibelo said.

Iranian and Russian Entities Sanctioned for Election Interference Using AI and Cyber Tactics https://thehackernews.com/2025/01/iranian-and-russian-entities-sanctioned.html The U.S. Treasury Department's Office of Foreign Assets Control (OFAC) on Tuesday leveled sanctions against two entities in Iran and Russia for their attempts to interfere with the November 2024 presidential election. The federal agency said the entities – a subordinate organization of Iran's Islamic Revolutionary Guard Corps and a Moscow-based affiliate of Russia's Main Intelligence

New U.S. DoJ Rule Halts Bulk Data Transfers to Adversarial Nations to Protect Privacy https://thehackernews.com/2024/12/new-us-doj-rule-halts-bulk-data.html The U.S. Department of Justice (DoJ) has issued a final rule carrying out Executive Order (EO) 14117, which prevents mass transfer of citizens' personal data to countries of concern such as China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela. "This final rule is a crucial step forward in addressing the extraordinary national security threat posed of our

Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents https://thehackernews.com/2024/12/chinese-apt-exploits-beyondtrust-api.html The United States Treasury Department said it suffered a "major cybersecurity incident" that allowed suspected Chinese threat actors to remotely access some computers and unclassified documents.  "On December 8, 2024, Treasury was notified by a third-party software service provider, BeyondTrust, that a threat actor had gained access to a key used by the vendor to secure a cloud-based

Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation https://thehackernews.com/2024/12/misconfigured-kubernetes-rbac-in-azure.html Cybersecurity researchers have uncovered three security weaknesses in Microsoft's Azure Data Factory Apache Airflow integration that, if successfully exploited, could have allowed an attacker to gain the ability to conduct various covert actions, including data exfiltration and malware deployment. "Exploiting these flaws could allow attackers to gain persistent access as shadow administrators

New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits https://thehackernews.com/2024/12/new-hipaa-rules-mandate-72-hour-data.html The United States Department of Health and Human Services' (HHS) Office for Civil Rights (OCR) has proposed new cybersecurity requirements for healthcare organizations with an aim to safeguard patients' data against potential cyber attacks. The proposal, which seeks to modify the Health Insurance Portability and Accountability Act (HIPAA) of 1996, is part of a broader initiative to bolster the

⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips https://thehackernews.com/2024/12/thn-weekly-recap-top-cybersecurity_0611565081.html Every week, the digital world faces new challenges and changes. Hackers are always finding new ways to breach systems, while defenders work hard to keep our data safe. Whether it's a hidden flaw in popular software or a clever new attack method, staying informed is key to protecting yourself and your organization. In this week's update, we'll cover the most important developments in

When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions https://thehackernews.com/2024/12/when-good-extensions-go-bad-takeaways.html News has been making headlines over the weekend of the extensive attack campaign targeting browser extensions and injecting them with malicious code to steal user credentials. Currently, over 25 extensions, with an install base of over two million users, have been found to be compromised, and customers are now working to figure out their exposure (LayerX, one of the companies involved in

16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft https://thehackernews.com/2024/12/16-chrome-extensions-hacked-exposing.html A new attack campaign has targeted known Chrome browser extensions, leading to at least 16 extensions being compromised and exposing over 600,000 users to data exposure and credential theft. The attack targeted publishers of browser extensions on the Chrome Web Store via a phishing campaign and used their access permissions to insert malicious code into legitimate extensions in order to steal

15,000+ Four-Faith Routers Exposed to New Exploit Due to Default Credentials https://thehackernews.com/2024/12/15000-four-faith-routers-exposed-to-new.html A high-severity flaw impacting select Four-Faith routers has come under active exploitation in the wild, according to new findings from VulnCheck. The vulnerability, tracked as CVE-2024-12856 (CVSS score: 7.2), has been described as an operating system (OS) command injection bug affecting router models F3x24 and F3x36. The severity of the shortcoming is lower due to the fact that it only works

North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign https://thehackernews.com/2024/12/north-korean-hackers-deploy-ottercookie.html North Korean threat actors behind the ongoing Contagious Interview campaign have been observed dropping a new JavaScript malware called OtterCookie. Contagious Interview (aka DeceptiveDevelopment) refers to a persistent attack campaign that employs social engineering lures, with the hacking crew often posing as recruiters to trick individuals looking for potential job opportunities into

Cloud Atlas Deploys VBCloud Malware: Over 80% of Targets Found in Russia https://thehackernews.com/2024/12/cloud-atlas-deploys-vbcloud-malware.html The threat actor known as Cloud Atlas has been observed using a previously undocumented malware called VBCloud as part of its cyber attack campaigns targeting "several dozen users" in 2024. "Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formula editor (CVE-2018-0802) to download and execute malware code," Kaspersky researcher Oleg

Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately https://thehackernews.com/2024/12/palo-alto-releases-patch-for-pan-os-dos.html Palo Alto Networks has disclosed a high-severity vulnerability impacting PAN-OS software that could cause a denial-of-service (DoS) condition on susceptible devices. The flaw, tracked as CVE-2024-3393 (CVSS score: 8.7), impacts PAN-OS versions 10.X and 11.X, as well as Prisma Access running PAN-OS versions. It has been addressed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS

FICORA and Kaiten Botnets Exploit Old D-Link Vulnerabilities for Global Attacks https://thehackernews.com/2024/12/ficora-and-kaiten-botnets-exploit-old-d.html Cybersecurity researchers are warning about a spike in malicious activity that involves roping vulnerable D-Link routers into two different botnets, a Mirai variant dubbed FICORA and a Kaiten (aka Tsunami) variant called CAPSAICIN. "These botnets are frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands via a GetDeviceSettings

Apache MINA CVE-2024-52046: CVSS 10.0 Flaw Enables RCE via Unsafe Serialization https://thehackernews.com/2024/12/apache-mina-cve-2024-52046-cvss-100.html The Apache Software Foundation (ASF) has released patches to address a maximum severity vulnerability in the MINA Java network application framework that could result in remote code execution under specific conditions. Tracked as CVE-2024-52046, the vulnerability carries a CVSS score of 10.0. It affects versions 2.0.X, 2.1.X, and 2.2.X. "The ObjectSerializationDecoder in Apache MINA uses Java's

Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts https://thehackernews.com/2024/12/brazilian-hacker-charged-for-extorting.html A Brazilian citizen has been charged in the United States for allegedly threatening to release data stolen by hacking into a company's network in March 2020. Junior Barros De Oliveira, 29, of Curitiba, Brazil has been charged with four counts of extortionate threats involving information obtained from protected computers and four counts of threatening communications, the U.S. Department of