TECHZONE™

CTEM is the New SOC: Shifting from Monitoring Alerts to Measuring Risk https://thehackernews.com/2025/06/ctem-is-new-soc-shifting-from.html Introduction: Security at a Tipping Point Security Operations Centers (SOCs) were built for a different era, one defined by perimeter-based thinking, known threats, and manageable alert volumes. But today’s threat landscape doesn’t play by those rules. The sheer volume of telemetry, overlapping tools, and automated alerts has pushed traditional SOCs to the edge. Security teams are overwhelmed,

Apple Zero-Click Flaw in Messages Exploited to Spy on Journalists Using Paragon Spyware https://thehackernews.com/2025/06/apple-zero-click-flaw-in-messages.html Apple has disclosed that a now-patched security flaw present in its Messages app was actively exploited in the wild to target civil society members in sophisticated cyber attacks. The vulnerability, tracked as CVE-2025-43200, was addressed on February 10, 2025, as part of iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1,

WordPress Sites Turned Weapon: How VexTrio and Affiliates Run a Global Scam Network https://thehackernews.com/2025/06/wordpress-sites-turned-weapon-how.html The threat actors behind the VexTrio Viper Traffic Distribution Service (TDS) have been linked to other TDS services like Help TDS and Disposable TDS, indicating that the sophisticated cybercriminal operation is a sprawling enterprise of its own that's designed to distribute malicious content. "VexTrio is a group of malicious adtech companies that distribute scams and harmful software via

New TokenBreak Attack Bypasses AI Moderation with Single-Character Text Changes https://thehackernews.com/2025/06/new-tokenbreak-attack-bypasses-ai.html Cybersecurity researchers have discovered a novel attack technique called TokenBreak that can be used to bypass a large language model's (LLM) safety and content moderation guardrails with just a single character change. "The TokenBreak attack targets a text classification model's tokenization strategy to induce false negatives, leaving end targets vulnerable to attacks that the implemented

AI Agents Run on Secret Accounts — Learn How to Secure Them in This Webinar https://thehackernews.com/2025/06/ai-agents-run-on-secret-accounts-learn.html AI is changing everything — from how we code, to how we sell, to how we secure. But while most conversations focus on what AI can do, this one focuses on what AI can break — if you’re not paying attention. Behind every AI agent, chatbot, or automation script lies a growing number of non-human identities — API keys, service accounts, OAuth tokens — silently operating in the background. And here’s

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction https://thehackernews.com/2025/06/zero-click-ai-vulnerability-exposes.html A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence (AI) vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the CVE identifier CVE-2025-32711 (CVSS score: 9.3). It requires no customer action and has been already

Non-Human Identities: How to Address the Expanding Security Risk https://thehackernews.com/2025/06/non-human-identities-how-to-address.html Human identities management and control is pretty well done with its set of dedicated tools, frameworks, and best practices. This is a very different world when it comes to Non-human identities also referred to as machine identities. GitGuardian’s end-to-end NHI security platform is here to close the gap. Enterprises are Losing Track of Their Machine Identities Machine identities–service

ConnectWise to Rotate ScreenConnect Code Signing Certificates Due to Security Risks https://thehackernews.com/2025/06/connectwise-to-rotate-screenconnect.html ConnectWise has disclosed that it's planning to rotate the digital code signing certificates used to sign ScreenConnect, ConnectWise Automate, and ConnectWise remote monitoring and management (RMM) executables due to security concerns. The company said it's doing so "due to concerns raised by a third-party researcher about how ScreenConnect handled certain configuration data in earlier versions.

Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool https://thehackernews.com/2025/06/over-80000-microsoft-entra-id-accounts.html Cybersecurity researchers have uncovered a new account takeover (ATO) campaign that leverages an open-source penetration testing framework called TeamFiltration to breach Microsoft Entra ID (formerly Azure Active Directory) user accounts. The activity, codenamed UNK_SneakyStrike by Proofpoint, has affected over 80,000 targeted user accounts across hundreds of organizations' cloud tenants since a

Former Black Basta Members Use Microsoft Teams and Python Scripts in 2025 Attacks https://thehackernews.com/2025/06/former-black-basta-members-use.html Former members tied to the Black Basta ransomware operation have been observed sticking to their tried-and-tested approach of email bombing and Microsoft Teams phishing to establish persistent access to target networks. "Recently, attackers have introduced Python script execution alongside these techniques, using cURL requests to fetch and deploy malicious payloads," ReliaQuest said in a report

295 Malicious IPs Launch Coordinated Brute-Force Attacks on Apache Tomcat Manager https://thehackernews.com/2025/06/295-malicious-ips-launch-coordinated.html Threat intelligence firm GreyNoise has warned of a "coordinated brute-force activity" targeting Apache Tomcat Manager interfaces. The company said it observed a surge in brute-force and login attempts on June 5, 2025, an indication that they could be deliberate efforts to "identify and access exposed Tomcat services at scale." To that end, 295 unique IP addresses have been found to be engaged

INTERPOL Dismantles 20,000+ Malicious IPs Linked to 69 Malware Variants in Operation Secure https://thehackernews.com/2025/06/interpol-dismantles-20000-malicious-ips.html INTERPOL on Wednesday announced the dismantling of more than 20,000 malicious IP addresses or domains that have been linked to 69 information-stealing malware variants. The joint action, codenamed Operation Secure, took place between January and April 2025, and involved law enforcement agencies from 26 countries to identify servers, map physical networks, and execute targeted takedowns. "These

Why DNS Security Is Your First Defense Against Cyber Attacks? https://thehackernews.com/2025/06/why-dns-security-is-your-first-defense.html In today’s cybersecurity landscape, much of the focus is placed on firewalls, antivirus software, and endpoint detection. While these tools are essential, one critical layer often goes overlooked: the Domain Name System (DNS). As the starting point of nearly every online interaction, DNS is not only foundational - it’s increasingly a target. When left unsecured, it becomes a single point of

SinoTrack GPS Devices Vulnerable to Remote Vehicle Control via Default Passwords https://thehackernews.com/2025/06/sinotrack-gps-devices-vulnerable-to.html Two security vulnerabilities have been disclosed in SinoTrack GPS devices that could be exploited to control certain remote functions on connected vehicles and even track their locations. "Successful exploitation of these vulnerabilities could allow an attacker to access device profiles without authorization through the common web management interface," the U.S. Cybersecurity and Infrastructure

How to Build a Lean Security Model: 5 Lessons from River Island https://thehackernews.com/2025/06/how-to-build-lean-security-model-5.html In today’s security landscape, budgets are tight, attack surfaces are sprawling, and new threats emerge daily. Maintaining a strong security posture under these circumstances without a large team or budget can be a real challenge. Yet lean security models are not only possible - they can be highly effective. River Island, one of the UK’s leading fashion retailers, offers a powerful

Microsoft Patches 67 Vulnerabilities Including WEBDAV Zero-Day Exploited in the Wild https://thehackernews.com/2025/06/microsoft-patches-67-vulnerabilities.html Microsoft has released patches to fix 67 security flaws, including one zero-day bug in Web Distributed Authoring and Versioning (WEBDAV) that it said has come under active exploitation in the wild. Of the 67 vulnerabilities, 11 are rated Critical and 56 are rated Important in severity. This includes 26 remote code execution flaws, 17 information disclosure flaws, and 14 privilege escalation

Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High-Severity Security Gaps https://thehackernews.com/2025/06/adobe-releases-patch-fixing-254.html Adobe on Tuesday pushed security updates to address a total of 254 security flaws impacting its software products, a majority of which affect Experience Manager (AEM). Of the 254 flaws, 225 reside in AEM, impacting AEM Cloud Service (CS) as well as all versions prior to and including 6.5.22. The issues have been resolved in AEM Cloud Service Release 2025.5 and version 6.5.23. "Successful

Researchers Uncover 20+ Configuration Risks, Including Five CVEs, in Salesforce Industry Cloud https://thehackernews.com/2025/06/researchers-uncover-20-configuration.html Cybersecurity researchers have uncovered over 20 configuration-related risks affecting Salesforce Industry Cloud (aka Salesforce Industries), exposing sensitive data to unauthorized internal and external parties. The weaknesses affect various components like FlexCards, Data Mappers, Integration Procedures (IProcs), Data Packs, OmniOut, and OmniScript Saved Sessions. "Low-code platforms such as

FIN6 Uses AWS-Hosted Fake Resumes on LinkedIn to Deliver More_eggs Malware https://thehackernews.com/2025/06/fin6-uses-aws-hosted-fake-resumes-on.html The financially motivated threat actor known as FIN6 has been observed leveraging fake resumes hosted on Amazon Web Services (AWS) infrastructure to deliver a malware family called More_eggs. "By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware," the

Rust-based Myth Stealer Malware Spread via Fake Gaming Sites Targets Chrome, Firefox Users https://thehackernews.com/2025/06/rust-based-myth-stealer-malware-spread.html Cybersecurity researchers have shed light on a previously undocumented Rust-based information stealer called Myth Stealer that's being propagated via fraudulent gaming websites. "Upon execution, the malware displays a fake window to appear legitimate while simultaneously decrypting and executing malicious code in the background," Trellix security researchers Niranjan Hegde, Vasantha Lakshmanan