TECHZONE™

State-Sponsored Hackers Weaponize ClickFix Tactic in Targeted Malware Campaigns https://thehackernews.com/2025/04/state-sponsored-hackers-weaponize.html Multiple state-sponsored hacking groups from Iran, North Korea, and Russia have been found leveraging the increasingly popular ClickFix social engineering tactic to deploy malware over a three-month period from late 2024 through the beginning of 2025. The phishing campaigns adopting the strategy have been attributed to clusters tracked as TA427 (aka Kimsuky), TA450 (aka MuddyWater),

Artificial Intelligence – What's all the fuss? https://thehackernews.com/2025/04/artificial-intelligence-whats-all-fuss.html Talking about AI: Definitions Artificial Intelligence (AI) — AI refers to the simulation of human intelligence in machines, enabling them to perform tasks that typically require human intelligence, such as decision-making and problem-solving. AI is the broadest concept in this field, encompassing various technologies and methodologies, including Machine Learning (ML) and Deep Learning. Machine

Blockchain Offers Security Benefits – But Don't Neglect Your Passwords https://thehackernews.com/2025/04/blockchain-offers-security-benefits-but.html Blockchain is best known for its use in cryptocurrencies like Bitcoin, but it also holds significant applications for online authentication. As businesses in varying sectors increasingly embrace blockchain-based security tools, could the technology one day replace passwords? How blockchain works  Blockchain is a secure way to maintain, encrypt, and exchange digital records of transactions.

Critical Erlang/OTP SSH Vulnerability (CVSS 10.0) Allows Unauthenticated Code Execution https://thehackernews.com/2025/04/critical-erlangotp-ssh-vulnerability.html A critical security vulnerability has been disclosed in the Erlang/Open Telecom Platform (OTP) SSH implementation that could permit an attacker to execute arbitrary code sans any authentication under certain conditions. The vulnerability, tracked as CVE-2025-32433, has been given the maximum CVSS score of 10.0. "The vulnerability allows an attacker with network access to an Erlang/OTP SSH

Node.js Malware Campaign Targets Crypto Users with Fake Binance and TradingView Installers https://thehackernews.com/2025/04/nodejs-malware-campaign-targets-crypto.html Microsoft is calling attention to an ongoing malvertising campaign that makes use of Node.js to deliver malicious payloads capable of information theft and data exfiltration. The activity, first detected in October 2024, uses lures related to cryptocurrency trading to trick users into installing a rogue installer from fraudulent websites that masquerade as legitimate software like Binance or

CISA Flags Actively Exploited Vulnerability in SonicWall SMA Devices https://thehackernews.com/2025/04/cisa-flags-actively-exploited.html The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting SonicWall Secure Mobile Access (SMA) 100 Series gateways to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2021-20035 (CVSS score: 7.2), relates to a case of operating system command injection

Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks https://thehackernews.com/2025/04/apple-patches-two-actively-exploited.html Apple on Wednesday released security updates for iOS, iPadOS, macOS Sequoia, tvOS, and visionOS to address two security flaws that it said have come under active exploitation in the wild. The vulnerabilities in question are listed below - CVE-2025-31200 (CVSS score: 7.5) - A memory corruption vulnerability in the Core Audio framework that could allow code execution when processing an audio

Experts Uncover Four New Privilege Escalation Flaws in Windows Task Scheduler https://thehackernews.com/2025/04/experts-uncover-four-new-privilege.html Cybersecurity researchers have detailed four different vulnerabilities in a core component of the Windows task scheduling service that could be exploited by local attackers to achieve privilege escalation and erase logs to cover up evidence of malicious activities. The issues have been uncovered in a binary named "schtasks.exe," which enables an administrator to create, delete, query, change,

Google Blocked 5.1B Harmful Ads and Suspended 39.2M Advertiser Accounts in 2024 https://thehackernews.com/2025/04/google-blocked-51b-harmful-ads-and.html Google on Wednesday revealed that it suspended over 39.2 million advertiser accounts in 2024, with a majority of them identified and blocked by its systems before it could serve harmful ads to users. In all, the tech giant said it stopped 5.1 billion bad ads, restricted 9.1 billion ads, and blocked or restricted ads on 1.3 billion pages last year. It also suspended over 5 million accounts for

Gamma AI Platform Abused in Phishing Chain to Spoof Microsoft SharePoint Logins https://thehackernews.com/2025/04/ai-powered-gamma-used-to-host-microsoft.html Threat actors are leveraging an artificial intelligence (AI) powered presentation platform named Gamma in phishing attacks to direct unsuspecting users to spoofed Microsoft login pages. "Attackers weaponize Gamma, a relatively new AI-based presentation tool, to deliver a link to a fraudulent Microsoft SharePoint login portal," Abnormal Security researchers Callie Hinman Baron and Piotr Wojtyla

From Third-Party Vendors to U.S. Tariffs: The New Cyber Risks Facing Supply Chains https://thehackernews.com/2025/04/from-third-party-vendors-to-us-tariffs.html Introduction Cyber threats targeting supply chains have become a growing concern for businesses across industries. As companies continue to expand their reliance on third-party vendors, cloud-based services, and global logistics networks, cybercriminals are exploiting vulnerabilities within these interconnected systems to launch attacks. By first infiltrating a third-party vendor with undetected

New BPFDoor Controller Enables Stealthy Lateral Movement in Linux Server Attacks https://thehackernews.com/2025/04/new-bpfdoor-controller-enables-stealthy.html Cybersecurity researchers have unearthed a new controller component associated with a known backdoor called BPFDoor as part of cyber attacks targeting telecommunications, finance, and retail sectors in South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024. "The controller could open a reverse shell," Trend Micro researcher Fernando Mercês said in a technical report published earlier in

Product Walkthrough: A Look Inside Wing Security's Layered SaaS Identity Defense https://thehackernews.com/2025/04/product-walkthrough-look-inside-wing.html Intro: Why hack in when you can log in? SaaS applications are the backbone of modern organizations, powering productivity and operational efficiency. But every new app introduces critical security risks through app integrations and multiple users, creating easy access points for threat actors. As a result, SaaS breaches have increased, and according to a May 2024 XM Cyber report, identity and

Chinese Android Phones Shipped with Fake WhatsApp, Telegram Apps Targeting Crypto Users https://thehackernews.com/2025/04/chinese-android-phones-shipped-with.html Cheap Android smartphones manufactured by Chinese companies have been observed pre-installed with trojanized apps masquerading as WhatsApp and Telegram that contain cryptocurrency clipper functionality as part of a campaign since June 2024. While using malware-laced apps to steal financial information is not a new phenomenon, the new findings from Russian antivirus vendor Doctor Web point to

U.S. Govt. Funding for MITRE's CVE Ends April 16, Cybersecurity Community on Alert https://thehackernews.com/2025/04/us-govt-funding-for-mitres-cve-ends.html The U.S. government funding for non-profit research giant MITRE to operate and maintain its Common Vulnerabilities and Exposures (CVE) program will expire Wednesday, an unprecedented development that could shake up one of the foundational pillars of the global cybersecurity ecosystem. The 25-year-old CVE program is a valuable tool for vulnerability management, offering a de facto standard to

Attacks on the education sector are surging: How can cyber-defenders respond? https://www.welivesecurity.com/en/business-security/attacks-education-sector-surging-cyber-defenders-respond/ Academic institutions have a unique set of characteristics that makes them attractive to bad actors. What's the right antidote to cyber-risk?

Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool https://thehackernews.com/2025/04/chinese-hackers-target-linux-systems.html The China-linked threat actor known as UNC5174 has been attributed to a new campaign that leverages a variant of a known malware dubbed SNOWLIGHT and a new open-source tool called VShell to infect Linux systems. "Threat actors are increasingly using open source tools in their arsenals for cost-effectiveness and obfuscation to save money and, in this case, plausibly blend in with the pool of

Critical Apache Roller Vulnerability (CVSS 10.0) Enables Unauthorized Session Persistence https://thehackernews.com/2025/04/critical-apache-roller-vulnerability.html A critical security vulnerability has been disclosed in the Apache Roller open-source, Java-based blogging server software that could allow malicious actors to retain unauthorized access even after a password change. The flaw, assigned the CVE identifier CVE-2025-24859, carries a CVSS score of 10.0, indicating maximum severity. It affects all versions of Roller up to and including 6.1.4.

Majority of Browser Extensions Can Access Sensitive Enterprise Data, New Report Finds https://thehackernews.com/2025/04/majority-of-browser-extensions-can.html Everybody knows browser extensions are embedded into nearly every user’s daily workflow, from spell checkers to GenAI tools. What most IT and security people don’t know is that browser extensions’ excessive permissions are a growing risk to organizations. LayerX today announced the release of the Enterprise Browser Extension Security Report 2025, This report is the first and only report to merge

Malicious PyPI Package Targets MEXC Trading API to Steal Credentials and Redirect Orders https://thehackernews.com/2025/04/malicious-pypi-package-targets-mexc.html Cybersecurity researchers have disclosed a malicious package uploaded to the Python Package Index (PyPI) repository that's designed to reroute trading orders placed on the MEXC cryptocurrency exchange to a malicious server and steal tokens. The package, ccxt-mexc-futures, purports to be an extension built on top of a popular Python library named ccxt (short for CryptoCurrency eXchange Trading),