Google has issued an urgent security update for its Chrome web browser to address a critical vulnerability that could enable attackers to fully take over user accounts if exploited. The flaw, identified as CVE-2025-4664, is categorized as high-severity and involves insufficient policy enforcement in Chrome’s Loader component. This could allow remote attackers to steal sensitive … Continued
The Australian Human Rights Commission (AHRC) has confirmed it was impacted by a significant data breach that exposed hundreds of sensitive documents uploaded via its website. The breach involved attachments submitted through the Commission’s online complaint webform between March 24 and April 10, 2025. These documents were inadvertently made publicly accessible and were viewed between … Continued
A report by blockchain analytics firm Elliptic has exposed Xinbi Guarantee, a massive Chinese-language Telegram marketplace, as a central player in Southeast Asia’s pig butchering scams and other organized cyberfraud. The platform is also implicated in laundering stolen cryptocurrency linked to North Korean hackers. According to Elliptic, Xinbi Guarantee has facilitated at least $8.4 billion … Continued
Multiple vulnerabilities have been identified in various Adobe products, with the most critical potentially allowing attackers to execute arbitrary code on affected systems. Adobe develops widely-used software for creating and publishing content across graphics, photography, illustration, animation, multimedia, film, and print. If successfully exploited, these vulnerabilities could enable attackers to execute code with the privileges … Continued
ReversingLabs has identified a malicious open-source package on PyPI masquerading as a legitimate tool for Solana blockchain development. The package, named solana-token, appeared to be a utility for developers but was designed to exfiltrate source code from a developer’s machine upon installation. Although the package’s PyPI landing page lacked a description, its name and functions … Continued
Ivanti has issued critical security patches for its Endpoint Manager Mobile (EPMM) product to address two recently discovered vulnerabilities—CVE-2025-4427 and CVE-2025-4428—one rated medium and the other high in severity. When exploited together, these flaws could allow unauthenticated remote code execution on affected systems. Ivanti confirmed that a small number of customers have been impacted by … Continued
A newly identified threat dubbed PupkinStealer has emerged as of April 2025. Written in C# and .NET framework, this information-stealing malware is designed to compromise Windows systems, focusing on harvesting sensitive user data and discreetly exfiltrating it using Telegram’s Bot API. Despite its relatively simple structure and lack of persistence mechanisms or advanced evasion techniques, … Continued
A state-sponsored hacking group linked to North Korea, known as TA406, has launched a targeted cyber campaign against Ukrainian government entities, according to new findings by cybersecurity firm Proofpoint. The campaign, which began in February 2025, aims to collect sensitive political and military intelligence, potentially to inform North Korean decision-making around its support for Russia … Continued
A security researcher has released a working proof-of-concept (PoC) exploit for a recently patched vulnerability in Apple’s macOS operating system, raising concerns about potential attacks on unpatched systems. The flaw, tracked as CVE-2025-31258, was addressed in Apple’s latest macOS Sequoia 15.5 update, rolled out on May 12. The vulnerability affects RemoteViewServices, a core macOS framework … Continued
Cybersecurity researchers at Morphisec have uncovered a new wave of malicious campaigns exploiting the growing public interest in artificial intelligence (AI) to distribute a dangerous information-stealing malware known as Noodlophile. Unlike traditional phishing schemes or malware hidden in pirated software, threat actors are now creating elaborate, AI-themed platforms that impersonate legitimate services. These fake websites … Continued
