Daily Cyber News

Hackers Use 13,000+ Domains via Cloudflare to Conduct ClickFix Attacks

In mid-2025, cybersecurity researchers at Lab539 detected an unexpected rise in a new browser-based malware campaign known as ClickFix. First appearing quietly in July, this threat quickly grew by registering over 13,000 unique domains aimed at tricking users into running malicious commands on their own devices. How ClickFix Works ClickFix attacks utilize compromised or low-cost […]

Hackers Use 13,000+ Domains via Cloudflare to Conduct ClickFix Attacks Read More »

100+ VS Code Extensions Found Exposing Developers to Hidden Supply Chain Threats

Recent research has revealed that more than 100 Visual Studio Code (VS Code) extensions have inadvertently leaked access tokens, creating a critical risk in the software supply chain. Malicious actors could exploit these tokens to push updates to the extensions, potentially compromising developers’ systems. Critical Risk of Leaked Tokens According to Wiz security researcher Rami

100+ VS Code Extensions Found Exposing Developers to Hidden Supply Chain Threats Read More »

F5 BIG-IP Source Code Exposed in Breach by Nation-State Hackers

U.S.-based cybersecurity firm F5 disclosed on Wednesday that unauthorized actors infiltrated its systems and obtained files containing portions of the BIG-IP source code, along with information about undisclosed vulnerabilities in the product. The company attributed the attack to a “highly sophisticated nation-state threat actor,” noting that the intruders maintained prolonged access to its network. According

F5 BIG-IP Source Code Exposed in Breach by Nation-State Hackers Read More »

Attackers Exploit ICTBroadcast Cookie Flaw to Obtain Remote Shell Access

Cybersecurity researchers have reported an active exploitation of a serious security flaw in ICTBroadcast, the autodialer software developed by ICT Innovations. The vulnerability, tracked as CVE-2025-2611 and assigned a CVSS score of 9.3, arises from insufficient input validation. This flaw allows unauthenticated remote code execution, as the call center application improperly passes session cookie data

Attackers Exploit ICTBroadcast Cookie Flaw to Obtain Remote Shell Access Read More »

New SAP NetWeaver Vulnerability Allows Server Takeover Without Authentication

SAP has released updates addressing 13 security flaws, with special focus on a critical vulnerability in SAP NetWeaver AS Java that could allow attackers to execute arbitrary commands. Tracked as CVE-2025-42944, this flaw has a CVSS score of 10.0, making it highly severe. Security experts classify it as an insecure deserialization issue. According to CVE.org,

New SAP NetWeaver Vulnerability Allows Server Takeover Without Authentication Read More »

Two Critical Red Lion RTU Flaws Rated CVSS 10.0 Could Give Hackers Full Industrial Control

Cybersecurity researchers have disclosed two severe vulnerabilities in Red Lion Sixnet remote terminal units, RTUs, that together can allow unauthenticated attackers to gain root level code execution on affected devices. The issues, tracked as CVE-2023-40151 and CVE-2023-42770, carry the maximum CVSS score, 10.0, highlighting the high risk to industrial control systems across energy, water, transportation,

Two Critical Red Lion RTU Flaws Rated CVSS 10.0 Could Give Hackers Full Industrial Control Read More »

Microsoft IIS Flaw Lets Unauthorized Attackers Execute Malicious Code

Microsoft has revealed a newly discovered critical flaw in its Internet Information Services (IIS) web server, posing potential risks to businesses and organizations using Windows Server for web hosting. The issue, identified as CVE-2025-59282, could allow attackers to execute arbitrary code without authorization under specific conditions. Though not yet exploited in active attacks, cybersecurity experts

Microsoft IIS Flaw Lets Unauthorized Attackers Execute Malicious Code Read More »

Windows Remote Desktop Client Flaw Enables Remote Code Execution

Microsoft has addressed a critical security flaw in the Windows Remote Desktop Client that could allow attackers to execute arbitrary code on a user’s system. The issue, identified as CVE-2025-58718, was disclosed on October 14, 2025, and rated as Important in severity. Although no active exploitation has been reported, cybersecurity researchers warn that the flaw

Windows Remote Desktop Client Flaw Enables Remote Code Execution Read More »

GhostBat RAT Masquerades as Fake RTO Android Apps to Steal Banking Data from Indian Users

A new, persistent Android campaign, attributed to GhostBat RAT, impersonates Regional Transport Office, RTO, applications to steal banking data from Indian users. Attackers distribute malicious droppers through WhatsApp, SMS with shortened URLs, GitHub hosted APKs, and compromised websites, then use multi stage loading, ZIP header manipulation, native libraries, and extensive string obfuscation to avoid detection

GhostBat RAT Masquerades as Fake RTO Android Apps to Steal Banking Data from Indian Users Read More »

Chinese Hackers Employ Geo Mapping Tool to Maintain Year Long Persistence

Researchers have discovered that the China-backed advanced persistent threat (APT) group Flax Typhoon maintained long-term access to a geographic information system (ArcGIS) by exploiting trusted software components. Instead of using traditional malware, the attackers converted a legitimate software extension into a persistent backdoor, forcing even the vendor to update its documentation. Turning Legitimate Software into

Chinese Hackers Employ Geo Mapping Tool to Maintain Year Long Persistence Read More »