Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of nearly 1,000 fixes, which was already about ten times the normal monthly patch load from Redmond. Just one of the weaknesses patched this week is considered a "zero day," or already exploited in the wild. Windows 10 users might be wondering if they can still expect security updates after this month. READ MORE...
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea's remote IT worker scheme. The Justice Department announced the indictment Tuesday, highlighting two arrests and searches of more than 40 residences in Texas known or suspected to operate as "laptop farms," where facilitators maintain employer-issued laptops so North Korean engineers can use them while abroad. READ MORE...
We found a wave of websites posing as Calendly booking pages for job interviews at Meta. Visitors pick a slot for a 30-minute phone call with a recruiter, fill in their details, and pass what looks like a CAPTCHA. Then the page asks them to log in to Facebook. The interview is fake. The pages are designed to steal the visitor's Facebook login details, including the two-factor authentication (2FA) codes meant to protect the account. READ MORE...
Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday. Since the start of the year, a vast collection of customized phishing kits developed and sold by Chinese-speaking threat actors have delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. READ MORE...
Security updates released on Tuesday resolve 29 vulnerabilities across Citrix, Fortinet, and Ivanti products, including multiple critical-severity bugs. Citrix published three advisories detailing nine security defects impacting Workspace App for Windows, XenServer 8.4 and XenServer 9, and UniconOS. Successful exploitation of the flaws could allow attackers to execute arbitrary code, cause denial-of-service (DoS) conditions, leak information, etc. READ MORE...
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. Researchers identified malicious copies of eight banking apps that use a hooking engine to bypass app-signature, Accessibility, and Play Integrity checks by substituting certificate information or returning empty lists. Threat actors can use Hirudo to steal credentials, remotely control infected phones in real time, etc. READ MORE...
Nothing sells AI products as well as fear. Using new research, Anthropic claims that self-replicating AI worms could be just months away from spreading across vulnerable IoT devices, which would be a problem if it came true. The frontier lab published a research report Monday suggesting that AI models could eventually self-replicate without relying on datacenter hardware, with a 9-billion-parameter model successfully setting up inference on eight of the nine hardware types Anthropic tested. READ MORE...
Police tip hotlines already have their fair share of crank callers. Apparently they now have to contend with crank AI agents as well. AI agents have already been caught hacking software companies, breaching an Australian government portal, and trying to hack a Canadian government website. Now Anthropic's Claude has added a made-up murder tip to the list. Claude's Haiku 4.5 model filed a false tip in an unsolved Philadelphia homicide via the police department's online public tip form. READ MORE...
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti's Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. Ivanti says that exploitation affected a limited number of customers at the time of disclosure and that it is working to help those organizations. READ MORE...