Mobile Phishers direciona clientes de corretagem no esquema de caixa ‘rampa e despejo’

Por
Mobile Phishers Target Brokerage Customers in 'Ramp and Dump' Cashout Scheme

Grupos cibercriminais especializados em kits avançados de phishing móvel desenvolveram suas operações além de roubar dados do cartão de pagamento para a inscrição em carteira móvel, agora girando para explorar contas de corretagem em esquemas sofisticados de ‘rampa e dump’. Essa mudança, conforme detalhada em pesquisas recentes de especialistas em segurança, aproveita as credenciais do … Ler mais

Public Exploit Released for Critical SAP NetWeaver Flaw

Por
Public Exploit Released for Critical SAP NetWeaver Flaw

A critical vulnerability in SAP NetWeaver AS Java Visual Composer, tracked as CVE-2025-31324, is now being widely exploited following the release of public exploit tooling. The flaw, patched in April 2025, allows unauthenticated remote code execution via the platform’s metadata uploader endpoint. What’s new is the public availability of the full source code, which makes … Ler mais

Elastic rejects claims of a zero-day RCE flaw in Defend EDR

Por
Picus Red Report 2025

Enterprise search and security company Elastic is rejecting reports of a zero-day vulnerability impacting its Defend endpoint detection and response (EDR) product. The company’s statement follows a blog post froma company called AshES Cybersecurityclaiming to have discovereda remote code execution (RCE) flaw in Elastic Defend that would allow an attacker to bypass EDR protections. Elastic’s … Ler mais

OpenAI releases $4 ChatGPT plan, but it's not available in the US for now

Por
legacy

OpenAI has finally announced the GPT Go subscription, which costs just $4 in the US or INR 399 in India. Unfortunately, the cheapest paid version of GPT is limited to India for now. If you live in India or have an account made in India, you’ll now begin seeing a nudge to try GPT Go … Ler mais

Novo clickfix ataque implanta página de notícias BBC falsa e verificação falsa de cloudflare para enganar usuários

Por
New ClickFix Attack Deploys Fake BBC News Page and Fake Cloudflare Verification to Deceive Users

Os pesquisadores de segurança cibernética descobriram uma nova variante de ataque de clickfix que personifica o conteúdo de notícias da BBC confiável e, ao mesmo tempo, alavancando interfaces de verificação de gornilha falsificadas Cloudflare para coagir os usuários a executar PowerShell comandos. Esta campanha, detalhada em análises recentes de fontes como News de segurança cibernética … Ler mais

Allianz Life Data Breach Exposes Personal Data of 1.1 Million

Por
Allianz Life Data Breach Exposes Personal Data of 1.1 Million

A cyber-attack on Allianz Life in July has exposed the personal information of about 1.1 million customers, according to new data byHave I Been Pwned. The breach targeted a cloud-based customer relationship management (CRM) system and is part of a larger campaign against companies using Salesforce-hosted databases. Allianz Life, a US subsidiary of German insurer … Ler mais

Documentos de direitos autorais armados usados pelos atores de ameaças para atingir os principais funcionários com ladrão de noodlophile

Por
Weaponized Copyright Documents Used by Threat Actors to Target Key Employees with Noodlophile Stealer

O malware de ladrão de noodlophile, inicialmente descoberto em campanhas que alavancam plataformas falsas de geração de vídeos de IA, evoluiu para uma operação de phishing de lança direcionada que armazia avisos de violação de direitos autorais para se infiltrar em empresas com presenças substanciais do Facebook. Essa variante atualizada, ativa por mais de um … Ler mais

Canadian Financial Regulator Hacked, Exposing Personal Data from Membe

Por
Canadian Financial Regulator Hacked, Exposing Personal Data from Membe

A Canadian financial regulator has disclosed a cybersecurity incident, which has breached the personal information of member firms and their employees. The Canadian Investment Regulatory Organization (CIRO), a national self-regulatory organization covering all investment dealers, mutual fund dealers and trading activity on Canada’s debt and equity marketplaces, revealed it identified the cybersecurity threat on August … Ler mais

Pharma firm Inotiv says ransomware attack impacted operations

Por
Picus Blue Report 2025

American pharmaceutical company Inotiv has disclosed that some of its systems and data have been encrypted in a ransomware attack, impacting the company’s business operations. In a filing to theU.S. Securities and Exchange Commission (SEC), Inotiv says that the cyberattack occurred on August 8 and took action to contain the breach. “On August 8, 2025, … Ler mais

Attacker “Patches” Vulnerability Post Exploitation to Lock Out Competi

Por
Attacker “Patches” Vulnerability Post Exploitation to Lock Out Competi

A threat actor has been observed “patching” a vulnerability post exploitation, likely in a bid to lock out other adversaries and secure exclusive access. The novel tactic was detected by Red Canary researchers in a cluster of activity targeting a flaw in Apache ActiveMQ, an open-source message broker, to gain persistent access on cloud-based Linux … Ler mais