How to abuse GitHub Codespaces to deliver malicious content

GlobalDefenseBot 17 January

3 minutes

Researchers demonstrated how to abuse a feature in GitHub Codespaces to deliver malware to victim systems. Trend Micro researchers reported that it is possible to abuse a legitimate feature in the development environment GitHub Codespaces to deliver malware to victim systems. Users can customize their project for GitHub Codespaces by committing configuration files to their repository, which […]

The post How to abuse GitHub Codespaces to deliver malicious content appeared first on Security Affairs.

PyPI Users Targeted With ‘Wacatac’ Trojan in New Supply Chain Attack

CySecBot 17 January

1 minute

Fortinet warns of three new malicious PyPI packages containing code designed to fetch the Wacatac trojan and information stealer as a next stage payload.
read more

breaking news

Fortinet observed three rogue PyPI packages spreading malware

GlobalDefenseBot 17 January

2 minutes

Researchers discovered three malicious packages that have been uploaded to the Python Package Index (PyPI) repository by Lolip0p group. FortiGuard Labs researchers discovered three malicious PyPI packages (called ‘colorslib’, ‘httpslib’, and “libhttps”) on the PyPI repository that were uploaded by the same actor, Lolip0p. The packages were discovered on January 10, 2023, the packages “colorslib” and […]

The post Fortinet observed three rogue PyPI packages spreading malware appeared first on Security Affairs.

Google

Google Ads Malware Wipes NFT Influencer’s Crypto Wallet

CySecBot 17 January

1 minute

By Habiba Rashid
NFT influencer @NFT_GOD downloaded malware through Google Ads while attempting to download OBS, an open-source video streaming software.
This is a post from HackRead.com Read the original post: Google Ads Malware Wipes NFT Influencer&#…

Researchers: Brace for Zoho ManageEngine ‘Spray and Pray’ Attacks

CySecBot 16 January

1 minute

Security researchers tracking a known pre-authentication remote code execution vulnerability in Zoho’s ManageEngine products are warning organizations to brace for “spray and pray” attacks across the internet.
read more

breaking news

Avast researchers released a free BianLian ransomware decryptor for some variants of the malware

GlobalDefenseBot 16 January

3 minutes

Antivirus firm Avast released a free decryptor for the BianLian ransomware family that allows victims to recover locked files. Security firm Avast has released a free decryptor for the BianLian ransomware to allow victims of the malware to recover locked files. The BianLian ransomware emerged in August 2022, the malware was employed in attacks against organizations in […]

The post Avast researchers released a free BianLian ransomware decryptor for some variants of the malware appeared first on Security Affairs.

breaking news

Experts spotted a backdoor that borrows code from CIA’s Hive malware

GlobalDefenseBot 16 January

3 minutes

Netlab 360 observed unidentified threat actors using a new backdoor based on the US CIA’s Project Hive malware suite. Researchers from Qihoo Netlab 360 reported that unidentified threat actors using a new backdoor based on the US CIA’s Project Hive malware suite. “Hive provides a covert communications platform for a whole range of CIA malware to send exfiltrated […]

The post Experts spotted a backdoor that borrows code from CIA’s Hive malware appeared first on Security Affairs.

Website of Canadian Liquor Distributor LCBO Infected With Web Skimmer

CySecBot 16 January

1 minute

Canadian liquor distributor Liquor Control Board of Ontario (LCBO) has announced that a web skimmer injected into its online store was used to steal users’ personal data.
read more

CircleCI breach post-mortem: Attackers got in by stealing engineer’s session cookie

CySecBot 16 January

1 minute

The attackers who pulled off the recent breach of continuous integration and continuous delivery (CI/CD) platform maker CircleCI got in by compromising an engineer’s laptop with malware, stealing their 2FA-backed SSO session cookie, and using it …

breaking news

T95 Android TV Box sold on Amazon hides sophisticated malware

GlobalDefenseBot 16 January

3 minutes

Expert discovered that the T95 Android TV box, available for sale on Amazon and AliExpress, came with sophisticated pre-installed malware. Security researcher, Daniel Milisic, discovered that the T95 Android TV box he purchased on Amazon was infected with sophisticated pre-installed malware. This Android TV box model is available on Amazon and AliExpress for as low […]

The post T95 Android TV Box sold on Amazon hides sophisticated malware appeared first on Security Affairs.