Author: BleepingComputer

Hackers use Google Search ads to steal Google Ads accounts
Summary: Cybercriminals are exploiting Google search advertisements to promote phishing sites that impersonate Google Ads, tricking users into revealing their credentials. These fake ads lead victims to counterfeit login pages hosted on Google Sites, which closely mimic the official Google Ads interface. The attackers, operating from various regions, aim to steal accounts for resale and further malicious activities.…
Read More
Windows BitLocker bug triggers warnings on devices with TPMs
Summary: Microsoft is investigating a bug that triggers security alerts on systems with a Trusted Platform Module (TPM) processor when BitLocker is enabled. This issue affects both managed and unmanaged devices, causing users to see alerts indicating that some settings are managed by their administrator. Microsoft is working on a fix and will provide updates as more information becomes available.…
Read More
Microsoft ends support for Office apps on Windows 10 in October
Summary: Microsoft will cease support for Office applications on Windows 10 after the operating system’s end of support on October 14, 2025. Users will need to upgrade to Windows 11 to continue receiving support for Microsoft 365 Apps and standalone Office versions. While Office apps will still function post-support, Microsoft advises upgrading to avoid performance issues.…
Read More
Allstate car insurer sued for tracking drivers without permission
Summary: Texas Attorney General Ken Paxton has filed a lawsuit against Allstate and its subsidiary Arity for allegedly collecting and selling driving data from over 45 million Americans without consent. The lawsuit claims violations of Texas data privacy laws and seeks various legal remedies.

Threat Actor: Allstate and Arity | Allstate, Arity Victim: Over 45 million Americans | over 45 million Americans

Key Point :

Allstate and Arity are accused of unlawfully collecting sensitive location data through popular mobile apps.…
Read More
WP3.XYZ malware attacks add rogue admins to 5,000+ WordPress sites
Summary: A new malware campaign has compromised over 5,000 WordPress sites by creating rogue admin accounts, installing malicious plugins, and stealing sensitive data. The attack utilizes the wp3[.]xyz domain for data exfiltration, with ongoing investigations into the initial infection vector.

Threat Actor: Unknown | unknown Victim: WordPress Sites | WordPress Sites

Key Point :

The malware creates a rogue admin account named wpx_admin with hardcoded credentials.…
Read More
Windows 11 KB5050009 & KB5050021 cumulative updates released
Summary: Microsoft has released mandatory cumulative updates KB5050009 and KB5050021 for Windows 11 to address security vulnerabilities and improve system features. These updates include various fixes and enhancements, particularly for touchscreen gestures, File Explorer, and speech functionalities.

Threat Actor: Microsoft | Microsoft Victim: Windows 11 Users | Windows 11 Users

Key Point :

Mandatory updates KB5050009 and KB5050021 fix security vulnerabilities and improve system features.…
Read More
Hackers use FastHTTP in new high-speed Microsoft 365 password attacks
Summary: Threat actors are exploiting the FastHTTP Go library to execute rapid brute-force password attacks against Microsoft 365 accounts, with a notable success rate. This campaign, identified by SpearTip, began on January 6, 2024, and primarily targets the Azure Active Directory Graph API.

Threat Actor: Unknown | unknown Victim: Microsoft 365 | Microsoft 365

Key Point :

Brute-force attacks have a 10% success rate for account takeovers.…
Read More
Microsoft: macOS bug lets hackers install malicious kernel drivers
Summary: Apple has patched a critical macOS vulnerability (CVE-2024-44243) that allowed local attackers to bypass System Integrity Protection (SIP) and install malicious kernel drivers. This flaw could lead to severe security risks, including the installation of rootkits and unauthorized access to user data.

Threat Actor: Local attackers | local attackers Victim: macOS users | macOS users

Key Point :

Vulnerability allows bypassing SIP without physical access to the device.…
Read More
Hackers exploit critical Aviatrix Controller RCE flaw in attacks
Summary: Threat actors are exploiting a critical remote command execution vulnerability (CVE-2024-50603) in Aviatrix Controller instances to install backdoors and crypto miners. This vulnerability allows attackers to execute commands without authentication, posing significant risks to cloud environments.

Threat Actor: Unknown | unknown Victim: Aviatrix Controller users | Aviatrix Controller

Key Point :

The vulnerability is caused by inadequate input sanitization in API actions, allowing remote command execution.…
Read More