Tag: ANDROID

Hackers Exploit 16 Zero-Days on First Day of Pwn2Own Automotive 2025
Summary: The Pwn2Own Automotive 2025 competition saw security researchers exploit 16 unique zero-day vulnerabilities, earning a total of $382,750 in cash awards. Fuzzware.io led the event by hacking electric vehicle chargers, while other teams also showcased their skills against various automotive technologies. The competition emphasizes the importance of securing automotive systems as vendors are given 90 days to patch the reported vulnerabilities.…
Read More
Hackers Exploit 16 Zero-Days on First Day of Pwn2Own Automotive 2025
Summary: The Pwn2Own Automotive 2025 hacking contest concluded with researchers earning $886,250 by exploiting 49 zero-day vulnerabilities in various automotive software and products. The event highlighted security flaws in electric vehicle chargers, car operating systems, and in-vehicle infotainment systems. Summoning Team’s Sina Kheirkhah emerged as the winner, showcasing significant exploits against EV chargers and IVI systems.…
Read More
Android’s New Identity Check Feature Locks Device Settings Outside Trusted Locations
Summary: Google has introduced a new feature called Identity Check for Android devices, requiring biometric authentication for accessing sensitive settings outside of trusted locations. This feature aims to enhance security for Google Accounts and prevent unauthorized access. It is currently available on select Pixel and Samsung Galaxy devices running the latest software updates.…
Read More
Frequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine | Microsoft Security Blog
Microsoft Threat Intelligence has reported on the Russian nation-state actor Secret Blizzard, which has been using co-opted tools and infrastructure from other threat actors to conduct espionage activities against targets in Ukraine. The campaigns have involved the deployment of custom malware, including the Tavdig and KazuarV2 backdoors, often facilitated through cybercriminal tools like Amadey bot malware.…
Read More
Critical Mozilla Vulnerabilities Prompt Urgent Updates for Firefox and Thunderbird Users
Mozilla Firefox and Thunderbird users are facing critical vulnerabilities that could result in arbitrary code execution and system instability. The Indian Computer Emergency Response Team (CERT-In) has issued an advisory urging immediate software updates to mitigate these risks. Affected: Mozilla Firefox, Mozilla Thunderbird

Keypoints :

High-severity vulnerabilities found in Mozilla Firefox and Thunderbird.…
Read More
Researchers Found New Android Malware Linked to DoNot Team APT Group
Summary: CYFIRMA researchers have linked a newly discovered Android malware named “Tanzeem” to the Indian APT group DoNot Team, which has been active since 2016. This malware targets government and military organizations in South Asia and utilizes the OneSignal platform to deliver phishing links. The evolving tactics of the DoNot APT group signify a persistent threat to regional cybersecurity.…
Read More
DoNot Team Linked to New Tanzeem Android Malware Targeting Intelligence Collection
Summary: The DoNot Team has developed a new Android malware named Tanzeem, designed for targeted cyber attacks against specific individuals or groups. The malware masquerades as a chat application but fails to function, instead facilitating intelligence gathering through various malicious activities. This development highlights the group’s evolving tactics, including the abuse of push notifications to deploy additional malware.…
Read More
Star Blizzard hackers abuse WhatsApp to target high-value diplomats
Summary: Russian nation-state actor Star Blizzard has initiated a spear-phishing campaign targeting WhatsApp accounts of individuals in government, diplomacy, and organizations related to Ukraine aid. This campaign marks a tactical shift following the exposure of their previous methods, utilizing social engineering techniques to compromise accounts without malware.…
Read More
Summary: Amazon has issued a security advisory for two critical vulnerabilities (CVE-2025-0500 and CVE-2025-0501) affecting its native clients for Amazon WorkSpaces, AppStream 2.0, and DCV, with a CVSSv4 score of 7.7. These vulnerabilities could enable attackers to execute man-in-the-middle (MITM) attacks, potentially granting unauthorized access to remote sessions.…
Read More
New Star Blizzard spear-phishing campaign targets WhatsApp accounts | Microsoft Security Blog
In mid-November 2024, Microsoft Threat Intelligence reported a shift in tactics by the Russian threat actor Star Blizzard, who began targeting WhatsApp accounts through spear-phishing campaigns. This new approach involves impersonating US government officials to lure victims into malicious links that compromise their WhatsApp data. The campaign highlights the actor’s resilience and adaptability in the face of operational disruptions.…
Read More
Windows 10 KB5049981, Windows 11 KB5050009 & KB5050021 Security Updates
Microsoft has released security updates for Windows 10 and Windows 11, which include new features and address various vulnerabilities. Notably, the updates introduce a blocklist for vulnerable kernel drivers and highlight known issues affecting SSH connections and Citrix configurations. Affected: Windows 10, Windows 11, Citrix

Keypoints :

Microsoft has provided security updates for Windows 10 (KB5049981) and Windows 11 (KB5050009, KB5050021).…
Read More
Chrome 132 Patches 16 Vulnerabilities
Summary: Google has released Chrome 132, addressing 16 security vulnerabilities, including 13 reported by external researchers. Among these, five high-severity flaws were identified, leading to significant bug bounty rewards for the researchers involved. Users are encouraged to update their browsers promptly to mitigate potential risks.

Threat Actor: N/A | N/A Victim: Google Chrome Users | Google Chrome Users

Keypoints :

Chrome 132 includes 16 security fixes, with five high-severity vulnerabilities addressed.…
Read More
Microsoft Patch Tuesday January 2025 Security Update Review Qualys ThreatPROTECT
January 2025 marks the release of Microsoft’s first Patch Tuesday, addressing 159 vulnerabilities, including 10 critical and 149 important. Among these, eight zero-day vulnerabilities have been patched, with three actively exploited. Key updates include fixes for various Microsoft products, notably in Windows and Microsoft Office. Affected: Microsoft Windows, Microsoft Office, .NET,…
Read More