Tag: SPOOFING

Hunt.io Insights: Gamaredon’s Flux-Like Infrastructure and a Look at Recent ShadowPad Activity
This article explores the infrastructure patterns of two state-linked cyber threat groups based in Russia and China, focusing on Gamaredon and RedFoxtrot. It highlights their use of fast flux DNS techniques for operational stealth and the reuse of TLS certificates among others. Furthermore, it discusses the implications of these patterns for cybersecurity defenses.…
Read More
Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws
Summary: Microsoft’s April 2025 Patch Tuesday addresses 134 vulnerabilities, including one actively exploited zero-day and multiple critical flaws that enable remote code execution. The updates are currently available for Windows Server and Windows 11, with Windows 10 updates expected shortly. Affected organizations should prioritize these updates to protect their systems from potential exploits.…
Read More
WhatsApp for Windows Spoofing Vulnerability Poses Code Execution Risk
Summary: A security advisory from Facebook reveals a spoofing vulnerability in WhatsApp for Windows (CVE-2025-30401) that could allow attackers to execute arbitrary code by manipulating file attachments. This issue arises from a discrepancy between how the application displays MIME types and handles file extension openings. Users of vulnerable versions are urged to update their application to version 2.2450.6 or later to mitigate this risk.…
Read More
Summary: A cybercriminal group known as the Smishing Triad is intensifying smishing activities targeting consumers in the US and UK with fraudulent texts related to toll payment services. This campaign involves the use of deceptive messages that impersonate legitimate toll agencies, demanding payments for fictitious unpaid tolls and soliciting sensitive personal information.…
Read More
EncryptHub’s dual life: Cybercriminal vs Windows bug-bounty researcher
Summary: The threat actor EncryptHub has been connected to SkorikARI after self-infection led to exposure of credentials, allowing researchers to track both cybercriminal and security research activities. The exposed credentials revealed links to Windows zero-day vulnerabilities that EncryptHub reportedly disclosed to Microsoft. This duality of identity reflects a complex individual straddling the line between malware development and ethical research.…
Read More
Social Media Flooded with Ghibli AI Images—But What Are We Really Feeding the Algorithms?
Summary: The viral trend of AI-generated art, particularly Ghibli-style portraits, raises significant privacy concerns as users unknowingly share sensitive biometric data. While the transformation of selfies into whimsical anime characters captivates audiences, it also poses risks of data misuse, identity theft, and exploitation by AI algorithms.…
Read More
Microsoft Credits EncryptHub, Hacker Behind 618+ Breaches, for Disclosing Windows Flaws
Summary: A lone wolf actor, known as EncryptHub, has been identified by Microsoft as the discoverer of two Windows security flaws while simultaneously engaging in cybercrime. The individual, originating from Ukraine and now in Romania, has compromised over 618 high-value targets and utilized advanced techniques in malware development, including reliance on OpenAI’s ChatGPT.…
Read More
Microsoft Warns of Tax-Themed Email Attacks Using PDFs and QR Codes to Deliver Malware
Summary: Microsoft has issued warnings about multiple phishing campaigns utilizing tax-related themes to distribute malware and steal credentials. These campaigns employ sophisticated methods like URL shorteners and QR codes to mask malicious intent while targeting thousands of organizations, especially in the U.S. The attacks often involve a phishing-as-a-service platform, RaccoonO365, and various malware types, including remote access trojans and information stealers.…
Read More
Chrome 135, Firefox 137 Patch High-Severity Vulnerabilities
Summary: Google and Mozilla have released Chrome 135 and Firefox 137, addressing nearly two dozen security vulnerabilities, including high-severity memory safety bugs. Chrome 135 includes 14 security fixes, while Firefox 137 resolves eight security defects, some of which could lead to code execution. Users are encouraged to update their applications promptly, as no active exploitation of these vulnerabilities has been reported.…
Read More
New Malware Loaders Use Call Stack Spoofing, GitHub C2, and .NET Reactor for Stealth
Summary: Cybersecurity researchers have identified enhanced malware loaders, including Hijack Loader and SHELBY, that use advanced evasion tactics and innovative command-and-control methods. Hijack Loader introduces call stack spoofing and anti-VM checks, while SHELBY operates through GitHub for remote control and data exfiltration. Meanwhile, Emmenhtal loader has been distributing SmokeLoader via phishing emails using .NET…
Read More
Analyzing New HijackLoader Evasion Tactics
HijackLoader is a modular malware loader discovered in 2023, capable of delivering payloads and employing various evasion techniques. Recently uncovered modules feature advanced tactics such as call stack spoofing, virtual machine detection, and persistence through scheduled tasks. Affected: malware, cybersecurity sector, antivirus software

Keypoints :

HijackLoader is a malware downloader first identified in 2023, continually receiving updates.…
Read More
Major Cyber Attacks Targeting Transportation & Logistics Industry
The transportation and logistics industry is increasingly targeted by cybercriminals as they exploit vulnerabilities to disrupt operations and steal sensitive data. Major incidents include ransomware attacks affecting ports and airports, along with data breaches that raise severe concerns about data security within the sector. Affected: transportation and logistics industry, public infrastructure, cybersecurity sector

Keypoints :

Transportation and logistics sector is a major target for cybercriminals due to valuable data.…
Read More
CoffeeLoader Uses GPU-Based Armoury Packer to Evade EDR and Antivirus Detection
Summary: Cybersecurity researchers have identified a new malware named CoffeeLoader, which is designed to download and execute secondary malware payloads while evading detection. This sophisticated loader exhibits behavioral similarities to the previously known SmokeLoader and employs various techniques to bypass security measures. CoffeeLoader primarily targets users through phishing campaigns and exploits vulnerabilities in systems for persistence and execution.…
Read More
CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices
Summary: CISA has added two critical vulnerabilities affecting Sitecore CMS to its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. These flaws allow attackers to execute arbitrary code through deserialization vulnerabilities. Additionally, there are ongoing exploit attempts against DrayTek devices and a new vulnerability in the Next.js…
Read More