Tag cybersecurity

Critical Security Flaws Discovered in Netop Remote Learning Software

On March 22, 2021, cybersecurity researchers revealed significant vulnerabilities in the remote student monitoring tool, Netop Vision Pro. These weaknesses could potentially allow attackers to execute arbitrary code and gain control over Windows computers. The McAfee Labs Advanced Threat Research team warned that these vulnerabilities enable privilege escalation and could facilitate full access to students’ devices within the same network. The identified issues, labeled as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195, were reported to Netop on December 11, 2020. The Denmark-based company addressed these vulnerabilities in an update (version 9.7.2) released on February 25. According to Netop, this maintenance release resolved several security concerns, including local privilege escalation and transmitting sensitive data in plain text.

Vulnerabilities Discovered in Netop Remote Learning Software: A Cybersecurity Concern On March 22, 2021, cybersecurity researchers revealed multiple significant vulnerabilities in Netop Vision Pro, a widely used remote monitoring software for student oversight. These vulnerabilities could potentially allow malicious attackers to execute arbitrary code and gain control over Windows computers…

Read More

Critical Security Flaws Discovered in Netop Remote Learning Software

On March 22, 2021, cybersecurity researchers revealed significant vulnerabilities in the remote student monitoring tool, Netop Vision Pro. These weaknesses could potentially allow attackers to execute arbitrary code and gain control over Windows computers. The McAfee Labs Advanced Threat Research team warned that these vulnerabilities enable privilege escalation and could facilitate full access to students’ devices within the same network. The identified issues, labeled as CVE-2021-27192, CVE-2021-27193, CVE-2021-27194, and CVE-2021-27195, were reported to Netop on December 11, 2020. The Denmark-based company addressed these vulnerabilities in an update (version 9.7.2) released on February 25. According to Netop, this maintenance release resolved several security concerns, including local privilege escalation and transmitting sensitive data in plain text.

Linux Malware Leveraging Malicious RAR Filenames Evades Antivirus Detection

In a recent report from cybersecurity researchers, a new attack strategy has been revealed, utilizing phishing emails to spread an open-source backdoor known as VShell. According to Trellix researcher Sagar Bade, this “Linux-specific malware infection chain begins with a spam email containing a harmful RAR archive file.” The unique aspect of this attack is that the malicious payload is embedded directly in the filename, rather than hidden within the file’s content or through macros. By employing shell command injection and Base64-encoded Bash payloads, attackers transform routine file listing commands into triggers for automatic malware execution. This technique exploits a common, yet dangerous pattern in shell scripts, where poorly sanitized file names allow seemingly innocuous commands like eval or echo to execute arbitrary code. Additionally, this approach provides further advantages…

Linux Malware Exploits Malicious RAR Filenames to Bypass Antivirus Detection August 22, 2025 Recent research has unveiled a sophisticated attack vector targeting Linux systems, whereby threat actors utilize phishing emails to distribute an open-source backdoor named VShell. According to cybersecurity expert Sagar Bade from Trellix, this method represents a distinct…

Read More

Linux Malware Leveraging Malicious RAR Filenames Evades Antivirus Detection

In a recent report from cybersecurity researchers, a new attack strategy has been revealed, utilizing phishing emails to spread an open-source backdoor known as VShell. According to Trellix researcher Sagar Bade, this “Linux-specific malware infection chain begins with a spam email containing a harmful RAR archive file.” The unique aspect of this attack is that the malicious payload is embedded directly in the filename, rather than hidden within the file’s content or through macros. By employing shell command injection and Base64-encoded Bash payloads, attackers transform routine file listing commands into triggers for automatic malware execution. This technique exploits a common, yet dangerous pattern in shell scripts, where poorly sanitized file names allow seemingly innocuous commands like eval or echo to execute arbitrary code. Additionally, this approach provides further advantages…

⚡ Weekly Update: Vulnerabilities in Password Managers, Apple 0-Day Exploit, Concealed AI Prompts, Real-World Attacks & More

📅 August 25, 2025

Cybersecurity Insights / Hacking

In today’s fast-paced cybersecurity landscape, developments can shift the balance of power in global supply chains and influence strategic decisions. Effective defense transcends firewalls and patches—it’s about understanding how cyber threats intertwine with business dynamics, trust, and authority. This week’s highlights demonstrate how technical vulnerabilities translate into critical issues and underscore the importance of security decisions that extend beyond mere IT considerations.

⚡ Threat of the Week
Explore the Risks: Popular Password Managers Targeted by Clickjacking – Major password manager browser extensions have been identified as vulnerable to clickjacking attacks. This security flaw can potentially lead to the theft of sensitive information, including account credentials, two-factor authentication (2FA) codes, and credit card details, under specific circumstances. This tactic, known as Document Object Model (DOM)-based extension clickjacking, has raised alarms among security experts.

Weekly Cybersecurity Summary: Vulnerabilities in Password Managers and Critical Exploits August 25, 2025 Cybersecurity News / Hacking The landscape of cybersecurity is evolving at a pace that often mirrors global political tensions. A single security breach has the potential to disrupt supply chains, transform software vulnerabilities into exploitable assets, and…

Read More

⚡ Weekly Update: Vulnerabilities in Password Managers, Apple 0-Day Exploit, Concealed AI Prompts, Real-World Attacks & More

📅 August 25, 2025

Cybersecurity Insights / Hacking

In today’s fast-paced cybersecurity landscape, developments can shift the balance of power in global supply chains and influence strategic decisions. Effective defense transcends firewalls and patches—it’s about understanding how cyber threats intertwine with business dynamics, trust, and authority. This week’s highlights demonstrate how technical vulnerabilities translate into critical issues and underscore the importance of security decisions that extend beyond mere IT considerations.

⚡ Threat of the Week
Explore the Risks: Popular Password Managers Targeted by Clickjacking – Major password manager browser extensions have been identified as vulnerable to clickjacking attacks. This security flaw can potentially lead to the theft of sensitive information, including account credentials, two-factor authentication (2FA) codes, and credit card details, under specific circumstances. This tactic, known as Document Object Model (DOM)-based extension clickjacking, has raised alarms among security experts.

Mozilla Leveraged Anthropic’s Mythos to Identify and Resolve 271 Bugs in Firefox

Mozilla’s Firefox 150 Release Enhances Cybersecurity with AI-Backed Protections Amidst the intensifying discourse on the implications of emerging AI technologies on cybersecurity, Mozilla has announced that its latest release of the Firefox browser—version 150—will incorporate robust defenses addressing 271 vulnerabilities. This significant upgrade leverages insights gained through early access to…

Read MoreMozilla Leveraged Anthropic’s Mythos to Identify and Resolve 271 Bugs in Firefox

MixShell Malware Exploits Contact Forms to Target U.S. Supply Chain Manufacturers

Date: Aug 26, 2025
Categories: Enterprise Security / Artificial Intelligence

Cybersecurity experts are highlighting a complex social engineering initiative aimed at crucial supply chain manufacturing firms, deploying in-memory malware known as MixShell. This campaign, dubbed “ZipLine” by Check Point Research, circumvents traditional phishing tactics by initiating contact through companies’ public “Contact Us” forms. Attackers deceive employees into engaging in what appears to be a legitimate communication. According to Check Point’s statement to The Hacker News, these interactions can span several weeks, often involving fabricated non-disclosure agreements before the attackers deliver a weaponized ZIP file containing the stealthy MixShell malware. The attacks have impacted various organizations across multiple sectors, with a particular focus on U.S. manufacturers in industrial fields such as machinery, metalworking, component production, and engine manufacturing.

MixShell Malware Campaign Targets U.S. Supply Chain Manufacturers via Contact Forms August 26, 2025 Enterprise Security / Artificial Intelligence Cybersecurity experts have drawn attention to a sophisticated social engineering operation known as ZipLine, which is specifically aimed at U.S. supply chain manufacturers. This campaign employs a stealthy in-memory malware called…

Read More

MixShell Malware Exploits Contact Forms to Target U.S. Supply Chain Manufacturers

Date: Aug 26, 2025
Categories: Enterprise Security / Artificial Intelligence

Cybersecurity experts are highlighting a complex social engineering initiative aimed at crucial supply chain manufacturing firms, deploying in-memory malware known as MixShell. This campaign, dubbed “ZipLine” by Check Point Research, circumvents traditional phishing tactics by initiating contact through companies’ public “Contact Us” forms. Attackers deceive employees into engaging in what appears to be a legitimate communication. According to Check Point’s statement to The Hacker News, these interactions can span several weeks, often involving fabricated non-disclosure agreements before the attackers deliver a weaponized ZIP file containing the stealthy MixShell malware. The attacks have impacted various organizations across multiple sectors, with a particular focus on U.S. manufacturers in industrial fields such as machinery, metalworking, component production, and engine manufacturing.

Microsoft’s Emergency Patch Ineffective Against PrintNightmare RCE Vulnerability

July 8, 2021

Microsoft’s attempt to mitigate the notorious PrintNightmare vulnerability across Windows 10 version 1607, Windows Server 2012, and Windows Server 2016 has proven inadequate. Reports indicate that the fix for the remote code execution exploit within the Windows Print Spooler service can still be circumvented under certain conditions, allowing attackers to execute arbitrary code on compromised systems. The company released an emergency out-of-band update for CVE-2021-34527 (CVSS score: 8.8) after researchers from Hong Kong-based cybersecurity firm Sangfor unintentionally disclosed the flaw late last month. Notably, this vulnerability is distinct from another issue, CVE-2021-1675, which Microsoft addressed on June 8. “Several days ago, two security vulnerabilities were identified in Microsoft Windows’ existing printing mechanism,” explained Yaniv Balmas, head of cyber research at C…

Microsoft’s Emergency Patch Fails to Fully Resolve PrintNightmare RCE Vulnerability On July 8, 2021, Microsoft announced the release of an emergency out-of-band update intended to address the PrintNightmare vulnerability, officially identified as CVE-2021-34527. This flaw pertains to a remote code execution (RCE) exploit within the Windows Print Spooler service, impacting…

Read More

Microsoft’s Emergency Patch Ineffective Against PrintNightmare RCE Vulnerability

July 8, 2021

Microsoft’s attempt to mitigate the notorious PrintNightmare vulnerability across Windows 10 version 1607, Windows Server 2012, and Windows Server 2016 has proven inadequate. Reports indicate that the fix for the remote code execution exploit within the Windows Print Spooler service can still be circumvented under certain conditions, allowing attackers to execute arbitrary code on compromised systems. The company released an emergency out-of-band update for CVE-2021-34527 (CVSS score: 8.8) after researchers from Hong Kong-based cybersecurity firm Sangfor unintentionally disclosed the flaw late last month. Notably, this vulnerability is distinct from another issue, CVE-2021-1675, which Microsoft addressed on June 8. “Several days ago, two security vulnerabilities were identified in Microsoft Windows’ existing printing mechanism,” explained Yaniv Balmas, head of cyber research at C…

TamperedChef Malware Masquerading as Fake PDF Editors Gathers Credentials and Cookies

Cybersecurity Alert: Aug 29, 2025

Cybersecurity experts have uncovered a new cybercrime operation utilizing deceptive advertising techniques to funnel victims to fraudulent websites, leading them to download an information-stealing malware known as TamperedChef. Researchers from Truesec—Mattias Wåhlén, Nicklas Keijser, and Oscar Lejerbäck Wolf—reported on the findings, revealing that the goal is to entice victims into installing a Trojan PDF editor. This malicious software is designed to capture sensitive information, including login credentials and web cookies. The scheme primarily leverages multiple fake sites to promote a free PDF editor named AppSuite PDF Editor. Once downloaded and executed, the software prompts users to agree to its terms of service and privacy policy, all while in the background covertly connecting to an external server to install the actual malware.

TamperedChef Malware Poses as Fake PDF Editors to Steal Credentials and Cookies In a recent cybersecurity alert, researchers uncovered a malicious campaign that employs deceptive advertising techniques to lure victims into downloading a second-rate PDF editor. This operation centers around a malware known as TamperedChef, which is specifically designed to…

Read More

TamperedChef Malware Masquerading as Fake PDF Editors Gathers Credentials and Cookies

Cybersecurity Alert: Aug 29, 2025

Cybersecurity experts have uncovered a new cybercrime operation utilizing deceptive advertising techniques to funnel victims to fraudulent websites, leading them to download an information-stealing malware known as TamperedChef. Researchers from Truesec—Mattias Wåhlén, Nicklas Keijser, and Oscar Lejerbäck Wolf—reported on the findings, revealing that the goal is to entice victims into installing a Trojan PDF editor. This malicious software is designed to capture sensitive information, including login credentials and web cookies. The scheme primarily leverages multiple fake sites to promote a free PDF editor named AppSuite PDF Editor. Once downloaded and executed, the software prompts users to agree to its terms of service and privacy policy, all while in the background covertly connecting to an external server to install the actual malware.

Urgent: Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation

Cybersecurity agencies in Australia and the U.S. are sounding the alarm about a serious vulnerability in ForgeRock’s OpenAM access management system, which is being actively exploited to execute remote code on compromised systems. The Australian Cyber Security Centre (ACSC) has reported that threat actors are leveraging this flaw to infiltrate multiple hosts, deploying additional malware and tools. However, details regarding the nature and scope of the attacks, as well as the identities of the perpetrating actors, remain undisclosed.

Identified as CVE-2021-35464, this vulnerability is a pre-authentication remote code execution (RCE) flaw linked to unsafe Java deserialization in the Jato framework used by ForgeRock Access Manager. Exploiting this vulnerability allows attackers to execute commands within the context of the current user rather than as a root user.

Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation On July 13, 2021, cybersecurity agencies from Australia and the United States issued a serious warning regarding an actively exploited vulnerability within ForgeRock’s OpenAM access management solution. This security flaw could allow attackers to execute arbitrary code on affected systems…

Read More

Urgent: Critical RCE Vulnerability in ForgeRock Access Manager Under Active Exploitation

Cybersecurity agencies in Australia and the U.S. are sounding the alarm about a serious vulnerability in ForgeRock’s OpenAM access management system, which is being actively exploited to execute remote code on compromised systems. The Australian Cyber Security Centre (ACSC) has reported that threat actors are leveraging this flaw to infiltrate multiple hosts, deploying additional malware and tools. However, details regarding the nature and scope of the attacks, as well as the identities of the perpetrating actors, remain undisclosed.

Identified as CVE-2021-35464, this vulnerability is a pre-authentication remote code execution (RCE) flaw linked to unsafe Java deserialization in the Jato framework used by ForgeRock Access Manager. Exploiting this vulnerability allows attackers to execute commands within the context of the current user rather than as a root user.

Cyber Attack Disrupts Passport Control at Istanbul Airport

July 26, 2013

The passport control system at Istanbul Ataturk Airport’s international departure terminal experienced a cyber attack on Friday, impacting operations at another airport in the city. Passengers faced lengthy delays, with many waiting hours as flight departures were postponed due to the system shutdown at both locations. Authorities were able to restore functionality after some time.

Reports indicated that the passport control system at Sabiha Gokcen International Airport was also affected by issues stemming from the Polnet data system managed by the Istanbul provincial security directorate. Preliminary investigations suggest the systems may have been compromised by malware, though authorities are still determining whether any user information was extracted from the affected machines.

As of now, there has been no claim of responsibility for the cyber attack. This incident is part of a worrying trend of malware attacks targeting critical infrastructure. Cybersecurity has become an increasingly critical concern in recent years.

Cyber Attack Disrupts Istanbul Airport’s Passport Control Systems On July 26, 2013, the passport control systems at Istanbul Ataturk Airport’s international departure terminal faced a significant disruption due to a cyber attack, affecting operations not only at this major facility but also at Sabiha Gokcen International Airport, another key location…

Read More

Cyber Attack Disrupts Passport Control at Istanbul Airport

July 26, 2013

The passport control system at Istanbul Ataturk Airport’s international departure terminal experienced a cyber attack on Friday, impacting operations at another airport in the city. Passengers faced lengthy delays, with many waiting hours as flight departures were postponed due to the system shutdown at both locations. Authorities were able to restore functionality after some time.

Reports indicated that the passport control system at Sabiha Gokcen International Airport was also affected by issues stemming from the Polnet data system managed by the Istanbul provincial security directorate. Preliminary investigations suggest the systems may have been compromised by malware, though authorities are still determining whether any user information was extracted from the affected machines.

As of now, there has been no claim of responsibility for the cyber attack. This incident is part of a worrying trend of malware attacks targeting critical infrastructure. Cybersecurity has become an increasingly critical concern in recent years.