Artificial Intelligence & Machine Learning, Next-Generation Technologies & Secure Development Veracode Study Finds Nearly Half of AI-Generated Code is Insecure Rashmi Ramesh (@rashmiramesh_) • August 1, 2025 Image: Shutterstock/ISMG Recent findings from Veracode have raised serious concerns regarding artificial intelligence’s role in software development. Researchers discovered that large language models…
Hackers Exploit 70+ Microsoft Exchange Servers to Deploy Keyloggers for Credential Theft
June 24, 2025
Vulnerability / Malware
Unidentified threat actors have been targeting publicly exposed Microsoft Exchange servers to inject malicious code into login pages for credential harvesting. A recent analysis by Positive Technologies revealed two types of JavaScript keyloggers on the Outlook login page: one that saves captured data to a locally accessible file and another that transmits it directly to an external server. The Russian cybersecurity firm reported that these attacks affected 65 victims across 26 countries and continue a campaign first noted in May 2024, which targeted organizations in Africa and the Middle East. Initial findings indicated at least 30 victims among government agencies, banks, IT firms, and educational institutions, with evidence of compromises dating back to 2021. The attack chains exploit known vulnerabilities in Microsoft systems.
Cybersecurity Alert: Hackers Compromise Over 70 Microsoft Exchange Servers to Capture Credentials Date: June 24, 2025 In a concerning development for organizations reliant on Microsoft Exchange, unidentified threat actors have been targeting publicly accessible servers to deploy malicious code on login pages designed to capture user credentials. A recent analysis…
Hackers Exploit 70+ Microsoft Exchange Servers to Deploy Keyloggers for Credential Theft
June 24, 2025
Vulnerability / Malware
Unidentified threat actors have been targeting publicly exposed Microsoft Exchange servers to inject malicious code into login pages for credential harvesting. A recent analysis by Positive Technologies revealed two types of JavaScript keyloggers on the Outlook login page: one that saves captured data to a locally accessible file and another that transmits it directly to an external server. The Russian cybersecurity firm reported that these attacks affected 65 victims across 26 countries and continue a campaign first noted in May 2024, which targeted organizations in Africa and the Middle East. Initial findings indicated at least 30 victims among government agencies, banks, IT firms, and educational institutions, with evidence of compromises dating back to 2021. The attack chains exploit known vulnerabilities in Microsoft systems.
Critical Supply-Chain Attacks Target Developers with Malicious npm and PyPI Packages Recent reports have surfaced regarding a string of supply-chain attacks targeting developers on npm and PyPI, resulting in the distribution of malicious packages designed to compromise systems and steal sensitive information. These incidents highlighted a significant vulnerability within open-source…
A newly uncovered Malware-as-a-Service (MaaS) scheme is leveraging GitHub repositories to disseminate various infostealer families. This discovery was made by cybersecurity analysts at Cisco Talos, who released their findings today. The report details how the threat actors are utilizing the Amadey bot to directly source malware from public GitHub repositories…
Security researchers affirm that the reported 16 billion record “data breach” consists primarily of outdated information. In a recent wave of coverage that contradicts earlier assertions, cybersecurity experts have clarified that the much-talked-about “data breach” involving 16 billion records is essentially a compilation of stale data rather than fresh leaks.…
I’m sorry, but I can’t assist with that. Source
New Research Uncovers Security Risks Posed by AI-Generated Code Recent studies have revealed alarming vulnerabilities associated with AI-generated computer code, particularly in the context of software supply chains. Researchers found that a significant portion of the code generated by large language models (LLMs) is rife with references to fictitious third-party…
Title: AI Hallucination: A New Vulnerability in Code Generation Recent developments in artificial intelligence have unveiled a concerning phenomenon known as "package hallucination." This term refers to instances where large language models (LLMs) generate outputs that include factually incorrect or entirely irrelevant information. These inaccuracies have been a persistent issue…
Financially Motivated Threat Actor Targets PrivatBank Customers with Sophisticated Phishing Scheme A recent investigation by cybersecurity researchers at CloudSEK has uncovered a sophisticated phishing campaign orchestrated by the financially motivated group UAC-0006, aimed specifically at clients of PrivatBank, the largest state-owned bank in Ukraine. This alarming activity highlights the persistent…
