Critical Vulnerability Discovered in WordPress Funnel Builder Plugin A significant security vulnerability affecting the Funnel Builder plugin for WordPress has been actively exploited, allowing malicious actors to inject harmful JavaScript code into WooCommerce checkout pages. This alarming situation has raised concerns over the potential theft of sensitive payment information from…
Recent investigations by cybersecurity specialists have uncovered a significant security vulnerability affecting Microsoft Office 2016 and earlier versions. This unpatched logical flaw enables cybercriminals to integrate malicious code into document files, effectively deceiving users into executing malware on their systems. The researchers at Cymulate identified that the vulnerability exploits the…
Pwn2Own 2018: A Showcase of Mobile Vulnerabilities The Pwn2Own 2018 mobile hacking competition, held in Tokyo on November 13-14, demonstrated the ongoing vulnerability of even well-secured smartphones. White hat hackers successfully exploited fully patched devices, including flagship models from renowned manufacturers, revealing concerning security gaps. Key targets included the iPhone…
A recent npm campaign, attributed to North Korea’s Lazarus Group, has highlighted a new strategy in which attackers employ deceptive package names to infiltrate developers’ systems and software build environments. This tactic poses significant risks for organizations reliant on JavaScript tools, as many developers may unwittingly install these malicious packages.…
Emerging Tracking Technique Raises Privacy Concerns for Internet Users In recent years, websites have increasingly employed sophisticated methods to monitor visitors’ online activities, accumulating data on browsing habits, device fingerprints, and even real-time keystrokes and mouse movements. Recent findings indicate that major tech companies such as Meta and Yandex have…
A significant security vulnerability has surfaced in Lodash, a widely utilized JavaScript library employed in over four million projects on GitHub alone. This issue poses a high risk, allowing attackers to potentially jeopardize the services leveraging this library and impact their user bases significantly. Lodash, accessible at lodash.com, offers developers…
Graphic for illustration On Tuesday, cybersecurity researchers unveiled a significant address bar spoofing vulnerability that impacts various mobile browsers, including Apple Safari and Opera Touch. This flaw poses a substantial risk, enabling attackers to launch spear-phishing campaigns and disseminate malware. Other affected browsers include UCWeb, Yandex Browser, Bolt Browser, and…
A recently identified zero-click remote code execution (RCE) vulnerability in Microsoft Teams’ desktop applications poses significant risks to users. This flaw enables potential adversaries to execute arbitrary code on a targeted system merely by sending a specially crafted chat message. The vulnerability was reported on August 31, 2020, by Oskars…
February 17, 2021
A malvertising collective known as “ScamClub” has exploited a zero-day vulnerability in WebKit-based browsers to inject malicious payloads that redirect users to fraudulent gift card scam websites. The attacks, first identified by the advertising security firm Confiant in late June 2020, took advantage of a bug (CVE-2021–1801) that allowed malicious actors to circumvent the iframe sandboxing policy in the browser engine used by Safari and Google Chrome on iOS, enabling them to execute harmful code. This technique specifically targeted the way WebKit manages JavaScript event listeners, allowing attackers to escape the sandbox of an ad’s inline frame even with the “allow-top-navigation-by-user-activation” attribute in place, which typically prevents redirection unless an event occurs within the iframe. To validate this approach, researchers created a simple HTML file featuring a cross-origin sandboxed iframe, along with an external button…
Malvertisers Exploit WebKit 0-Day to Redirect Users to Fraudulent Schemes On February 17, 2021, security researchers revealed a significant cybersecurity threat posed by a malvertising group dubbed “ScamClub.” This group has taken advantage of a zero-day vulnerability within WebKit-based browsers, enabling them to inject malicious payloads that redirect unsuspecting users…
February 17, 2021
A malvertising collective known as “ScamClub” has exploited a zero-day vulnerability in WebKit-based browsers to inject malicious payloads that redirect users to fraudulent gift card scam websites. The attacks, first identified by the advertising security firm Confiant in late June 2020, took advantage of a bug (CVE-2021–1801) that allowed malicious actors to circumvent the iframe sandboxing policy in the browser engine used by Safari and Google Chrome on iOS, enabling them to execute harmful code. This technique specifically targeted the way WebKit manages JavaScript event listeners, allowing attackers to escape the sandbox of an ad’s inline frame even with the “allow-top-navigation-by-user-activation” attribute in place, which typically prevents redirection unless an event occurs within the iframe. To validate this approach, researchers created a simple HTML file featuring a cross-origin sandboxed iframe, along with an external button…
