Two healthcare organizations in the UK are said to be among the victims of a malicious campaign involving the exploitation of a vulnerability linked to cybersecurity hardware provider Ivanti. According to Netherlands-based cybersecurity company EclecticIQ, threat actors have attempted to… Read More "Ivanti Vulnerability Exploit Could Expose UK NHS Data"
A CVE (Common Vulnerabilities and Exposures) is a publicly listed security flaw in software, hardware, or firmware. CVEs have unique CVE identifiers to help track and fix vulnerabilities. It helps standardize how security issues are reported and discussed. CVEs allow… Read More "Common Vulnerabilities and Exposures for Better Security"
May 28, 2025Ravie LakshmananData Privacy / Vulnerability Cybersecurity researchers have discovered a security flaw in Microsoft’s OneDrive File Picker that, if successfully exploited, could allow websites to access a user’s entire cloud storage content, as opposed to just the files… Read More "Microsoft OneDrive File Picker Flaw Grants Apps Full Cloud Access — Even When Uploading Just One File"
OneDrive File Picker is a Microsoft-provided tool that lets websites and web apps integrate with a user’s OneDrive account to allow uploading, browsing, and selecting OneDrive files directly from the app. An over-privileged OAuth trap This broad access stems from… Read More "If you use OneDrive to upload files to ChatGPT or Zoom, don’t"
Cybercriminals impersonate the trusted e-signature brand and send fake Docusign notifications to trick people into giving away their personal or corporate data 27 May 2025 • , 5 min. read Remember when you used to have to print, sign, scan,… Read More "Don’t give your personal data to fraudsters: Dodging Docusign scam emails"
The Czech Republic has accused the Chinese government of being behind a malicious cyber campaign which targeted the Czech Ministry of Foreign Affairs. In a public statement issued on May 28, Czech authorities said Beijing had sponsored cyberespionage actor APT31 to… Read More "Czech Republic Accuses China of Government Hack"
May 28, 2025The Hacker NewsBrowser Security / Credential Theft Would you expect an end user to log on to a cybercriminal’s computer, open their browser, and type in their usernames and passwords? Hopefully not! But that’s essentially what happens if… Read More "How ‘Browser-in-the-Middle’ Attacks Steal Sessions in Seconds"
A hacking group allegedly from Vietnam has been leveraging social media ads promoting generative AI tools to distribute malware since at least mid-2024, according to Google Cloud-owned Mandiant. On May 27, Google Cloud released a new report detailing the findings… Read More "Vietnam-Nexus Hackers Distribute Malware Via Fake AI Video Generators"
May 28, 2025Ravie LakshmananCryptojacking / Vulnerability A financially motivated threat actor has been observed exploiting a recently disclosed remote code execution flaw affecting the Craft Content Management System (CMS) to deploy multiple payloads, including a cryptocurrency miner, a loader dubbed… Read More "Mimo Hackers Exploit CVE-2025-32432 in Craft CMS to Deploy Cryptominer and Proxyware"
Adidas has disclosed that customer data was breached following a cyber-attack on a third-party. The global sportswear giant said the data mainly consists of contact information relating to consumers who have contacted its customer service health desk in the past.… Read More "Adidas Customer Data Stolen in Third-Party Attack"
