Apr 10, 2025The Hacker NewsAI Security / Enterprise Security AI agents have rapidly evolved from experimental technology to essential business tools. The OWASP framework explicitly recognizes that Non-Human Identities play a key role in agentic AI security. Their analysis highlights… Read More "A Deep Dive Into AI & NHI"
Apr 10, 2025Ravie LakshmananMalware / Cryptocurrency Threat actors are continuing to upload malicious packages to the npm registry so as to tamper with already-installed local versions of legitimate libraries and execute malicious code in what’s seen as a sneakier attempt… Read More "Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses"
Apr 10, 2025Ravie LakshmananContainer Security / Vulnerability Cybersecurity researchers have detailed a case of an incomplete patch for a previously addressed security flaw impacting the NVIDIA Container Toolkit that, if successfully exploited, could put sensitive data at risk. The original… Read More "Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes"
Overview of the PlayPraetor Masquerading Party Variants CTM360 has now identified a much larger extent of the ongoing Play Praetor campaign. What started with 6000+ URLs of a very specific banking attack has now grown to 16,000+ with multiple variants.… Read More "CTM360 Uncovers a Play Masquerading Party"
Law enforcement authorities have announced that they tracked down the customers of the SmokeLoader malware and detained at least five individuals. “In a coordinated series of actions, customers of the Smokeloader pay-per-install botnet, operated by the actor known as ‘Superstar,’… Read More "Europol Arrests Five SmokeLoader Clients Linked by Seized Database Evidence"
Apr 10, 2025Ravie LakshmananWebsite Security / Cybercrime Cybersecurity researchers have disclosed details of an artificial intelligence (AI) powered platform called AkiraBot that’s used to spam website chats, comment sections, and contact forms to promote dubious search engine optimization (SEO) services… Read More "AkiraBot Targets 420,000 Sites with OpenAI-Generated Spam, Bypassing CAPTCHA Protections"
Apr 09, 2025Ravie LakshmananApplication Security / Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting Gladinet CentreStack to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild.… Read More "CISA Warns of CentreStack’s Hard-Coded MachineKey Vulnerability Enabling RCE Attacks"
Apr 09, 2025Ravie LakshmananVulnerability / Ransomware Microsoft has revealed that a now-patched security flaw impacting the Windows Common Log File System (CLFS) was exploited as a zero-day in ransomware attacks aimed at a small number of targets. “The targets include… Read More "PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware"
Lovable, a generative artificial intelligence (AI) powered platform that allows for creating full-stack web applications using text-based prompts, has been found to be the most susceptible to jailbreak attacks, allowing novice and aspiring cybercrooks to set up lookalike credential harvesting… Read More "Lovable AI Found Most Vulnerable to VibeScamming — Enabling Anyone to Build Live Scam Pages"
Apr 09, 2025Ravie LakshmananWindows Security / Vulnerability A Chinese-affiliated threat actor known for its cyber-attacks in Asia has been observed exploiting a security flaw in security software from ESET to deliver a previously undocumented malware codenamed TCESB. “Previously unseen in… Read More "New TCESB Malware Found in Active Attacks Exploiting ESET Security Scanner"
