Hacks

Researchers discovered a new trojan Masad Stealer to deliver the powerful spyware on the targeted systems and exfiltrate the stolen data via Telegram. Masad Stealer using Telegram as a command and control channel to maintain the anonymity and hide the malware communication traffic. Recent pas, several hacking groups are abusing the Telegram and used it as a part of their attack in different categories of a malicious campaign. Malware developers who behind the Masad Stealer advertised in the underground hacking forums as it is capable of steals browser data, which might contain usernames, passwords, and credit card information. Also, it automatically replaces the own cryptocurrency wallets from the clipboard with the help of the Telegram bot that controlled by the attacker behind the scene. Researchers believe that Masad Stealer is currently an ongoing campaign and actively attacking the thousands of victims around the world. also, the command and control bot stil...

Microsoft blocked 38 file extensions in Outlook web to prevent user’s from downloading attachments with those files extensions. Outlook contains a built-in spam mail filter which prevents the junk mail from getting into the inbox. Now Microsoft added 38 file extensions to  BlockedFileTypes  property of existing  OwaMailboxPolicy  objects. Previously outlook blocked  104 file types , now Microsoft expanded it by adding additional 38 File types to enhance the security. If these file types are added to outlook blocked extensions, then users are blocked from downloading the attachments with those file types. Microsoft  said  that the “newly blocked file types are rarely used, so most organizations will not be affected by the change. However, if your users are sending and receiving affected attachments, they will report that they are no longer able to download them.” Securing your email address  is vital, in the digital world, the email a...

A picture is worth a thousand words, but a GIF is worth a thousand pictures. Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight. But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone? Well, not a theoretical idea anymore. WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages. WhatsApp Remote Code Execution Vulnerability The vulnerability, tracked as  CVE-2019-11932 , is a double-free memory corruption bug that doesn't actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that What...

Another day, another revelation of a critical unpatched zero-day vulnerability, this time in the world's most widely used mobile operating system, Android. What's more? The Android zero-day vulnerability has also been found to be exploited in the wild by the Israeli surveillance vendor NSO Group—infamous for selling zero-day exploits to governments—or one of its customers, to gain control of their targets' Android devices. Discovered by Project Zero researcher Maddie Stone, the details and a proof-of-concept exploit for the high-severity security vulnerability, tracked as CVE-2019-2215, has been made public today—just seven days after reporting it to the Android security team. The zero-day is a use-after-free vulnerability in the Android kernel's binder driver that can allow a local privileged attacker or an app to escalate their privileges to gain root access to a vulnerable device and potentially take full remote control of the device. Vulnerable Android Devices...

Intro In June 2019, ThreatFabric analysts found a new Android malware, dubbed "Cerberus", being rented out on underground forums. Its authors claim that it was used for private operations for two years preceding the start of the rental. They also state that the code is written from scratch and is not using parts of other existing banking Trojans, unlike many other Trojans that are either based completely on the source of another Trojan (such as the leaked Anubis source code that is now being resold) or at least borrow parts of other Trojans. After a thorough analysis, we can confirm that Cerberus was indeed not based on the Anubis source code. One peculiar thing about the actor group behind this banking malware is that they have an "official" Twitter account that they use to post promotional content (even videos) about the malware. Oddly enough they also use it to make fun of the AV community, sharing detection screenshots from VirusTotal (thus leaking IoC) an...