Hacks

NSO Group CEO Shalev Hulio Claim that Facebook tried to buy a Pegasus Spyware to monitor better their users especially access to the Apple user’s data and their activities. Pegasus is a powerful commercial spyware developed by Israel based spyware maker NSO group, also known as Q cyber technologies. The company claimed that they sell its spyware only government and law enforcement agencies for tracking criminals and terrorists, but it alleged that their technology also used to target the individual users around the world Oct 2019, Facebook  filed a lawsuit  against the NSO group in the U.S district count in northern direct of California for hacking its WhatsApp messenger by exploiting the zero-day vulnerability using Pegasus to steal the WhatsApp users data. Now, the Defendant of this case, NSO group or Q cyber technologies CEO and the major shareholder of the company  Shalev Hulio  declared that two Facebook representatives approached to NSO group t...

Cybersecurity researchers have discovered a new emerging IoT botnet threat that leverages compromised smart devices to stage ' distributed denial-of-service ' attacks, potentially triggered on-demand through platforms offering DDoS-for-hire services. The botnet, named "dark_nexus" by Bitdefender researchers, works by employing credential stuffing attacks against a variety of devices, such as routers (from Dasan Zhone, Dlink, and ASUS), video recorders, and thermal cameras, to co-opt them into the botnet. So far, dark_nexus comprises at least 1,372 bots, acting as a reverse proxy, spanning across various locations in China, South Korea, Thailand, Brazil, and Russia. "While it might share some features with previously known IoT botnets, the way some of its modules have been developed makes it significantly more potent and robust," the  researchers said . "For example, payloads are compiled for 12 different CPU architectures and dynamically delivered ...

By just making the users visiting a link, an attacker can hack the users’ iOS/macOS Camera using zero-day bugs in Safari. With iOS and macOS camera security model every app needs to assigned permission manually but Apple’s own app such as  Safari  gets access by default. Security researcher Ryan Pickren  discovered  seven new vulnerabilities with Safari browser that allows attackers to access your device’s camera, microphone, or location, and in some cases, saved passwords as well. Pickren said that Safari not using the method of the origin to keep track of the open website, “I deduced that Safari was likely running a Generic URI Syntax parser against all open windows to get the URIs’ hostnames, then doing some extra parsing on those.” Exploiting Bugs to Access Camera He started exploiting using javascript: data: and about, but that fails, but while parsing file: which specified for remote or FTP purpose( file://host.example.com/Share/path/to/file.txt ...

Researchers uncovered a new wave of an APT campaign that target the Indian financial institutions with the powerful Crimson RAT to compromise the network devices and exfiltrate the sensitive data. Crimson RAT was initially observed in 2016 that targeted the Indian diplomatic and military resources on behalf of APT attack, since then threat actors are continuously targeting the financial, healthcare, and space technology sectors. The recently observed campaign has specifically targeted the Indian Financial institutions with  spear-phishing  emails. Crimson RAT Infection Process  A Phishing email campaign contains a malicious attachment and the email send to a targeted organization in two different ways. A first method malformed Email campaign hit the target with a malicious link that pointed to PE (executable) file that contains two ZIP files with an embedded document. Once the payload executed by the victim, it automatically checks the OS version of the ...

Cybersecurity researchers today uncovered an ongoing new Magecart skimmer campaign that so far has successfully compromised at least 19 different e-commerce websites to steal payment card details of their customers. According to a  report  published today and shared with The Hacker News, RiskIQ researchers spotted a new digital skimmer, dubbed " MakeFrame ," that injects HTML iframes into web-pages to phish payment data. MakeFrame attacks have been attributed to Magecart Group 7 for its approach of using the compromised sites to host the skimming code, load the skimmer on other compromised websites, and siphoned off the stolen data. Magecart attacks usually involve bad actors compromising a company's online store to siphon credit card numbers and account details of users who're making purchases on the infected site by placing malicious JavaScript skimmers on payment forms. It's the latest in a series of attacks by Magecart, an umbrella term for eight differen...