New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency

New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency,

Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency.
« Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring 
browsing history, taking screenshots,

,

Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency.
« Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a broad spectrum of malicious activities, including monitoring 
browsing history, taking screenshots,

, ,
https://thehackernews.com/2023/04/new-rilide-malware-targeting-chromium.html

Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks

Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks,

The threat actor known as Arid Viper has been observed using refreshed variants of its malware toolkit in its attacks targeting Palestinian entities since September 2022.
Symantec, which is tracking the group under its insect-themed moniker Mantis, said the adversary is « going to great lengths to maintain a persistent presence on targeted networks. »
Also known by the names APT-C-23 and Desert

,

The threat actor known as Arid Viper has been observed using refreshed variants of its malware toolkit in its attacks targeting Palestinian entities since September 2022.
Symantec, which is tracking the group under its insect-themed moniker Mantis, said the adversary is « going to great lengths to maintain a persistent presence on targeted networks. »
Also known by the names APT-C-23 and Desert

, ,
https://thehackernews.com/2023/04/arid-viper-hacking-group-using-upgraded.html

Think Before You Share the Link: SaaS in the Real World

Think Before You Share the Link: SaaS in the Real World,

Collaboration sits at the essence of SaaS applications. The word, or some form of it, appears in the top two headlines on Google Workspace’s homepage. It can be found six times on Microsoft 365’s homepage, three times on Box, and once on Workday. Visit nearly any SaaS site, and odds are ‘collaboration’ will appear as part of the app’s key selling point. 
By sitting on the cloud, content within

,

Collaboration sits at the essence of SaaS applications. The word, or some form of it, appears in the top two headlines on Google Workspace’s homepage. It can be found six times on Microsoft 365’s homepage, three times on Box, and once on Workday. Visit nearly any SaaS site, and odds are ‘collaboration’ will appear as part of the app’s key selling point. 
By sitting on the cloud, content within

, ,
https://thehackernews.com/2023/04/think-before-you-share-link-saas-in.html

Microsoft Tightens OneNote Security by Auto-Blocking 120 Risky File Extensions

Microsoft Tightens OneNote Security by Auto-Blocking 120 Risky File Extensions,

Microsoft has announced plans to automatically block embedded files with « dangerous extensions » in OneNote following reports that the note-taking service is being increasingly abused for malware delivery.
Up until now, users were shown a dialog warning them that opening such attachments could harm their computer and data, but it was possible to dismiss the prompt and open the files.
That’s going

,

Microsoft has announced plans to automatically block embedded files with « dangerous extensions » in OneNote following reports that the note-taking service is being increasingly abused for malware delivery.
Up until now, users were shown a dialog warning them that opening such attachments could harm their computer and data, but it was possible to dismiss the prompt and open the files.
That’s going

, ,
https://thehackernews.com/2023/04/microsoft-tightens-onenote-security-by.html

Cryptocurrency Companies Targeted in Sophisticated 3CX Supply Chain Attack

Cryptocurrency Companies Targeted in Sophisticated 3CX Supply Chain Attack,

The adversary behind the supply chain attack targeting 3CX deployed a second-stage implant specifically singling out a small number of cryptocurrency companies.
Russian cybersecurity firm Kaspersky, which has been internally tracking the versatile backdoor under the name Gopuram since 2020, said it observed an increase in the number of infections in March 2023 coinciding with the 3CX breach.

,

The adversary behind the supply chain attack targeting 3CX deployed a second-stage implant specifically singling out a small number of cryptocurrency companies.
Russian cybersecurity firm Kaspersky, which has been internally tracking the versatile backdoor under the name Gopuram since 2020, said it observed an increase in the number of infections in March 2023 coinciding with the 3CX breach.

, ,
https://thehackernews.com/2023/04/cryptocurrency-companies-targeted-in.html

Western Digital Hit by Network Security Breach – Critical Services Disrupted!

Western Digital Hit by Network Security Breach – Critical Services Disrupted!,

Data storage devices maker Western Digital on Monday disclosed a « network security incident » that involved unauthorized access to its systems.
The breach is said to have occurred on March 26, 2023, enabling an unnamed third party to gain access to a « number of the company’s systems. »
Following the discovery of the hack, Western Digital said it has initiated incident response efforts and enlisted

,

Data storage devices maker Western Digital on Monday disclosed a « network security incident » that involved unauthorized access to its systems.
The breach is said to have occurred on March 26, 2023, enabling an unnamed third party to gain access to a « number of the company’s systems. »
Following the discovery of the hack, Western Digital said it has initiated incident response efforts and enlisted

, ,
https://thehackernews.com/2023/04/western-digital-hit-by-network-security.html

Italian Watchdog Bans OpenAI’s ChatGPT Over Data Protection Concerns

Italian Watchdog Bans OpenAI’s ChatGPT Over Data Protection Concerns

,

The Italian data protection watchdog, Garante per la Protezione dei Dati Personali (aka Garante), has imposed a temporary ban of OpenAI’s ChatGPT service in the country, citing data protection concerns.
To that end, it has ordered the company to stop processing users’ data with immediate effect, stating it intends to investigate the company over whether it’s unlawfully processing such data in

,

The Italian data protection watchdog, Garante per la Protezione dei Dati Personali (aka Garante), has imposed a temporary ban of OpenAI’s ChatGPT service in the country, citing data protection concerns.
To that end, it has ordered the company to stop processing users’ data with immediate effect, stating it intends to investigate the company over whether it’s unlawfully processing such data in

, ,
https://thehackernews.com/2023/04/italian-watchdog-bans-openais-chatgpt.html

« It’s The Service Accounts, Stupid »: Why Do PAM Deployments Take (almost) Forever To Complete

« It’s The Service Accounts, Stupid »: Why Do PAM Deployments Take (almost) Forever To Complete

,

Privileged Access Management (PAM) solutions are regarded as the common practice to prevent identity threats to administrative accounts. In theory, the PAM concept makes absolute sense: place admin credentials in a vault, rotate their passwords, and closely monitor their sessions. However, the harsh reality is that the vast majority of PAM projects either become a years-long project, or even

,

Privileged Access Management (PAM) solutions are regarded as the common practice to prevent identity threats to administrative accounts. In theory, the PAM concept makes absolute sense: place admin credentials in a vault, rotate their passwords, and closely monitor their sessions. However, the harsh reality is that the vast majority of PAM projects either become a years-long project, or even

, ,
https://thehackernews.com/2023/04/its-service-accounts-stupid-why-do-pam.html

Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service

Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service,

A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign.
« OpcJacker’s main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and replacing cryptocurrency addresses in the clipboard for hijacking purposes, » Trend Micro researchers

,

A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign.
« OpcJacker’s main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and replacing cryptocurrency addresses in the clipboard for hijacking purposes, » Trend Micro researchers

, ,
https://thehackernews.com/2023/04/crypto-stealing-opcjacker-malware.html

Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps

Microsoft Fixes New Azure AD Vulnerability Impacting Bing Search and Major Apps,

Microsoft has patched a misconfiguration issue impacting the Azure Active Directory (AAD) identity and access management service that exposed several « high-impact » applications to unauthorized access.
« One of these apps is a content management system (CMS) that powers Bing.com and allowed us to not only modify search results, but also launch high-impact XSS attacks on Bing users, » cloud security

,

Microsoft has patched a misconfiguration issue impacting the Azure Active Directory (AAD) identity and access management service that exposed several « high-impact » applications to unauthorized access.
« One of these apps is a content management system (CMS) that powers Bing.com and allowed us to not only modify search results, but also launch high-impact XSS attacks on Bing users, » cloud security

, ,
https://thehackernews.com/2023/04/microsoft-fixes-new-azure-ad.html