Google Uncovers Tool Used by Iranian Hackers to Steal Data from Email Accounts

Google Uncovers Tool Used by Iranian Hackers to Steal Data from Email Accounts,

The Iranian government-backed actor known as Charming Kitten has added a new tool to its malware arsenal that allows it to retrieve user data from Gmail, Yahoo!, and Microsoft Outlook accounts.
Dubbed HYPERSCRAPE by Google Threat Analysis Group (TAG), the actively in-development malicious software is said to have been used against less than two dozen accounts in Iran, with the oldest known

,

The Iranian government-backed actor known as Charming Kitten has added a new tool to its malware arsenal that allows it to retrieve user data from Gmail, Yahoo!, and Microsoft Outlook accounts.
Dubbed HYPERSCRAPE by Google Threat Analysis Group (TAG), the actively in-development malicious software is said to have been used against less than two dozen accounts in Iran, with the oldest known

, ,
https://thehackernews.com/2022/08/google-uncovers-tool-used-by-iranian.html

XCSSET Malware Updates with Python 3 to Target macOS Monterey Users

XCSSET Malware Updates with Python 3 to Target macOS Monterey Users,

The operators of the XCSSET macOS malware have upped the stakes by making iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3.
« The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022, » SentinelOne researchers

,

The operators of the XCSSET macOS malware have upped the stakes by making iterative improvements that add support for macOS Monterey by upgrading its source code components to Python 3.
« The malware authors have changed from hiding the primary executable in a fake Xcode.app in the initial versions in 2020 to a fake Mail.app in 2021 and now to a fake Notes.app in 2022, » SentinelOne researchers

, ,
https://thehackernews.com/2022/08/xcsset-malware-updates-with-python-3-to.html

The Rise of Data Exfiltration and Why It Is a Greater Risk Than Ransomware

The Rise of Data Exfiltration and Why It Is a Greater Risk Than Ransomware,

Ransomware is the de facto threat organizations have faced over the past few years. Threat actors were making easy money by exploiting the high valuation of cryptocurrencies and their victims’ lack of adequate preparation. 
Think about bad security policies, untested backups, patch management practices not up-to-par, and so forth. It resulted in easy growth for ransomware extortion, a crime that

,

Ransomware is the de facto threat organizations have faced over the past few years. Threat actors were making easy money by exploiting the high valuation of cryptocurrencies and their victims’ lack of adequate preparation. 
Think about bad security policies, untested backups, patch management practices not up-to-par, and so forth. It resulted in easy growth for ransomware extortion, a crime that

, ,
https://thehackernews.com/2022/08/the-rise-of-data-exfiltration-and-why.html

Suspected Iranian Hackers Targeted Several Israeli Organizations for Espionage

Suspected Iranian Hackers Targeted Several Israeli Organizations for Espionage,

A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations as part of an espionage-focused campaign that commenced in late 2020.
Cybersecurity firm Mandiant is tracking the group under its uncategorized moniker UNC3890, which is believed to conduct operations that align with Iranian interests.
« The collected

,

A suspected Iranian threat activity cluster has been linked to attacks aimed at Israeli shipping, government, energy, and healthcare organizations as part of an espionage-focused campaign that commenced in late 2020.
Cybersecurity firm Mandiant is tracking the group under its uncategorized moniker UNC3890, which is believed to conduct operations that align with Iranian interests.
« The collected

, ,
https://thehackernews.com/2022/08/suspected-iranian-hackers-targeted.html

New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data

New Air-Gap Attack Uses MEMS Gyroscope Ultrasonic Covert Channel to Leak Data,

A novel data exfiltration technique has been found to leverage a covert ultrasonic channel to leak sensitive information from isolated, air-gapped computers to a nearby smartphone that doesn’t even require a microphone to pick up the sound waves.
Dubbed GAIROSCOPE, the adversarial model is the latest addition to a long list of acoustic, electromagnetic, optical, and thermal approaches devised by

,

A novel data exfiltration technique has been found to leverage a covert ultrasonic channel to leak sensitive information from isolated, air-gapped computers to a nearby smartphone that doesn’t even require a microphone to pick up the sound waves.
Dubbed GAIROSCOPE, the adversarial model is the latest addition to a long list of acoustic, electromagnetic, optical, and thermal approaches devised by

, ,
https://thehackernews.com/2022/08/new-air-gap-attack-uses-mems-gyroscope.html

CISA Warns of Active Exploitation of Palo Alto Networks’ PAN-OS Vulnerability

CISA Warns of Active Exploitation of Palo Alto Networks’ PAN-OS Vulnerability

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
The high-severity vulnerability, tracked as CVE-2022-0028 (CVSS score: 8.6), is a URL filtering policy misconfiguration that could allow an unauthenticated, remote attacker to

,

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a security flaw impacting Palo Alto Networks PAN-OS to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.
The high-severity vulnerability, tracked as CVE-2022-0028 (CVSS score: 8.6), is a URL filtering policy misconfiguration that could allow an unauthenticated, remote attacker to

, ,
https://thehackernews.com/2022/08/cisa-warns-of-active-exploitation-of.html

Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts

Researchers Find Counterfeit Phones with Backdoor to Hack WhatsApp Accounts,

Budget Android device models that are counterfeit versions associated with popular smartphone brands are harboring multiple trojans designed to target WhatsApp and WhatsApp Business messaging apps.
The trojans, which Doctor Web first came across in July 2022, were discovered in the system partition of at least four different smartphones: P48pro, radmi note 8, Note30u, and Mate40, was
« These

,

Budget Android device models that are counterfeit versions associated with popular smartphone brands are harboring multiple trojans designed to target WhatsApp and WhatsApp Business messaging apps.
The trojans, which Doctor Web first came across in July 2022, were discovered in the system partition of at least four different smartphones: P48pro, radmi note 8, Note30u, and Mate40, was
« These

, ,
https://thehackernews.com/2022/08/researchers-find-counterfeit-phones.html

« As Nasty as Dirty Pipe » — 8 Year Old Linux Kernel Vulnerability Uncovered

« As Nasty as Dirty Pipe » — 8 Year Old Linux Kernel Vulnerability Uncovered

,

Details of an eight-year-old security vulnerability in the Linux kernel have emerged that the researchers say is « as nasty as Dirty Pipe. »
Dubbed DirtyCred by a group of academics from Northwestern University, the security weakness exploits a previously unknown flaw (CVE-2022-2588) to escalate privileges to the maximum level.
« DirtyCred is a kernel exploitation concept that swaps unprivileged 

,

Details of an eight-year-old security vulnerability in the Linux kernel have emerged that the researchers say is « as nasty as Dirty Pipe. »
Dubbed DirtyCred by a group of academics from Northwestern University, the security weakness exploits a previously unknown flaw (CVE-2022-2588) to escalate privileges to the maximum level.
« DirtyCred is a kernel exploitation concept that swaps unprivileged 

, ,
https://thehackernews.com/2022/08/as-nasty-as-dirty-pipe-8-year-old-linux.html

Meet Borat RAT, a New Unique Triple Threat

Meet Borat RAT, a New Unique Triple Threat,

Atlanta-based cyber risk intelligence company, Cyble discovered a new Remote Access Trojan (RAT) malware. What makes this particular RAT malware distinct enough to be named after the comic creation of Sacha Baron Cohen?
RAT malware typically helps cybercriminals gain complete control of a victim’s system, permitting them to access network resources, files, and power to toggle the mouse and

,

Atlanta-based cyber risk intelligence company, Cyble discovered a new Remote Access Trojan (RAT) malware. What makes this particular RAT malware distinct enough to be named after the comic creation of Sacha Baron Cohen?
RAT malware typically helps cybercriminals gain complete control of a victim’s system, permitting them to access network resources, files, and power to toggle the mouse and

, ,
https://thehackernews.com/2022/08/meet-borat-rat-new-unique-triple-threat.html

RTLS Systems Found Vulnerable to MiTM Attacks and Location Tampering

RTLS Systems Found Vulnerable to MiTM Attacks and Location Tampering,

Researchers have disclosed multiple vulnerabilities impacting Ultra-wideband (UWB) Real-time Locating Systems (RTLS), enabling threat actors to launch adversary-in-the-middle (AitM) attacks and tamper with location data.
« The zero-days found specifically pose a security risk for workers in industrial environments, » cybersecurity firm Nozomi Networks disclosed in a technical write-up last week. « 

,

Researchers have disclosed multiple vulnerabilities impacting Ultra-wideband (UWB) Real-time Locating Systems (RTLS), enabling threat actors to launch adversary-in-the-middle (AitM) attacks and tamper with location data.
« The zero-days found specifically pose a security risk for workers in industrial environments, » cybersecurity firm Nozomi Networks disclosed in a technical write-up last week. « 

, ,
https://thehackernews.com/2022/08/rtls-systems-found-vulnerable-to-mitm.html