Tag: security
WordPress users beware – GootLoader strikes again, using font hack to spread malware
Gootloader malware resurfaced in late October 2025 after a nine-month hiatus, used to stage ransomware attacks Delivered via malicious JavaScript hidden in custom web fonts, enabling stealthy remote access and reconnaissance Linked to Storm-0494 and Vice Society; attackers reached domain controllers in under an hour in some cases After a…
Read More
Hackers hijacked antivirus features to install malware – here’s what we know
CVE-2025-12480 in Triofox allowed zero-day exploitation via improper access control UNC6485 attackers deployed Zoho Assist, AnyDesk, and SSH tunneling for remote access Patch released July 26; newer Triofox version available October 14 for mitigation Popular remote file sharing and collaboration platform Triofox carried a critical vulnerability that was exploited as…
Read More
North Korean hackers hijack Google’s Find Hub to find and wipe target devices
KONNI hackers use KakaoTalk to deliver malware and harvest account credentials from victims Attackers exploit Google Find Hub to remotely wipe Android devices and evade detection Compromised PCs spread malware to contacts while mobile devices are repeatedly factory reset North Korean threat actors with ties to the government were seen…
Read More
Lost your iPhone? Make sure you don’t make things worse by falling for this evil phishing text giving you hope
Scammers prey on hope, turning lost iPhones into gateways for identity theft A fake Apple message is all it takes to lose everything Cybercriminals exploit desperation, sending convincing “found phone” texts that steal data Losing an iPhone is stressful enough, but cybercriminals have found ways to make the experience even…
Read More
Whisper it – Microsoft uncovers sneaky new attack targeting top LLMs to gain access to encrypted traffic
Microsoft finds Whisper Leak shows privacy flaws inside encrypted AI systems Encrypted AI chats may still leak clues about what users discuss Attackers can track conversation topics using packet size and timing Microsoft has revealed a new type of cyberattack it has called “Whisper Leak”, which is able to expose…
Read More
An incredibly popular JavaScript library might have some worrying malware issues
CVE-2025-12735 in expr-eval allows remote code execution via unsafe input evaluation Vulnerable versions ≤2.0.2; patched in 2.0.3 and forked in expr-eval-fork 3.0.0 Developers should sanitize variables and avoid untrusted input in evaluate() calls A widely-adopted JavaScript library has been found carrying a critical vulnerability which could allow threat actors to…
Read More