Watering-Holes Target Asian Ethnic Victims with Flash Update Decoy
About 10 compromised websites employ a multi-stage, targeted effort to fingerprint and compromise victims.
Zoom Scrutinized As Security Woes Mount
The New York Attorney General has inquired about Zoom's data security strategy, as the conferencing platform comes under heavy scrutiny for its privacy policies.
8-Year-Old VelvetSweatshop Bug Resurrected in LimeRAT Campaign
An old RAT learns an old trick.
Millions of Guests Impacted in Marriott Data Breach, Again
The second breach in less than 24 months stemmed from employee account compromises.
Covid-19 Poll Results: One in Four Prioritize Health Over Privacy
An informal Threatpost reader poll shows the majority of site visitors are privacy absolutists. But attitudes shift when the trade off is saving lives.
Nation-State Attacks Drop in Latest Google Analysis
Phishing and zero-days continue to be a core part of the APT arsenal.
Zoom Kills iOS App’s Data-Sharing Facebook Feature
Zoom removed its Facebook SDK for iOS feature after a report found the app sending Facebook "unnecessary" user data.
Zeus Sphinx Banking Trojan Arises Amid COVID-19
The malware is back after three years, looking to cash in on interest in government relief efforts around coronavirus.
Apple Unpatched VPN Bypass Bug Impacts iOS 13, Warn Researchers
The vulnerability can be exploited to reveal limited traffic data including a device’s IP address.
Critical CODESYS Bug Allows Remote Code Execution
CVE-2020-10245, a heap-based buffer overflow that rates 10 out of 10 in severity, exists in the CODESYS web server and takes little skill to exploit.
Tupperware Cyberattack Stores Away Customer Payment Cards
The food container company's main website had a card skimmer that scooped up online customers' payment card data.
Emerging APT Mounts Mass iPhone Surveillance Campaign
The malware, the work of a new APT called TwoSail Junk, allows deep surveillance and total control over iOS devices.
As Zoom Booms Incidents of ‘ZoomBombing’ Become a Growing Nuisance
Numerous instances of online conferences being disrupted by pornographic images, hate speech or even threats can be mitigated using some platform tools.
Hackers Hijack Routers to Spread Malware Via Coronavirus Apps
The router DNS hijacking attacks have targeted more than a thousand victims with the Oski info-stealing malware.
Responding to the New Normal: How to Prevent Added Risk in Your Business
With more employees than ever working remotely, there are numerous potential threats that organizations must be aware of.
Tokyo Olympics Postponed, But 5G Security Lessons Shine
Threatpost Senior Editor Tara Seals is joined by Russ Mohr, engineer and Apple evangelist at MobileIron along with Jerry Ray, COO at SecureAge, for a discussion about the now postponed Tokyo Games and its use of 5G and the...
Apple Update Fixes WebKit Flaws in iOS, Safari
Apple's security update included a slew of vulnerabilities in various components of iOS, macOS and Safari - the most severe of which could enable remote code execution.
Chinese Hackers Exploit Cisco, Citrix Flaws in Massive Espionage Campaign
Researchers say that APT41's exploits are part of one of the broadest espionage campaigns they've seen from a Chinese-linked actor "in recent years."
GE Employees Lit Up with Sensitive Doc Breach
Marriage, divorce and death certificates, beneficiary info, passports and more were all caught up in an email takeover hack.
TrickBot App Bypasses Non-SMS Banking 2FA
TrickBot victims are being fooled into downloading an app that records their screens - stealing non-SMS 2FA passcodes for banking websites.
Palantir, The $20 Billion, Peter Thiel-Backed Big Data Giant, Is Providing A Coronavirus Monitoring Tool To The CDC
Palantir will help the Centers for Disease Control keep on top of ventilator and mask needs to treat coronavirus victims, sources say.
Defense Evasion Dominated 2019 Attack Tactics
Researchers mapped tactics and techniques to the MITRE ATT&CK framework to determine which were most popular last year.
Watering-Holes Target Asian Ethnic Victims with Flash Update Decoy
About 10 compromised websites employ a multi-stage, targeted effort to fingerprint and compromise victims.
OpenWRT is vulnerable to attacks that execute malicious code
Enlarge (credit: OpenWRT)
For almost three years, OpenWRT—the open source operating system that powers home routers and other types of embedded systems—has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital...
Privacy in critical care after telehealth demands jump
As coughs and body aches drive anxious Americans to telemed services in record numbers, relieving the burden on medical facilities stressed to breaking with COVID-19 cases, the subsequent relaxation of privacy requirements puts them at risk of PHI compromises,...
