Cybercrime & Fraud
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The Hacker News reports: The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file. The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps
Ransomware & Extortion
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
KrebsOnSecurity reports: U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation firms who maintained unusually close relations with the extortion group, KrebsOnSecurity has learned. Sources close to the investigation say one of the executives in the United States even helped ShinyHunters op…
Vulnerabilities & remediation
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor
The Hacker News reports: Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public. According to a researcher who goes by the online alias boredhackerblog, the exploitation activity involves chaining four different vulnerabilities, collectively called Plex2Shell. The vulnerabilities
Security Operations
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor
The Hacker News reports: Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the
Security Operations
Security Leaders Discuss BAE Cyberattack
Security Magazine reports: BAE Systems was hit with a cyberattack that halted production/distribution of bankruptcy notices.
AI & Security
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software
The Hacker News reports: In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately, Email-to-Case and Web-to-Case turn inbound customer messages into case records; it is how airlines and hotels run support intake. Both are standard, documented, as-designed features. Chained together,
AI & Security
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
The Hacker News reports: A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tools delivered information-stealing malware and backdoors for macOS and Windows machines," Elastic
Security Operations
Healthcare Workers Claim Authentication Errors Delay Patient Care
Security Magazine reports: According to a report from Imprivata, problems with authentication are delaying patient care within healthcare organizations.