Secure Bulletin - Navigating the cyber sea with knowledge (@securebulletin.com.web.brid.gy) Bsky

A Silent Killer Sneaking into Your Code: New Campaign Targets VS Code Developers From seemingly innocuous extensions to stealthy trojans, the threat landscape for developers is evolving. While the world continues to grapple with the ever-shifting tide of cybersecurity threats, a particularly insidious attack has taken root within the development community. A coordinated campaign targeting VS Code users through its Marketplace reveals the growing sophistication of malicious actors […]

4 months ago 0 0 0 0

GitLab Releases Critical Security Patch for Multiple High-Severity Vulnerabilities Security researchers have uncovered vulnerabilities in GitLab’s Community Edition and Enterprise Edition platforms, prompting the company to release critical security patches. On December 10th, 2025, Gitlab released update versions (18.6.2, 18.5.4, and 18.4.6) addressing ten significant vulnerabilities across both their Community and Enterprise editions. These vulnerabilities pose a serious threat to users, prompting immediate action […]

4 months ago 0 0 0 0

VSCode: A New Wave of Malware Exploits the Heart of Creative Workflows The lines between personal work and corporate security are increasingly blurring, especially for developers. With tools like Visual Studio Code (VS Code) becoming integral to both individual projects and team collaboration, an opportunistic threat actor is capitalizing on this ecosystem’s unique vulnerabilities in a novel attack campaign. While traditional malware aims for the obvious – […]

4 months ago 0 0 0 0

A Sneaky New Threat: Microsoft Teams Calls and QuickAssist Lead to Stealthy Malware Attacks From phishing calls to fileless malware, the evolution of cyberattacks is alarmingly rapid. The latest threat employs a sophisticated blend of social engineering and technical prowess to bypass traditional security measures. This new attack chain leverages familiar platforms like Microsoft Teams for communication and QuickAssist for remote support, creating a perfect storm for malicious operations. […]

4 months ago 0 0 0 0

The Kitten Project: A New Era of Coordinated Hacktivism The cyber-world has always been a stage for activism and protest, but the rise of hacktivism offers something different – a blend of technical expertise and political expression. One such project that exemplifies this trend is “The Kitten Project,” an initiative operating at the intersection of activism and technical operations. This platform, accessible at kitten.group, […]

4 months ago 0 0 0 0

A Sophisticated New Threat: FvncBot Strikes Again A dangerous new banking malware called FvncBot is targeting unsuspecting users of Android devices, leveraging sophisticated techniques to steal sensitive financial information. First observed in late November 2025, this attack highlights the ever-evolving landscape of cyber threats and underscores the need for vigilance. FvncBot’s modus operandi revolves around a deceptive tactic known as “app injection.” […]

4 months ago 0 0 0 0

The Sophisticated ClickFix Sting: How Calisto Disguises Itself to Steal Credentials Calisto, a cyberespionage campaign attributed to the Russian FSB’s Center 18 for Information Security (military unit 64829), has been making waves in the cybersecurity community. This group has established itself as a persistent threat against Western institutions with their sophisticated phishing operations and intricate use of social engineering tactics, specifically targeting NATO research entities and […]

4 months ago 0 0 0 0

ClayRat: A New Breed of Android Spyware with Unprecedented Control A closer look at the sophisticated threat and its tactics. The mobile device landscape is under a constant barrage of new threats, with cybercriminals becoming increasingly adept at exploiting vulnerabilities in our everyday technology. One recently emerged player, ClayRat, represents a significant escalation in this regard, offering an unsettling glimpse into the potential for near-total […]

4 months ago 0 0 0 0

Cloudflare Dashboard Goes Down Again Cloudflare, a well-known player in the world of web security and delivery, is currently facing a significant service outage. This disruption has been affecting users relying on the company’s dashboard for website management and automation. While not entirely unexpected in the high-pressure world of tech infrastructure, this specific outage raises several critical questions about the […]

4 months ago 0 0 0 0

Evilginx: A Sophisticated Phishing Toolkit Undermining MFA Advanced phishing tactics utilizing a sophisticated tool known as Evilginx are becoming increasingly common, raising serious concerns for security professionals and users alike. This attack vector has seen a surge in recent months, particularly impacting educational institutions, which are now vulnerable targets. Evilginx leverages its ability to impersonate legitimate websites, manipulating unsuspecting users into divulging […]

4 months ago 0 0 0 0

A Critical Patch for Vulnerable Next.js: New Scanner Unveils Hidden Attacks With the rise of Serverless functions, static site generators like Next.js have become ubiquitous in web development, streamlining functionality and boosting speed. However, while these frameworks offer undeniable advantages, they also expose potential vulnerabilities like CVE-2025-55182, a critical flaw impacting React Server Components (RSC). Traditional approaches to detecting this vulnerability often fall short, forcing security […]

4 months ago 0 0 0 0

A Silent Vulnerability Exposed: How Hackers Used Hidden Commands to Steal Sensitive Data Microsoft’s seemingly “unremarkable” November 2025 Patch Tuesday update actually contained a major security fix. But even the most meticulous patching process can sometimes be outmaneuvered by cunning threat actors, as demonstrated by a hidden vulnerability that has been exploited for years. Let’s delve into the details of this overlooked attack and its implications for cybersecurity […] The post A Silent Vulnerability Exposed: How Hackers Used Hidden Commands to Steal Sensitive Data first appeared on Secure Bulletin.

4 months ago 0 0 0 0

K.G.B. RAT Strikes Again: A Case Study in Undetectable Malware Distribution The underground cybercriminal ecosystem has witnessed a worrisome development – the rise of a highly sophisticated remote access trojan (RAT) known as K.G.B. RAT. This weaponized software, now readily available on forums frequented by threat actors, poses a significant risk to organizations across various sectors. The K.G.B. RAT package is more than just a standard […] The post K.G.B. RAT Strikes Again: A Case Study in Undetectable Malware Distribution first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Chrome 143: A Patch Day For Deep Dive Cybersecurity Professionals Google has just released Chrome 143, ushering in a new era of browser security with 13 addressed vulnerabilities. This release is no mere formality – it’s a critical step for cybersecurity professionals who crave deep dives into the nitty-gritty of web browsing. Let’s break down why this update matters and delve into the technical details. […] The post Chrome 143: A Patch Day For Deep Dive Cybersecurity Professionals first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Arkanix: A Sneaky New Malware Stealing from Homes and Small Offices New malware is emerging with a distinct focus on stealing sensitive information from home users and small businesses: the Arkanix stealer. This advanced tool leverages common vulnerabilities to infiltrate networks, gain access to user data, and potentially compromise entire systems. Arkanix primarily targets VPN clients and wireless network configurations, leveraging the trust built by regular […] The post Arkanix: A Sneaky New Malware Stealing from Homes and Small Offices first appeared on Secure Bulletin.

4 months ago 0 0 0 0

ShadyPanda’s Seven-Year Heist: How a Simple Extension Became a Mass Spy Tool A sophisticated threat group, dubbed ShadyPanda, has quietly exploited millions of users across the world by weaponizing popular Chrome and Edge extensions. This stealthy campaign, spanning seven years and leveraging seemingly legitimate apps, highlights a concerning trend in cyberattacks: infiltrating trusted systems under the guise of common software. ShadyPanda’s strategy involved meticulous planning and execution. […] The post ShadyPanda’s Seven-Year Heist: How a Simple Extension Became a Mass Spy Tool first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Android’s December Patch: Zero-Day Vulnerabilities and Their Impact The latest security bulletin from Google has brought forth a grim reality for Android users: multiple zero-day vulnerabilities are actively exploited by threat actors, demanding immediate attention. This update unveils the gravity of these threats, highlighting their potential to wreak havoc on our devices and data. A Symphony of Threats: The December 2025 security bulletin […] The post Android’s December Patch: Zero-Day Vulnerabilities and Their Impact first appeared on Secure Bulletin.

4 months ago 0 0 0 0

A Critical Design Flaws in Microsoft Azure API Management Threatens Organizations Microsoft’s Azure API Management (APIM) Developer Portal, a platform commonly used for managing and securing APIs, is vulnerable to a significant security flaw that enables attackers to bypass access controls and create unauthorized accounts across different tenants. This issue stems from a fundamental design flaw where disabling signup within the Azure Portal UI only visually […] The post A Critical Design Flaws in Microsoft Azure API Management Threatens Organizations first appeared on Secure Bulletin.

4 months ago 1 0 0 0

Pakistan-based APT36 Leverages Python and Linux for Sophisticated Indian Government Espionage A new wave of cyberespionage has emerged, targeting the critical infrastructure of Indian government institutions. This time, it’s not your average phishing attack – the threat is more sophisticated, employing advanced techniques that challenge even seasoned security professionals. Our analysis reveals a significant escalation by Pakistan-based APT36, commonly known as “Transparent Tribe”, who have adapted […] The post Pakistan-based APT36 Leverages Python and Linux for Sophisticated Indian Government Espionage first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Handala Targeting Israel’s Tech & Aerospace with Doxing and Financial Incentives A recent shift in the geopolitically motivated cyber landscape has raised serious concerns as the Handala hacker group launches a targeted campaign against Israeli high-tech and aerospace professionals. This attack goes beyond traditional propaganda and lays bare the growing threat of doxxing and intelligence gathering, posing significant dangers to private sector employees. Handala’s action centers […] The post Handala Targeting Israel’s Tech & Aerospace with Doxing and Financial Incentives first appeared on Secure Bulletin.

4 months ago 0 0 0 0

A Polish Arrest Uncovers the Real Face of Cybercrime Recent developments in Poland have highlighted a disturbing trend – the rise of sophisticated cyberattacks targeting businesses across Europe, with seemingly motivated individuals serving as fronts for broader organized crime networks. On November 16, 2025, Polish authorities made a significant arrest that reveals not only the scale of this threat but also offers crucial insight […] The post A Polish Arrest Uncovers the Real Face of Cybercrime first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Battlefield 6’s Rise Is Fueling a Surge of Malware: How Attackers are Capitalizing on the Hype Since its release this October, “Battlefield 6” has ignited gaming communities, with millions eagerly jumping into the action-packed experience. However, alongside the excitement comes a darker side – cybercriminals have seized on this popularity to distribute malicious software that targets unsuspecting players and fans looking for game modifications. This isn’t a new tactic; brand impersonation […] The post Battlefield 6’s Rise Is Fueling a Surge of Malware: How Attackers are Capitalizing on the Hype first appeared on Secure Bulletin.

4 months ago 0 0 0 0

OpenAI API Users: Mixpanel Data Leak Exposes Personal Information OpenAI, the renowned developer of AI models like ChatGPT, has recently acknowledged a data breach involving its third-party analytics provider, Mixpanel. This incident exposed sensitive user information for API users primarily accessing OpenAI’s platform, platform.openai.com. While this attack didn’t compromise core system functionality or chat content, it highlights the potential vulnerabilities of relying on external […] The post OpenAI API Users: Mixpanel Data Leak Exposes Personal Information first appeared on Secure Bulletin.

4 months ago 0 0 0 0

The FBI’s Latest Warning: Phishing Scams Target the IC3 The internet is a constant battleground, and today’s cybercriminal tactics are more intricate and insidious than ever before. Recently, the Federal Bureau of Investigation (FBI) issued urgent warnings about a particularly cunning phishing scam designed to steal sensitive personal information from unsuspecting victims. This time, the threat is aimed at the official Internet Crime Complaint […] The post The FBI’s Latest Warning: Phishing Scams Target the IC3 first appeared on Secure Bulletin.

4 months ago 0 0 0 0

HashJack: weaponizing trust in AI browser assistants A vulnerability in the way AI browser assistants handle URL fragments opens doors for malicious attacks. For years, we’ve seen AI take center stage across various industries, revolutionizing everything from customer service to medical diagnostics. Now, these systems are finding their way into our web browsing experiences, thanks to the integration of intelligent browsers within […] The post HashJack: weaponizing trust in AI browser assistants first appeared on Secure Bulletin.

4 months ago 0 0 0 0

A Critical Security Flaws in HashiCorp’s Provider HashiCorp’s Vault Terraform provider, a cornerstone of secure secrets management for organizations worldwide, has been found with a critical security flaw. This vulnerability, tracked as CVE-2025-13357, affects users implementing LDAP authentication within the provider. The root cause lies in an incorrect default configuration; the deny_null_bind parameter was set to false by default for this authentication […] The post A Critical Security Flaws in HashiCorp’s Provider first appeared on Secure Bulletin.

4 months ago 0 0 0 0

ClickFix: Fake Windows Updates and PNG Steganography Make a Darker Play for User Machines For those deeply involved with cybersecurity, the past few years have seen a dramatic rise in sophisticated phishing campaigns leveraging social engineering to deliver malware onto unsuspecting victims. One such method, often dubbed “ClickFix,” has taken a new turn, becoming more alarmingly intricate and effective than ever before. This time, the attackers are exploiting user […] The post ClickFix: Fake Windows Updates and PNG Steganography Make a Darker Play for User Machines first appeared on Secure Bulletin.

4 months ago 0 0 0 0

How Hackers are using Open-Source repositories to steal crypto A new wave of malware targeting cryptocurrency users is hitting developers hard, showcasing the growing sophistication and accessibility of attacks in 2023. The root cause? A well-executed supply chain attack leveraging a seemingly innocent open-source package from PyPI (Python Package Index). This isn’t just a technical vulnerability; it’s a symptom of an evolving threat landscape […] The post How Hackers are using Open-Source repositories to steal crypto first appeared on Secure Bulletin.

4 months ago 0 0 0 0

ToddyCat’s new tricks: email hacking evolves with the cloud The age-old adage “if it ain’t broke, don’t fix it” doesn’t always hold true in cybersecurity. As attackers are increasingly leveraging cloud services to protect sensitive data, their methods are evolving too – and with them, the level of sophistication and audacity of attacks rises considerably. One such group that has been pushing boundaries is […] The post ToddyCat’s new tricks: email hacking evolves with the cloud first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Wireshark 4.6.1: critical security update addresses major vulnerabilities A recent update from the Wireshark Foundation addresses critical vulnerabilities impacting the widely used network protocol analyzer, potentially exposing users to denial-of-service conditions. The vulnerability lies within the core parsing of specific network protocols using dissectors like BPv7 and Kafka. These dissectors, crucial for accurately analyzing network traffic, have been found vulnerable to manipulation by […] The post Wireshark 4.6.1: critical security update addresses major vulnerabilities first appeared on Secure Bulletin.

4 months ago 0 0 0 0

Posts by Secure Bulletin - Navigating the cyber sea with knowledge