SecureWorld News

MARCH 17, 2025

If you ask a layperson which industries they expect to come under attack from cyberattacks, they'll probably highlight targets like banks, infrastructure, or big tech. But one of the most high-profile cyberattacks in 2024 was against Krispy Kreme. Is nothing sacred anymore, when even our doughnuts aren't safe? It might seem a bit odd to target a doughnut chain, but the incident highlights a real issue for the food and beverage industry, with implications for many others.

Cyber Attacks 112

Cyber Attacks Digital transformation Threat Detection Penetration Testing 112

Schneier on Security

MARCH 20, 2025

This is serious : A sophisticated cascading supply chain attack has compromised multiple GitHub Actions, exposing critical CI/CD secrets across tens of thousands of repositories. The attack, which originally targeted the widely used tj-actions/changed-files utility, is now believed to have originated from an earlier breach of the reviewdog/action-setup@v1 GitHub Action, according to a report. […] CISA confirmed the vulnerability has been patched in version 46.0.1.

277

277

Krebs on Security

MARCH 21, 2025

Authorities in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on a custom Android app to relay tap-to-pay transactions from mobile devices located in China.

Phishing 211

Phishing Mobile Scams Banking 211

Security Affairs

MARCH 21, 2025

Russian zero-day broker Operation Zero is looking for exploits for the popular messaging app Telegram, offering up to $4 million for them. Operation Zero, a Russian zero-day broker, is offering up to $4 million for Telegram exploits, the news was first reported by Tech Crunch. The Russian firm seeks up to $500K for one-click RCE, $1.5M for zero-click RCE, and $4M for a full-chain exploit that could allow full device compromise.

Government 144

Government Surveillance Mobile Hacking 144

Advertisement

Many cybersecurity awareness platforms offer massive content libraries, yet they fail to enhance employees’ cyber resilience. Without structured, engaging, and personalized training, employees struggle to retain and apply key cybersecurity principles. Phished.io explains why organizations should focus on interactive, scenario-based learning rather than overwhelming employees with excessive content.

Cyber threats

Adam Shostack

MARCH 20, 2025

A group of us have urged HHS to require better handling of security reports A group of us have urged HHS to require that health care providers to act on (and facilitate reporting of) security issues by good faith cybersecurity researchers. The core of what we recommend is that HHS should require cooperation with Good Faith researchers. All regulated entities should be required to enable people to report security issues in a way thats easy to discover and aligned with standards.

Software 130

Software Cybersecurity 130

Schneier on Security

MARCH 17, 2025

New paper: “ GPU Assisted Brute Force Cryptanalysis of GPRS, GSM, RFID, and TETRA: Brute Force Cryptanalysis of KASUMI, SPECK, and TEA3.” Abstract: Key lengths in symmetric cryptography are determined with respect to the brute force attacks with current technology. While nowadays at least 128-bit keys are recommended, there are many standards and real-world applications that use shorter keys.

Technology 217

Technology 217

Malwarebytes

MARCH 17, 2025

The FBI Denver Field Office has warned of an increasing number of scammy websites offering free online file converter services. Instead of converting files, the tools actually load malware onto victims computers. The FBI warned specifically about that malware leading to ransomware attacks, but we’ve also seen similar sites that install browser hijackers, adware, and potentially unwanted programs (PUPs).

Malware 141

Malware Adware Education Phishing 141

The Last Watchdog

MARCH 19, 2025

Sydney, Australia, Mar. 19, 2025, CyberNewswire — Sydney-based cybersecurity software company Knocknoc has raised a seed round from US-based venture capital firm Decibel Partners with support from CoAct and SomethingReal. The funding will support go-to-market, new staff, customer onboarding and product development. The company has appointed Adam Pointon as Chief Executive Officer.

Technology 130

Technology Media Telecommunications Authentication 130

Schneier on Security

MARCH 18, 2025

Really interesting research: “ How WEIRD is Usable Privacy and Security Research? ” by Ayako A. Hasegawa Daisuke Inoue, and Mitsuaki Akiyama: Abstract : In human factor fields such as human-computer interaction (HCI) and psychology, researchers have been concerned that participants mostly come from WEIRD (Western, Educated, Industrialized, Rich, and Democratic) countries.

Education 207

Education 207

Security Affairs

MARCH 18, 2025

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiOS/FortiProxyand GitHub Actionflaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog : CVE-2025-24472 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability CVE-2025-30066 tj-actions/changed-files GitHub Action Embedded Malicious Code Vulnerability In Fe

Authentication 112

Authentication Ransomware Firewall Hacking 112

Advertisement

The DHS compliance audit clock is ticking on Zero Trust. Government agencies can no longer ignore or delay their Zero Trust initiatives. During this virtual panel discussion—featuring Kelly Fuller Gordon, Founder and CEO of RisX, Chris Wild, Zero Trust subject matter expert at Zermount, Inc., and Principal of Cybersecurity Practice at Eliassen Group, Trey Gannon—you’ll gain a detailed understanding of the Federal Zero Trust mandate, its requirements, milestones, and deadlines.

Cybersecurity

Malwarebytes

MARCH 18, 2025

Amazon has announced its Echo devices will no longer have the option to store and process requests on the device itself, meaning your voice recordings will now be sent to the cloud for processing. In an email sent to customers, Amazon explained that the feature “Do Not Send Voice Recordings” will no longer be available beginning March 28, 2025.

Internet 145

Internet Internet 145

The Last Watchdog

MARCH 18, 2025

Palo Alto, Calif., Mar. 18, 2025, CyberNewswire — SquareX , a pioneer in Browser Detection and Response (BDR) space, announced the launch of the “Year of Browser Bugs” (YOBB) project today, a year-long initiative to draw attention to the lack of security research and rigor in what remains one of the most understudied attack vectors – the browser.

Cybersecurity 130

Cybersecurity Architecture Media Password Management 130

Javvad Malik

MARCH 19, 2025

I had the honour of being invited as the first guest on a new podcast hosted by the wonderful Lisa Forte , and Sarah Armstrong Smith where we got to sit down and talk about insider threats. Well, more specifically, around the story where a fake North Korean IT worker tried to get hired at KnowBe4 and how that was discovered and then we discussed some of the wider implications around that.

130

130

Security Affairs

MARCH 15, 2025

Pirated software seekers are targeted by the new MassJacker clipper malware, according to CyberArk researchers. A new malware campaign spreading a new clipper malware dubbed MassJacker targets users searching for pirated software, Cyberark users warn. A clipper malware is a type of malicious software designed to intercept and manipulate clipboard data, typically for cryptocurrency theft.

Software 115

Software Cryptocurrency Malware Encryption 115

Advertisement

Keeper Security is transforming cybersecurity for people and organizations around the world. Keeper’s affordable and easy-to-use solutions are built on a foundation of zero-trust and zero-knowledge security to protect every user on every device. Our next-generation privileged access management solution deploys in minutes and seamlessly integrates with any tech stack to prevent breaches, reduce help desk costs and ensure compliance.

Passwords

Malwarebytes

MARCH 18, 2025

We were alerted to Mac and Windows stealers currently distributed via Reddit posts targeting users engaging in cryptocurrency trading. One of the common lures is a cracked software version of the popular trading platform TradingView. The crooks are posting links to both Windows and Mac installers which have been laced with Lumma Stealer and Atomic Stealer (AMOS) respectively.

Cryptocurrency 120

Cryptocurrency Malware Scams Antivirus 120

The Last Watchdog

MARCH 19, 2025

Bengaluru, India, Mar. 19, 2025, CyberNewswire — SecPod, a global cybersecurity provider, has announced the General Availability of Saner Cloud , a Cloud-Native Application Protection Platform designed to provide automated remediation and workload security across multi-cloud environments. Unlike conventional security solutions that focus primarily on detection, Saner Cloud integrates security using AI-driven automation to remediate threats in real-time.

Cyber threats 130

Cyber threats Risk Technology Media 130

SecureWorld News

MARCH 19, 2025

In a move that shakes up the cybersecurity business landscape, Google has announced its largest acquisition to date: a $32 billion all-cash agreement to acquire Wiz, a rapidly growing cloud security startup. This deal underscores Google's increasing investment in security solutions as it looks to bolster its Google Cloud offerings and better compete in the multi-cloud security space.

Cybersecurity 109

Cybersecurity Marketing Data privacy Government 109

Security Affairs

MARCH 18, 2025

Threat actors exploit a server-side request forgery (SSRF) flaw, tracked as CVE-2024-27564, in ChatGPT, to target US financial and government organizations. Cybersecurity firm Veriti reports that threat actors are exploiting a server-side request forgery (SSRF) vulnerability, tracked as CVE-2024-27564 (CVSS score of 6.5), in ChatGPT to target financial and government organizations in the US.

Government 124

Government Healthcare Authentication Hacking 124

Advertisement

Many software teams have migrated their testing and production workloads to the cloud, yet development environments often remain tied to outdated local setups, limiting efficiency and growth. This is where Coder comes in. In our 101 Coder webinar, you’ll explore how cloud-based development environments can unlock new levels of productivity. Discover how to transition from local setups to a secure, cloud-powered ecosystem with ease.

Software

Malwarebytes

MARCH 19, 2025

With financial stress at an all-time high, and many Americans grappling with confusion about social security, Medicaid, and Medicare, people are desperately seeking relief. Scammers know this all too well and have tailored their tactics to exploit these fears, preying on vulnerable individuals with promises of “free money.” Whether it’s a so-called “subsidy program,” a “government grant,” or a “relief card,” these scams all share the same und

Scams 100

Scams Government Identity Theft Social Engineering 100

The Last Watchdog

MARCH 17, 2025

Frankfurt, Germany, Mar. 17, 2025, CyberNewswire — Cyberattacks are no longer an abstract threat – they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than doubled, and they are shorter, more targeted, and more technically sophisticated.

DDOS 130

DDOS Digital transformation Cyber threats Threat Detection 130

SecureWorld News

MARCH 20, 2025

A newly discovered Windows zero-day vulnerability is actively being exploited by nation-state threat actors, raising serious cybersecurity concerns across government, financial, and critical infrastructure sectors. The vulnerability, tracked as ZDI-CAN-25373, allows attackers to execute hidden malicious commands via specially crafted Windows shortcut (.lnk) files.

Cryptocurrency 112

Cryptocurrency Telecommunications Government Education 112

Security Affairs

MARCH 17, 2025

Threat actors exploit Cascading Style Sheets (CSS) to bypass spam filters and detection engines, and track users actions and preferences. Cisco Talos observed threat actors abusing Cascading Style Sheets (CSS) to evade detection and track user behavior, raising security and privacy concerns, including potential fingerprinting. Cascading Style Sheets (CSS) is a stylesheet language used to control the appearance and layout of web pages.

Phishing 114

Phishing Engineering Media Hacking 114

Advertisement

How many people would you trust with your house keys? Chances are, you have a handful of trusted friends and family members who have an emergency copy, but you definitely wouldn’t hand those out too freely. You have stuff that’s worth protecting—and the more people that have access to your belongings, the higher the odds that something will go missing.

Cybersecurity

Security Boulevard

MARCH 20, 2025

Amost a dozen state-sponsored threat groups from Russia, China, and North Korea have been exploiting a security flaw in WIndows in attacks on governments and critical infrastructure that date back to 2017. According to Trend Micro's VDI unit, Microsoft has no plans to patch the vulnerability. The post China, Russia, North Korea Hackers Exploit Windows Security Flaw appeared first on Security Boulevard.

Government 100

Government Social Engineering Engineering Malware 100

The Last Watchdog

MARCH 19, 2025

Austin, TX, Ma. 19, 2025, CyberNewswire — The average corporate user now has 146 stolen records linked to their identity, an average 12x increase from previous estimates, reflecting a surge in holistic identity exposures. SpyCloud , the leading identity threat protection company, today released its 2025 SpyCloud Annual Identity Exposure Report , highlighting the rise of darknet-exposed identity data as the primary cyber risk facing enterprises today.

Cyber Risk 113

Cyber Risk Risk Phishing Cybercrime 113

Malwarebytes

MARCH 19, 2025

Sperm donor giant California Cryobank has announced it has suffered a data breach that exposed customers’ personal information. California Cryobank (CCB) is a sperm donation and cryopreservation firm and one of the US top sperm banks. As such, it services all US states and over 30 countries worldwide. The data breach notification states that the breach occurred on April 20, 2024 and CCB discovered it on October 4, 2024.

Banking 96

Banking Data breaches Computers and Electronics Passwords 96

Security Affairs

MARCH 20, 2025

CERT-UA warns of a cyber campaign using Dark Crystal RAT to target Ukraine’s defense sector, including defense industry employees and Defense Forces members. The Computer Emergency Response Team of Ukraine (CERT-UA) uncovered a new cyber espionage campaign targeting employees of defense-industrial complex enterprises and representatives of the Defense Forces of Ukraine with Dark Crystal RAT.

Computers and Electronics 105

Computers and Electronics Telecommunications Malware Surveillance 105

Advertisement

After a year of sporadic hiring and uncertain investment areas, tech leaders are scrambling to figure out what’s next. This whitepaper reveals how tech leaders are hiring and investing for the future. Download today to learn more!

SecureWorld News

MARCH 20, 2025

March Madness is here, and while fans are busy filling out brackets and making last-minute bets, cybercriminals are running their own full-court presstargeting unsuspecting fans with phishing scams, fake betting apps, and credential-harvesting schemes. This annual college basketball bonanza presents a prime opportunity for scammers to capitalize on excitement, urgency, and, of course, the lure of easy money.

Scams 84

Scams Social Engineering Mobile Phishing 84

The Last Watchdog

MARCH 18, 2025

Weve seen this movie before. Alphabet, Googles parent company’s, $32 billion bid for Wiz isnt just about security and privacy. Its the latest round in Big Techs long-running game of business leapfrogwhere each giant keeps lunging into the next guys home turf, trying to reshape the battlefield in its favor. Think about it. Google tried to unseat Microsoft Office with Google Apps.

CISO 130

CISO Media Internet Internet 130

Malwarebytes

MARCH 17, 2025

This year, Spring Break vacationers are packing more than their flip-flops, bucket hats, and sunglassestheyre also packing a few cybersecurity anxieties for the trip. According to new research from Malwarebytes, 52% of people said they worry about being scammed while traveling, while another 40% admitted that they worry about my kids or family sharing trip details online.

VPN 100

VPN Passwords Scams Backups 100

Security Affairs

MARCH 16, 2025

A Micronesian state suffered a ransomware attack and was forced to shut down all computers of its government health agency. A state in Micronesia, the state of Yap, suffered a ransomware attack, forcing the shutdown of all computers in its government health agency. Yap is one of the four states of the Federated States of Micronesia (FSM), a Pacific island nation.

Ransomware 114

Ransomware Government Internet Internet 114

Advertiser: Revenera

In a recent study, IDC found that 64% of organizations said they were already using open source in software development with a further 25% planning to in the next year. Most organizations are unaware of just how much open-source code is used and underestimate their dependency on it. As enterprises grow the use of open-source software, they face a new challenge: understanding the scope of open-source software that's being used throughout the organization and the corresponding exposure.

Risk