1010.cx

  • Charging Cable that Hacks your Device to Record Keystrokes and Control Wi-Fi

    ·

    ,

    The Evil Crow Cable Wind is a stealthy tool for red teamers that hides a powerful hacking implant inside what appears to be a standard USB charging cable.

    Designed by security researcher Joel Serna Moreno, this device functions as a Human Interface Device (HID) capable of executing automated keystroke attacks at speeds of up to 1,000 characters per minute.

    Unlike traditional BadUSB tools that require pre-configured scripts, the Evil Crow Cable Wind integrates an ESP32-S3 chip, allowing attackers to control the device remotely via Wi-Fi through a web-based interface.

    This specific model follows the lineage of high-end espionage tools like the NSA’s $20,000 COTTONMOUTH-I implant, but makes similar capabilities available to penetration testers for approximately $43.​

    The defining feature of the Evil Crow Cable Wind is its wireless management, without installing specialized software or mobile applications.

    Users can connect to the cable’s Wi-Fi hotspot and access a browser-based dashboard to deploy payloads, manage configurations, or update firmware over the air.

    This web interface includes a live payload editor with syntax highlighting and an “AutoExec” feature that automatically runs specific scripts when the cable is plugged into a target device.

    The hardware is versatile, available in both USB-A to USB-C and USB-C to USB-C configurations, making it compatible with a broad range of modern laptops and smartphones.

    Advanced Features: OS Detection and Remote Shell

    According to Mobile-hacker analysis, Beyond simple keystroke injection, the EvilCrow CableWind offers sophisticated reconnaissance and control features.

    The device can detect the operating system of the host machine, identifying Windows, macOS, Linux, or Android, and conditionally execute payloads tailored to that specific environment.

    Furthermore, the tool supports a “Remote Shell” capability that establishes a serial connection between the target and the attacker’s interface.

    This allows red teamers to execute system commands on air-gapped machines that lack internet access, bridging the gap between physical access and remote execution, Joel Serna Moreno added.

    When placed alongside competitors like the O.MG Cable and USB Ninja, the Evil Crow Cable Wind positions itself as a cost-effective open-source alternative that prioritizes essential functionality over premium stealth features.

    While the O.MG Cable Elite offers advanced capabilities like hardware keylogging and geo-fencing, it costs significantly more. Conversely, the USB Ninja offers a stealthy design but lacks the dynamic web-based control found in Serna Moreno’s creation.

    The following table outlines the key differences between these popular hardware implants.​

    FeatureEvil Crow Cable WindUSB NinjaO.MG Cable (Elite)
    Price~$43~$161$150–$180
    Control MechanismWi-Fi (Web Interface)RF RemoteWi-Fi, App
    Payload EditingWeb-based (Live)NoneWeb-based
    OS DetectionYesNoYes
    Remote ShellYesNoYes
    KeyloggerNoNoYes
    Open SourceYesNoNo
    Comparison table (Source: Mobile-hacker)

    The Evil Crow Cable Wind represents a significant evolution in accessible physical security testing tools. By combining the ease of Wi-Fi control with powerful features like OS detection and air-gap bridging, it offers a robust solution for security professionals simulating insider threats.

    Although it lacks the hardware keylogging found in more expensive alternatives, its open-source nature and support for custom firmware such as the USB Army Knife project ensure it remains a flexible and adaptable asset for red team operations.​

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Charging Cable that Hacks your Device to Record Keystrokes and Control Wi-Fi appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Azure API Management Vulnerability Lets Attackers Create Accounts Across Tenants

    ·

    , , ,

    A critical security flaw in the Azure API Management Developer Portal enables attackers to bypass administrator controls and register accounts across multiple tenants, even when user sign-up has been explicitly disabled. The vulnerability remains unpatched as Microsoft considers it working “by design.” The Vulnerability Security researcher Mihalis Haatainen from Finnish cybersecurity firm Bountyy Oy discovered […]

    The post Azure API Management Vulnerability Lets Attackers Create Accounts Across Tenants appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apache Struts Vulnerability Let Attackers Trigger Disk Exhaustion Attacks

    ·

    , , , ,

    A critical security flaw in Apache Struts could allow attackers to trigger disk exhaustion attacks, rendering affected systems unusable.

    The vulnerability, tracked as CVE-2025-64775, stems from a file leak in multipart request processing that enables denial-of-service conditions.

    Apache Struts researcher discovered the vulnerability in Apache Struts’ multipart request processing mechanism. The flaw allows attackers to exploit file-handling operations, leading to uncontrolled file accumulation on the server.

    Critical Flaw Enables Disk Exhaustion Attacks

    As disk space depletes, applications become unresponsive and crash, disrupting business operations and services.

    The vulnerability affects multiple Struts versions, including those that have reached end-of-life status.

    Organizations running unsupported versions face heightened risk as they no longer receive security updates from Apache.

    FieldDetails
    CVE IdentifierCVE-2025-64775
    ProblemFile leak in multipart request processing causes disk exhaustion (DoS)
    ImpactDenial of service
    Affected SoftwareStruts 2.0.0-2.3.37 (EOL), Struts 2.5.0-2.5.33 (EOL), Struts 6.0.0-6.7.0, Struts 7.0.0-7.0.3

    All Struts 2 developers, system administrators, and security teams maintaining applications built on the Apache Struts framework should immediately assess their exposure to CVE-2025-64775.

    The vulnerability has an Important security rating and can cause complete denial-of-service. Attackers require no authentication to exploit this flaw, making it particularly dangerous for internet-facing applications.

    Once exploited, organizations experience service disruptions, potential data loss, and operational downtime during system restoration.

    All Apache Struts versions from 2.0.0 to 2.3.37 and 2.5.0 to 2.5.33 are End-of-Life (EOL), while versions 6.0.0 to 6.7.0 and 7.0.0 to 7.0.3 are currently vulnerable. Organizations running EOL versions face compounding risks from unpatched vulnerabilities.

    Apache Software Foundation strongly recommends upgrading to Struts 6.8.0 or newer within the 6.x branch. Alternatively, organizations can upgrade to Struts 7.1.1 or later.

    The patch addresses the file-leak issue while maintaining backward compatibility, ensuring existing applications continue to function without code modifications.

    Security teams should prioritize patching internet-facing Struts applications and conduct thorough testing in development environments before deploying to production.

    Organizations unable to immediately upgrade should implement monitoring for disk usage anomalies and consider temporary workarounds such as restricting multipart request sizes.

    The Apache Struts team responded quickly to the disclosure, releasing patched versions that resolve the disk exhaustion vulnerability. Organizations should treat this as a high-priority patch and include it in their next maintenance window.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Apache Struts Vulnerability Let Attackers Trigger Disk Exhaustion Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • OpenVPN Flaws Allow Hackers to Launch DoS Attacks and Bypass Security Checks

    ·

    , , ,

    Security researchers have uncovered three significant vulnerabilities in OpenVPN, one of the world’s most trusted open-source virtual private network (VPN) solutions. The discovered flaws could allow attackers to crash VPN services, bypass essential security checks, or read sensitive memory data. The OpenVPN development team has released urgent updates to address these issues, and administrators are […]

    The post OpenVPN Flaws Allow Hackers to Launch DoS Attacks and Bypass Security Checks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploit Telegram, WinSCP, Chrome, and Teams to Deliver ValleyRat Malware

    ·

    , , , ,

    Researchers have uncovered a sophisticated malware campaign where threat actors weaponize trojanized installers for popular productivity applications to deploy ValleyRat, a persistent remote access tool. The operation demonstrates advanced evasion techniques, including kernel-level driver abuse, endpoint security tampering, and multi-stage obfuscation designed to evade detection and establish long-term system compromise. The campaign has been attributed […]

    The post Hackers Exploit Telegram, WinSCP, Chrome, and Teams to Deliver ValleyRat Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sonesta International Hotels Implements Industry-Leading Cloud Security Through AccuKnox Collaboration

    ·

    Travel and hospitality industry leader Sonesta International Hotels partners with AccuKnox to deploy Zero Trust Integrated Application and Cloud Security [ASPM and CNAPP (Cloud Native Application Protection Platform)] for Microsoft Azure. AccuKnox, Inc., announced that Sonesta International Hotels has partnered with AccuKnox to deploy Zero Trust CNAPP. Gartner Group, in its 2024 findings, reported that […]

    The post Sonesta International Hotels Implements Industry-Leading Cloud Security Through AccuKnox Collaboration appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Sonesta International Hotels Implements Industry-Leading Cloud Security Through AccuKnox Collaboration

    ·

    Travel and hospitality industry leader Sonesta International Hotels partners with AccuKnox to deploy Zero Trust Integrated Application and Cloud Security [ASPM and CNAPP (Cloud Native Application Protection Platform)] for Microsoft Azure.

    AccuKnox, Inc., announced that Sonesta International Hotels has partnered with AccuKnox to deploy Zero Trust CNAPP.

    Gartner Group, in its 2024 findings, reported that security leaders should:

    • Adopt CNAPP offerings to safeguard cloud-native applications and counter the growing attack surface. These solutions protect against threats in the runtime environment, mitigate misconfigurations in cloud infrastructure, and streamline security integration and collaboration throughout the overall development experience.
    • Leverage CNAPP to strengthen defenses against network attacks, compute, storage, identities, permissions, APIs, and the software supply chain, thereby mitigating potential risks and safeguarding critical assets.
    • Prioritize solutions that cater to the increasing operational responsibilities of developers and cloud architects.

    Furthermore, Gartner opined that enterprises that do not employ a unified CNAPP will lack extensive visibility into the cloud attack surface and consequently fail to achieve their desired zero-trust goals.

    In its 2024 report on Vulnerability Management, Gartner advised organizations to implement an RVBM (Risk-based Vulnerability Management) and conduct CTEM (Continuous Threat Exposure Management) to achieve actionability, risk control, security integration, and prioritization. 

    Sonesta Security Engineering and Cloud Platform DevOps leaders were focused on implementing an integrated application security and cloud security platform with the following goals/objectives:

    • Multi-Cloud misconfigurations with a focus on reducing Alert Deluge.
    • Compliance conformance against CIS, SOC2 Type II, NIST, MITRE, PCI across Multi-Cloud Infrastructure.
    • DevSecOps with SAST, DAST & IaC security integrations with Azure DevOps.
    • Automation of the Findings & Ticketing Lifecycle.

    Sonesta conducted an extensive POC (Proof of Concept) with multiple vendors and selected AccuKnox for the following reasons:

    • Multi-cloud misconfiguration detection.
    • Special focus on toxic combinations. 
    • Continuous Compliance visibility against cloud in CIS, SOC2 Type II, NIST, MITRE, PCI across Multi-Cloud Infrastructure.
    • Consolidated view of the DevSecOps with SAST, DAST & IaC security integrations with Azure DevOps pipeline.
    • 45% reduction in the Engineering efforts due to the Automation of Findings & Ticketing Lifecycle.

    Supporting Quotes

    “We are thrilled that an industry leader like Sonesta chose us for their integrated Zero Trust ASPM/CNAPP platform. Their vision and strategy are very well aligned with ours, and we look forward to a great partnership”,

    Nat Natraj, co-founder and CEO, AccuKnox.

    “We conducted an extensive evaluation of best-in-class vendors in the industry and selected AccuKnox based on their comprehensive features, ease of deployment, ease of use, 3rd party integrations, and real-time security to prevent advanced zero-day attacks. Their strong roadmap offerings in API Security, AI/LLM Security made AccuKnox the best choice for an integrated AppSec/CloudSec platform”

    David Billeter, Cybersecurity Leader, Sonesta International Hotels.

    About AccuKnox

    AccuKnox provides a Zero Trust CNAPP Security platform that secures public clouds, private clouds, edge/IoT & 5G assets. AccuKnox is funded by leading security investors like National Grid Partners, MDSV, Avanta Venture Partners, Dolby Family Ventures, DreamIT Ventures, 5G Open Innovation Lab, and Seedop. AccuKnox was formed in partnership with SRI International (previously Stanford Research Institute) and has seminal patents on different aspects of Zero Trust security. 

    About Sonesta International Hotels

    Sonesta is the 8th largest hotel company in the U.S., according to Smith Travel Research (STR), with approximately 1,100 properties totaling 100,000 guest rooms across 13 brands in eight countries. Sonesta owns, manages, and/or franchises under The Royal Sonesta; The James, Classico Collection by Sonesta, Sonesta Hotels, Resorts & Cruises; MOD Collection by Sonesta, Sonesta Select Hotels; Sonesta Essential Hotels, Sonesta ES Suites, Sonesta Simply Suites, Red Lion Hotels, Inns & Suites by Sonesta; Signature Inn by Sonesta; Americas Best Value Inn by Sonesta; and Canada’s Best Value Inn by Sonesta.

    Contact

    Syed Hadi
    AccuKnox
    syed.hadi@accuknox.com

    The post Sonesta International Hotels Implements Industry-Leading Cloud Security Through AccuKnox Collaboration appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google Patches Android 0-Day Vulnerabilities Exploited in the Wild

    ·

    , , , ,

    Google has released critical security updates to address multiple zero-day vulnerabilities affecting Android devices worldwide.

    The December 2025 security bulletin reveals that threat actors are actively exploiting at least two of these vulnerabilities in real-world attacks, prompting urgent action from the tech giant.

    Critical Vulnerabilities Under Active Exploitation

    The two most concerning vulnerabilities being actively exploited are CVE-2025-48633 and CVE-2025-48572, both classified as information disclosure (ID) issues with high severity ratings.

    These vulnerabilities reside in Android’s Framework component and require immediate attention from device manufacturers and users.

    CVE-2025-48633 poses a significant risk by allowing unauthorized disclosure of information on affected versions of Android 13, 14, 15, and 16.

    Similarly, CVE-2025-48572 is classified as a privilege escalation vulnerability that could enable attackers to gain elevated access on vulnerable devices.

    AspectCVE-2025-48572CVE-2025-48633
    Vulnerability TypeElevation of Privilege (EoP)Information Disclosure (ID)
    Severity RatingHighHigh
    ComponentAndroid FrameworkAndroid Framework
    Affected VersionsAndroid 13, 14, 15, 16Android 13, 14, 15, 16
    Impact DescriptionAllows attacker to gain elevated system privileges without requiring additional permissionsEnables unauthorized access to sensitive device information and data

    Most Severe Threat: Remote Denial of Service

    While CVE-2025-48633 and CVE-2025-48572 represent the most actively exploited threats, the security bulletin identifies an even more critical vulnerability.

    CVE-2025-48631 stands out as the most severe issue in this month’s update, capable of causing remote denial-of-service attacks.

    What makes this vulnerability particularly dangerous is that attackers need no additional execution privileges to exploit it, meaning even unauthenticated attackers could trigger it.

    Google’s security response is comprehensive, addressing over 30 vulnerabilities across multiple Android components.

    Security patch levels resolve these issues, with source code patches to be released to the Android Open-Source Project within 48 hours of the bulletin’s publication.

    The Framework component dominates this month’s updates, with vulnerabilities including privilege escalation flaws (CVE-2025-22420, CVE-2025-48525).

    Denial-of-service issues and information disclosure vulnerabilities affecting Android versions 13 through 16. Google emphasizes that users can significantly reduce their risk through immediate action.

    The company has implemented multiple layers of protection through the Android security platform and Google Play Protect, which are enabled by default on devices with Google Mobile Services.

    Security experts advise users to install available updates immediately, particularly those using Android 13, 14, 15, or 16.

    Device manufacturers received advance notification at least one month before the public bulletin release, allowing them time to prepare patches for their specific devices.

    Android device owners should prioritize checking for available security updates in their device settings. Users can verify their current security patch level through their device’s About Phone section.

    Immediate installation of patches addressing the December 5, 2025, security level is strongly recommended, especially for devices that active exploits may target.

    Additionally, users should ensure Google Play Protect remains enabled and consider limiting app installation to the official Google Play Store, as the system actively monitors for potentially harmful applications that might exploit these vulnerabilities.

    The post Google Patches Android 0-Day Vulnerabilities Exploited in the Wild appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Arkanix Stealer Emerges as New Threat: Steals VPN Logins, Wi-Fi Credentials, and Screenshots

    ·

    , , ,

    A newly discovered information-stealing malware called Arkanix is rapidly evolving to target sensitive user data, including VPN credentials, system information, and wireless network passwords. Security researchers have identified this emerging threat as a short-lived, profit-driven malware designed for quick financial exploitation through the sale of stolen data and direct credential compromise. The threat actors behind […]

    The post Arkanix Stealer Emerges as New Threat: Steals VPN Logins, Wi-Fi Credentials, and Screenshots appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 4.3 Million Chrome and Edge Users Hacked in 7-Year ShadyPanda Malware Campaign

    ·

    , ,

    A sophisticated threat group operating under the name ShadyPanda has successfully compromised millions of browser users through a methodical seven-year campaign targeting popular Chrome and Edge extensions.

    The attack represents a significant breach of user trust, as the malicious extensions gained verified status from both Google and Microsoft, making them appear legitimate to unsuspecting users.

    Over this extended period, ShadyPanda infected 4.3 million devices while remaining largely undetected, demonstrating a patient and evolving approach to browser-based attacks.

    The campaign operates in two distinct but interconnected phases. The first involves a remote code execution (RCE) backdoor deployed through five weaponized extensions, including the well-known Clean Master application, which accumulated over 300,000 installations before activation.

    Clean Master - the malware that was featured by Google (Source - Koi)
    Clean Master – the malware that was featured by Google (Source – Koi)

    The second phase comprises a massive spyware operation spanning five additional extensions with over 4 million combined installs, particularly the WeTab New Tab Page extension with 3 million users alone.

    This dual-operation structure reveals the threat group’s ability to maintain multiple attack vectors simultaneously while evading detection for extended periods.

    Koi security analysts noted and identified that ShadyPanda’s success stems from weaponizing legitimate applications through quiet updates rather than malicious distribution methods.

    The group cultivated trust by allowing extensions to operate normally for years, collecting genuine user reviews and building installer counts.

    Cookie exfiltration (Source - Koi)
    Cookie exfiltration (Source – Koi)

    When vulnerable numbers were reached, a single update transformed these trusted tools into surveillance instruments, using Chrome and Edge’s automatic update mechanisms to instantly compromise millions of browsers without user interaction or visibility.

    Infection mechanism

    The infection mechanism operates with remarkable sophistication through several technical methods. Every infected browser contacts remote servers hourly to retrieve new instructions and execute arbitrary JavaScript code with full browser API access.

    This creates a persistent backdoor rather than static malware, enabling the threat group to adapt attacks dynamically.

    The malicious payload collects complete browsing histories, search queries, website navigation patterns, and precise mouse click coordinates, all encrypted with AES encryption before transmission to servers in China.

    To maintain effectiveness against security researchers, the malware employs advanced evasion techniques.

    When developer tools are opened, the extension immediately switches to benign behavior, preventing analysis and discovery.

    The code uses heavy obfuscation through shortened variable names and executes through a 158KB JavaScript interpreter to bypass security policies.

    Service workers enable man-in-the-middle capabilities, allowing traffic interception and modification of legitimate files, including credential harvesting from HTTPS connections.

    The threat landscape now extends beyond individual consumers to enterprise environments. Developer workstations running infected extensions represent entry points to corporate networks, potentially compromising repositories, API keys, and cloud infrastructure access.

    Security professionals must immediately audit installed extensions on critical systems and implement behavioral monitoring solutions to detect weaponization patterns that traditional static analysis cannot identify.

    Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

    The post 4.3 Million Chrome and Edge Users Hacked in 7-Year ShadyPanda Malware Campaign appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶