• A large phishing campaign has been targeting travelers worldwide, using more than 4,300 fake domains to steal payment card information.

    The operation focuses on people planning vacations or about to check into hotels by sending fake booking confirmation emails that appear to come from trusted travel companies.

    The attackers have created a network of websites that look like real hotel reservation pages, complete with familiar logos and professional layouts, making them difficult to spot as scams.

    The campaign uses a well-built phishing kit that adapts on links sent to victims via email. When someone clicks on a link in the fake email, their browser gets redirected through several websites before landing on the phishing page.

    The emails claim that a hotel reservation must be confirmed within 24 hours to avoid cancellation, creating a sense of urgency that pushes victims to act quickly without carefully checking the details.

    The fake pages mimic major travel brands, including Airbnb, Booking.com, Expedia, and Agoda, using their logos and design elements to appear legitimate.

    The phishing pages (Source - Netcraft)
    The phishing pages (Source – Netcraft)

    Netcraft security researchers identified that the threat actor behind this campaign is Russian-speaking, based on extensive Russian language comments found throughout the phishing kit’s source code.

    The operation began in February 2025 and has steadily grown, with the attacker registering new domains almost daily. One notable spike occurred on March 20, 2025, when 511 domains were registered in a single day.

    The domains follow consistent patterns with phrases like “confirmation,” “booking,” “guestverify,” “cardverify,” or “reservation” appearing in their names, often combined with random numbers.

    The attacker primarily uses four domain registrars: WebNIC, Public Domain Registry, Atak Domain Bilgi Teknolojileri A.S., and MAT BAO Corporation.

    Several hundred domains even reference specific luxury and boutique hotels from around the world, making the scam appear more targeted and convincing to potential victims.

    Redirection Chain and Infection Mechanism

    The phishing attack relies on a complex redirection system that makes it harder to trace and block.

    When victims click the “Confirm Booking” button in the fake email, they don’t go directly to the phishing site.

    Instead, the link first sends them to an old, unused website domain that was originally registered in 2016 for a movie promotion. That site then redirects to a page on Blogspot, Google’s free blogging platform, which finally redirects to the actual phishing page.

    This multi-step redirection chain serves several purposes. It helps the attackers avoid detection by security systems that might flag direct links to malicious sites.

    Using legitimate platforms like Blogspot adds a layer of trust since the intermediate URL appears on a well-known service. The chain also makes it harder for security researchers to track down the final destination and shut down the operation.

    Many real hotels have been impersonated by the attackers (Source – Netcraft)

    Once victims reach the phishing page, they see what appears to be a legitimate hotel booking confirmation form.

    The page displays a fake Cloudflare CAPTCHA that doesn’t actually function but uses Cloudflare branding to build false confidence.

    After passing this fake security check, victims are asked to enter their payment card details including the cardholder name, card number, CVV code, and expiration date.

    The page performs Luhn validation to check if the card number format is correct before attempting to process a fraudulent transaction in the background.

    While this happens, a fake support chat window appears with automated messages telling victims to confirm SMS notifications from their bank, which are actually the real fraud alerts triggered by the unauthorized charges the attackers are attempting.

    The phishing kit includes sophisticated features like support for 43 different languages and real-time polling that sends user keystrokes back to the attacker’s server approximately once per second.

    The pages use a unique identifier called an “AD_CODE” in the URL that determines which travel brand to impersonate, with different codes producing different branding on the same domain.

    This allows the attackers to run multiple campaigns simultaneously using the same infrastructure, targeting different brands and hotels with customized pages for each victim.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Massive Phishing Attack Impersonate as Travel Brands Attacking Users with 4,300 Malicious Domains appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler Gateway products.

    Tracked as CVE-2025-12101, the flaw allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking, data theft, or unauthorized actions.

    The vulnerability carries a moderate CVSSv4 score of 5.9, highlighting its network accessibility but reliance on user interaction.

    NetScaler ADC, formerly Citrix ADC, and NetScaler Gateway serve as critical application delivery controllers and secure remote access solutions for thousands of organizations worldwide.

    They handle VPN connections, load balancing, and authentication, making them prime targets for threat actors. This XSS issue stems from improper neutralization of input during web page generation, classified under CWE-79.

    Citrix NetScaler ADC and Gateway Vulnerability

    Exploitation requires specific configurations: the NetScaler must operate as a Gateway (including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or an AAA virtual server for authentication.

    Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-56.73, 13.1 before 13.1-60.32, 13.1-FIPS and NDcPP before 13.1-37.250-FIPS and NDcPP, and 12.1-FIPS and NDcPP before 12.1-55.333-FIPS and NDcPP.

    Notably, versions 12.1 and 13.0 have reached end-of-life (EOL) status, leaving them perpetually vulnerable without support. Customers using Secure Private Access on-premises or hybrid deployments with NetScaler instances face similar risks and must upgrade those components.

    The advisory applies solely to customer-managed appliances; Cloud Software Group handles updates for its managed cloud services and Adaptive Authentication.

    To detect exposure, administrators should inspect their NetScaler configurations for authentication virtual servers (e.g., “add authentication vserver .*”) or Gateway setups (e.g., VPN-related commands).

    While no active exploitation has been reported, the flaw’s simplicity could attract opportunistic attackers, especially in environments with unpatched legacy systems.

    Cloud Software Group urges immediate action: upgrade to patched releases such as NetScaler ADC and Gateway 14.1-56.73 or later, 13.1-60.32 or later for 13.1, 13.1-37.250 or later for FIPS/NDcPP variants, and 12.1-55.333 or later where applicable.

    EOL users should migrate to supported versions to mitigate risks. The company provides fixes without charge but emphasizes that the information is offered “as is,” with no warranties on system impact.

    This disclosure arrives amid heightened scrutiny of supply chain and remote access vulnerabilities, reminding enterprises to prioritize timely patching in their security postures. As threat landscapes evolve, regular configuration audits and version management remain essential defenses.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Citrix NetScaler ADC and Gateway Vulnerability Enables Cross-Site Scripting Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Rachel Riley, the new head of the Office of Naval Research, is more than just an alum of the controversial Department of Government Efficiency, according to current and former military and defense officials. Indeed, they said, the 33-year-old Rhodes Scholar and former McKinsey consultant may have what it takes to bring urgent reform to the Navy’s top R&D office.

    Riley was appointed acting chief of naval research sometime in October after nine months at Health and Human Services. Like DOGE employees across the federal government, she was assigned to HHS with a White House mandate to reduce staff; Politico described her as a “driving force” behind a failed effort to cut 8,000 people. One official told the news site that “No one wanted to work with her anymore,” but another said had helped “reorganize the department in a short period of time” and brought “strong analysis to the problems.”

    And despite DOGE’s record of disruptive change, hasty cuts, fecklessness, and conflicts of interest elsewhere, one former and one current defense official said its members at the Pentagon had a different relationship to their agency. At DOD, the DOGE office is led by Owen West, a former Marine and longtime defense policy expert, not a 19-year-old nicknamed “Big Balls.” 

    Riley earned an MSc in contemporary Chinese studies and a Ph.D in social policy at Oxford, then worked her way up to partner during eight years at McKinsey. 

    She had never worked for the government before January, according to her LinkedIn profile. But Riley has completed significant academic work related to China, which sources we spoke to highlighted as relevant. (She is also a military spouse.) At McKinsey, much of her work focused on helping the government address the challenge of too much bureaucracy, too low a risk tolerance, devotion to committee meetings, and other rigid structures that inhibit timely deployment of technology.

    Three current senior defense officials on background told Defense One in a note that they had full confidence in Riley and particularly the skills she had honed at McKinsey. They pointed out what numerous government reports have also highlighted, that persistent inefficiencies and layers of bureaucracy in Defense Department-led tech research, including time delays, sometimes caused more than a decade to field new capabilities. The Navy’s canceled $500 million electromagnetic railgun program is one example.

    The former defense official said that much of DOD’s work in fields like autonomy and artificial intelligence is simply a slower, more expensive version of what private tech firms already do, often better. 

    “There are entire enterprises within ONR that have never produced anything,” the official said. “They continue to be justified as part of the research enterprise, the kind of thing Anduril would love to stand up a division to deliver on tomorrow, and Silicon Valley would respond to by founding a whole new company.”

    A former military official who worked in drone research noted that billions of dollars going to research projects produces a fielded capability a fraction of the time. “That’s not a great model for the DoD.”

    They said some traditional defense contractors have built side businesses around research contracts that lack any requirement to deliver deployable systems quickly.

    Meanwhile, private capital is rapidly moving in. Venture-backed defense tech is already producing systems faster and cheaper, largely because much of the research is dual-use. In autonomy, for example, private-sector R&D is driving advances that have direct commercial applications, such as self-piloting cargo vessels.

    Venture capitalist Paul Madera made a similar point in December, writing, “Venture capitalists seem to be shifting their investment strategies toward so-called hard tech and deep tech opportunities: hardware products with high technical risk, versus software products with high market risk.”

    The former defense official said ONR devotes too little attention to development timelines, and to asking, “What’s commercially available?” New guidance from the defense secretary’s office echoes that point.

    Given those trends, the former official said, Riley’s experience is highly relevant.

    “The only way to prevent waste is strong leadership willing to say ‘no’ to projects and slaughter sacred cows,” the former defense official said. “And the Navy, with its federated holdover system, is really uncomfortable with that.”

    But Riley, and the new research and engineering leaders at the Pentagon, will also need to recognize that ONR funds research in areas that are crucial to national security yet unlikely to attract commercial R&D: high-level encryption, ocean climate science, marine geosciences, physical oceanography, marine biology, and more. As Congress cuts support to institutions like the National Science Foundation, the Defense Department has become a last refuge for high-risk, high-reward, strategically vital research.

    These are research areas that China prizes highly. But their future in the U.S. remains uncertain.

    Defense One was unable to reach Riley for comment.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • After nearly two months away from their jobs, House lawmakers are returning to vote on a deal to end the 43-day government shutdown, which is the longest in U.S. history. That vote is expected sometime this evening. 

    The deal, which advanced through the Senate Monday evening, would use a continuing resolution (PDF) to fund the Defense Department until Jan. 30. It will also unwind the more than 4,000 layoffs the Trump administration issued during the shutdown. Those reductions in force are currently paused by a federal court, Eric Katz of Government Executive reports

    Bigger picture: “[A]s the possibility of an end to the shutdown draws near, almost no one will be satisfied. Democrats didn’t get the health insurance provisions they demanded added to the spending deal,” the Associated Press reported Wednesday morning. “And Republicans, who control the levers of power in Washington, didn’t escape blame, according to polls and some state and local elections that went poorly for them.”

    ICYMI: Leaders from four of the military’s professional advocacy groups united to ask Congress to re-open the government, provide backpay to civilians who are looking at another missed paycheck, and pass legislation so that in the event of another shutdown, Defense Department civilians won’t be forced to work without pay, Defense One’s Meghann Myers reported Monday. 

    Despite House preparations to vote this evening, the services are looking at a long road to recovery. That’s in large part because the prospect of another CR to patch over a shut down means the services will have to pick and choose which missions to prioritize even more than usual. Read more, here

    Squeezed into that deal to end the shutdown: Funding for the Air Force’s new E-7 Wedgetail radar jet—despite the fact that the service wants to gut the program, Defense One’s Thomas Novelly reported Monday. 

    Background: The E-7 was pitched as a replacement for the service’s aging E-3 Sentry aircraft. Boeing and the Air Force reached an agreement last year for two test planes, to be delivered in 2028 for a substantial $2.6 billion. Those costs have risen by $884 million, according to a June Government Accountability Office report. 

    However, Defense Secretary Pete Hegseth told appropriators this summer that the E-7 was an example of a platform that was “not survivable in the modern battlefield or they don't give us an advantage in a future fight.” Additionally, defense officials this summer said the program was going to be cut “due to significant delays with cost increases.”  

    Expert reax: “If it passes, this is a big win for Boeing, and it shows that many in Congress still have doubts about how quickly the Space Force can deploy the AMTI system it funded in the reconciliation bill a few months ago,” said Todd Harrison, a defense budget expert with the American Enterprise Institute think tank. “This is Congress hedging its bets on the airborne warning mission.” Continue reading, here


    Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1969, journalist Seymour Hersh broke the story of the My Lai Massacre in Vietnam.

    Around the Defense Department

    New: The British military has paused intelligence-sharing with the Pentagon regarding alleged drug-trafficking boats in the Caribbean region “because it does not want to be complicit in US military strikes and believes the attacks are illegal,” CNN reported Tuesday. The halt in sharing began “over a month ago,” British officials told Natasha Bertrand. 

    Notable: “Several boats hit by the US have either been stationary or were turning around when they were attacked, CNN has reported, undermining the [Trump] administration’s claim that they posed an imminent threat that could not be dealt with through interdiction and arrest.”

    Not just the Brits: Canada “has made clear to the US that it does not want its intelligence being used to help target boats for deadly strikes, the sources told CNN.” 

    And Colombia said it would stop sharing intel with the U.S. over the strikes, President Gustavo Petro announced Tuesday on social media. “Such a measure will be maintained as long as the missile attack on boats in the Caribbean persists. The fight against drugs must be subordinated to the human rights of the Caribbean people,” he wrote. 

    Britain’s MI5 is also annoyed with FBI chief Kash Patel, who reportedly went back on a pledge to keep a key liaison officer in London, the New York Times reported Monday. The report raised eyebrows among longtime intelligence watchers, who noted that disputes between the countries’ intel communities rarely emerge in public.

    On Sunday, the U.S. military attacked and destroyed two more alleged drug trafficking boats in the waters off Latin America, SecDef Hegseth announced on social media the following morning. “Both strikes were conducted in international waters and 3 male narco-terrorists were aboard each vessel. All 6 were killed,” he said. “These vessels were known by our intelligence to be associated with illicit narcotics smuggling, were carrying narcotics, and were transiting along a known narco-trafficking transit route in the Eastern Pacific,” Hegseth claimed. 

    Updated death toll: According to Hegseth and Trump, the U.S. military has killed at least 76 people in almost two dozen strikes since Sept. 2. The New York Times and Military Times are both maintaining a running log of these strikes (though the NYT is typically more up to date). 

    New: The USS Gerald R. Ford carrier is now in the Caribbean region after it was diverted out of the Mediterranean Sea and closer to Venezuela, U.S. Naval Institute News reported Tuesday. Ship spotters located it off the coast of Puerto Rico on Tuesday. 

    By the way: “Ford’s escorts include guided-missile destroyers USS Bainbridge (DDG-96), USS Mahan (DDG-72) and USS Winston Churchill (DDG-81),” USNI writes. There are already at least eight U.S. warships, a nuclear submarine and F-35 aircraft operating in the Caribbean region, Reuters reminds readers. 

    Related reading:Venezuelan military preparing guerrilla response in case of US attack,” Reuters reported separately on Tuesday. 

    Update: ​​Trump’s military occupations of U.S. cities have cost nearly half a billion dollars so far, the Intercept reported Tuesday, citing estimates from the National Priorities Project and Sen. Dick Durbin, D-Ill. 

    The total includes “$172 million spent in Los Angeles, where troops arrived in June; almost $270 million for the occupation of Washington, D.C., which began in August; nearly $15 million for Portland, Oregon, which was announced in September; and more than $3 million for Memphis, Tennessee, and almost $13 million for Chicago, which both began last month,” Nick Turse writes. 

    Those costs could rise, too, considering Trump “has specifically threatened to surge troops into Baltimore, New York City, Oakland, St. Louis, San Francisco, and Seattle to put down supposed rebellions and to aid law enforcement agencies, despite falling crime numbers and pushback by local officials. Troops are also expected to be deployed to New Orleans later this month.” Read more, here

    Related:Trump Administration Plans to Send Border Patrol to Charlotte and New Orleans,” the New York Times reported Tuesday. 

    Meanwhile in the Pacific region, just one prototype won’t cut it anymore, Marine Corps Forces Pacific commander Lt. Gen. Jim Glynn said during a keynote speech at the recent AFCEA TechNet Indo-Pacific conference in Hawaii.

    Glynn: “What we need is: when you come with it, don’t come with one with the intention to take it home with you, and all the data that was collected while we conducted an exercise together. Come with five. Take one or two home and leave three with us, and we’ll continue to work with it. We’ll give you access to all the data that’s coming off of it, and we’ll do everything we can to break it, with the goal of making it better.” 

    He cited the Joint Fires Network as an example, saying that it has evolved over the past five years from “the amalgamation of some prototypes” to a formal program. Defense One’s Jennifer Hlad has more from Honolulu, here

    Additional reading: 

    Middle East

    U.S., Saudi officials rush to finalize defense pact before MBS visits White House. The pact may include the sale of weapons, including F-35 jets, promised as part of a giant package in May. It might also include a U.S. security guarantee of the sort Trump extended to Qatar last month, though “would fall short of a legally binding defense treaty, which would be nearly impossible to pass through the Senate,” Axios wrote. U.S. and Saudi officials have also discussed Riyadh’s desire to normalize relations with Israel, but only if Jerusalem ends its opposition to a deadline for creating a Palestinian state. More, here.

    Next week’s visit will be the first to the U.S. by Crown Prince Mohammed bin Salman since the 2018 murder and dismembering of journalist Adnan Khashoggi, a killing that MBS has called a “mistake” and which U.S. intelligence sources say he directed.

    The negotiations include Trump son-in-law Jared Kushner, who in 2020 launched a private equity firm with a reported $2 billion investment from the Saudi sovereign wealth fund controlled by MBS. Kushner has denied this represents a conflict of interest.

    Trump welcomed al-Qaeda leader-turned-Syrian president to the White House on Monday. New York Times: The Syrian leader has been discreetly cooperating with the U.S.-led coalition against ISIS and Al Qaeda since he took control of a slice of rebel-held territory in northwestern Syria in 2016, according to Syrian officials and Western diplomats who spoke on condition of anonymity in keeping with diplomatic protocol.” Read on, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries. The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit trusted brands like E-ZPass and USPS to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity leaders now face an impossible equation: you need intelligence that’s comprehensive enough to protect your organisation, fresh enough to stop emerging threats, and manageable enough that your team doesn’t drown in false positives.

    Most solutions force you to choose. Some prove you don’t have to. 

    The Intelligence Paradox: Too Much and Never Enough 

    Every CISO knows the struggle. Deploy too few threat feeds, and you’re flying blind, missing critical indicators that could prevent the next breach.

    Deploy too many, and your SOC analysts spend their days buried in alerts, chasing false positives, and burning out before they can focus on genuine threats. 

    This isn’t just an operational headache. It’s a business risk. When analysts are overwhelmed, response times slow. When threat data arrives too late, attackers have already moved.

    When intelligence lacks context, your team wastes hours investigating benign activity while real threats slip through undetected. 

    The balance seems impossible: you need data that’s simultaneously comprehensive and curated, real-time and actionable, detailed and digestible.  

    Business Resilience Happens When Context Meets Speed 

    ANY.RUN’s Threat Intelligence Feeds are made with the key principle in mind. Quality feeds don’t just add data — they transform how your entire cybersecurity operation functions.

    Think of them as your early warning system, your threat hunting compass, and your analyst productivity accelerator rolled into one. 

    ANY.RUN’s TI Feeds: data sources, features, benefits 

     
    Or, probably, imagine combining a microscope with a telegraph. One gives you perfect detail; the other gives you instant transmission. Individually useful, but together? Transformative. 

    But enough with metaphors. ANY.RUN’s TI Feeds solve the data paradox.  
     
    Powered by data from over 15,000 SOCs and researchers using ANY.RUN’s interactive malware sandbox, the feeds deliver live intelligence on real attacks happening right now. Each record is backed by behavioral analysis and real-world evidence. 

    Build resilience with live, contextual intelligence from 15K teams -> Request your TI Feeds trial 

    This combination of context and freshness is critical for decision-makers. It means your analysts don’t waste time chasing false positives or outdated data. They can prioritize real threats, act early, and protect the organization’s assets before risk turns into loss. 
     
    They integrate seamlessly with your SIEM, EDR, firewall, and other security tools, automatically enriching alerts with context and enabling automated response workflows.

    They shift your posture from reactive to proactive, allowing you to block threats before they reach your network rather than scrambling after the breach. 

    For MSSPs managing security across multiple clients, feeds become even more critical. They enable you to scale protection without scaling headcount proportionally, applying lessons learned from one customer’s threat landscape to protect all others instantly. 

    Why Context Matters for Your Bottom Line 

    Context transforms raw data into actionable intelligence. When your SIEM flags a suspicious IP address, generic feeds tell you “this is malicious.” 

    ANY.RUN’s feeds tell you how it’s malicious, what malware family it’s associated with, which attack techniques it employs, and what IOCs you should look for across your environment. 

    For security teams, this means: 

    • Faster triage: Analysts immediately understand threat severity and scope; 
    • Accurate prioritization: Distinguish between critical incidents and low-risk events; 
    • Effective response: Know exactly which containment measures to deploy; 
    • Reduced burnout: Spend time hunting real threats, not chasing shadows. 

    For business leaders, context transforms into: 

    • Lower operational costs: Less time wasted on false positives means better ROI on your security investment; 
    • Faster time-to-resolution: Contextual intelligence accelerates incident response from hours to minutes; 
    • Informed decision-making: Understand your actual risk exposure, not just a list of scary-sounding indicators. 

    When your intelligence reflects the experience of 15,000 SOCs worldwide, you’re no longer reacting in isolation — you’re part of a collective defense network. 

    Why Freshness Is Non-Negotiable 

    Threat actors evolve their techniques daily, launching new campaigns, rotating infrastructure, and modifying malware to evade detection. 

    ANY.RUN’s TI Feeds deliver intelligence with up-to-the-minute freshness because they’re derived from live analysis happening right now — as security teams worldwide investigate active threats using ANY.RUN’s Interactive Sandbox. 

    This real-time advantage means: 

    • Proactive blocking: Stop emerging threats before they become widespread; 
    • Reduced dwell time: Detect active compromises faster with the latest IOCs; 
    • Instant awareness: Gain visibility into novel attack techniques as they emerge; 
    • Competitive protection: Access intelligence that attackers haven’t yet adapted to evade. 

    For MSSPs, this freshness is a competitive differentiator. You can promise clients protection against threats that other providers won’t detect for days—because by the time those threats appear in slower feeds, you’ve already blocked them. 

    Make your next security decision data-driven, turn live threat data into strategic advantage -> Start you trial of ANY.RUN’s TI Feeds 

    TI Feeds: Business Objectives Met 

    ANY.RUN’s Threat Intelligence Feeds deliver business value across multiple dimensions: 

    • Real-World Threat Visibility: You’re receiving data about actual incidents and attacks that are impacting other companies right now. The threats currently investigated by 15,000 SOCs using ANY.RUN’s Interactive Sandbox.  
    • Cost-Effective Scale: ANY.RUN’s Feeds give you enterprise-grade intelligence without enterprise-level overhead.  
    • Regulatory Compliance and Due Diligence: Demonstrate to auditors, board members, and customers that you’re using current, comprehensive threat intelligence.  
    • Improved Detection Rates: Enrich your existing security tools with high-fidelity indicators that dramatically reduce false negatives. Catch threats that generic signature-based detection misses. 
    • Accelerated Incident Response: When a threat is detected, contextual intelligence means your team already knows the attack chain, associated IOCs, and effective countermeasures.  
    • Strategic Planning Support: Aggregate intelligence helps security leaders identify trends, understand your industry’s threat landscape, and make informed decisions about security investments and priorities. 
    • Reduced Analyst Fatigue: Analysts spend time doing interesting, meaningful work instead of drowning in noise. 
    • Interoperability: The feeds integrate seamlessly with your existing security infrastructure: SIEM platforms, threat intelligence platforms, EDR solutions, firewalls, and more.  

    Conclusion 

    Cyber resilience isn’t about having more data — it’s about having the right data at the right moment. ANY.RUN’s Threat Intelligence Feeds provide exactly that: live, contextual insights from real incidents across the globe.

    They help organizations cut through noise, reduce uncertainty, and make every security decision count. 

    The post Why your Business Need Live Threat Intel from 15k SOCs appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • A sophisticated backdoor malware campaign has emerged targeting Windows users through a weaponized version of SteamCleaner, a legitimate open-source utility designed to clean junk files from the Steam gaming platform.

    The malware establishes persistent access to compromised systems by deploying malicious Node.js scripts that maintain continuous communication with command-and-control servers, enabling attackers to execute arbitrary commands remotely.

    The threat actors have weaponized the legitimate SteamCleaner tool, which has not received updates since September 2018, by injecting malicious code into the original source and distributing it through fraudulent websites posing as illegal software repositories.

    Users seeking cracked software or keygens are redirected to GitHub repositories hosting the malware, which is delivered as Setup.exe.

    The malicious installer is signed with a valid digital certificate from Taiyuan Jiankang Technology Co., Ltd., lending false legitimacy to the 4.66MB package and allowing it to bypass initial security scrutiny.

    Upon execution, the malware installs itself in the C:\Program Files\Steam Cleaner\ directory, deploying multiple components including Steam Cleaner.exe (3,472KB), configuration files, and batch scripts.

    SteamCleaner source code released on Github (Source - ASEC)
    SteamCleaner source code released on Github (Source – ASEC)

    ASEC security researchers identified that the attackers maintained the original SteamCleaner functionality while incorporating sophisticated anti-sandbox detection mechanisms.

    The malware performs extensive environmental checks including system information analysis, port enumeration, WMI queries, and process monitoring.

    When a sandboxed environment is detected, the malware executes only the legitimate cleaning functionality without triggering malicious behavior.

    The payload delivery mechanism relies on encrypted PowerShell commands embedded within the malware.

    Malware signature and attribute information (Source - ASEC)
    Malware signature and attribute information (Source – ASEC)

    These commands orchestrate the installation of Node.js on the victim’s system and subsequently download two distinct malicious scripts from separate command-and-control infrastructure.

    Both scripts are registered with the Windows Task Scheduler to ensure persistence, executing automatically at system startup and repeating every hour thereafter.

    Command-and-Control Communication Protocol

    The two Node.js scripts establish bidirectional communication channels with their respective C2 servers through structured JSON payloads.

    When connecting to the C2 infrastructure, the malware transmits comprehensive system reconnaissance data including OS type and version, hostname, system architecture, and a unique machine identifier derived from the device GUID.

    The first script, installed at C:\WCM{UUID}\UUID and registered as Microsoft/Windows/WCM/WiFiSpeedScheduler, connects to multiple C2 domains including rt-guard[.]com, 4tressx[.]com, kuchiku[.]digital, and screenner[.]com.

    This script downloads files from attacker-specified URLs and executes them using CMD or PowerShell processes.

    The second script operates from C:\WindowsSetting{UUID}\UUID with the task name Microsoft/Windows/Diagnosis/Recommended DiagnosisScheduler, communicating with aginscore[.]com.

    This variant employs more aggressive obfuscation techniques and executes commands directly through Node[.]js’s native shell execution function.

    The C2 communication occurs through two primary endpoints: /d for receiving commands and /e for transmitting execution results.

    Follow us on Google NewsLinkedIn, and X to Get More Instant UpdatesSet CSN as a Preferred Source in Google.

    The post Beware of Malicious Steam Cleanup Tool Attack Windows Machines to Deploy Backdoor Malware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Apache OpenOffice has released version 4.1.16, addressing seven critical security vulnerabilities that enable unauthorized remote document loading and memory corruption attacks.

    These flaws represent a significant security risk to users of the popular open-source office suite. The most severe vulnerabilities involve unauthorized remote content loading without user prompts or warnings.

    Attackers can exploit these weaknesses to load malicious external documents through multiple attack vectors:

    Unauthorized Remote Content Loading

    CVE-2025-64401 allows remote document loading via IFrame elements, while CVE-2025-64402 leverages OLE objects for the same purpose.

    CVE-2025-64403 exploits the Calc spreadsheet application through external data sources, and CVE-2025-64404 abuses background and bullet images.

    Additionally, CVE-2025-64405 manipulates the DDE function to fetch remote content without user interaction.

    These remote content-loading vulnerabilities create opportunities for attackers to deliver malware and steal sensitive information.

    Conduct targeted phishing campaigns by embedding malicious content in seemingly legitimate office documents.

    Memory Corruption and Data Exfiltration

    Beyond unauthorized content loading, CVE-2025-64406 introduces a critical memory corruption vulnerability during CSV file imports.

    This flaw could enable arbitrary code execution if successfully exploited with specially crafted CSV files. OpenOffice concerning the issue is CVE-2025-64407, which enables URL fetching to extract arbitrary INI file values and environment variables.

    This vulnerability enables attackers to extract sensitive configuration data and system information from affected systems.

    Users should update to Apache OpenOffice 4.1.16 immediately to patch these vulnerabilities. The affected versions include all installations before 4.1.16.

    Organizations relying on OpenOffice for document processing should prioritize this update in their patch management schedules.

    The previous version 4.1.15 addressed additional critical issues, including use-after-free vulnerabilities, arbitrary file write capabilities in Base, and macro execution flaws.

    These layered fixes demonstrate ongoing security challenges in the OpenOffice codebase. OpenOffice system administrators should implement the following measures: Deploy version 4.1.16 across all systems, restrict macro execution policies.

    Disable DDE functions when not required and implement network monitoring to detect suspicious document-loading behavior. Users should exercise caution when opening documents from untrusted sources until updates are fully deployed.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Multiple Apache OpenOffice Vulnerabilities Leads to Memory Corruption and Unauthorized Content Loading appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Microsoft has disclosed two critical security vulnerabilities in GitHub Copilot and Visual Studio that could allow attackers to bypass essential security features.

    Both vulnerabilities were released on November 11, 2025, and have been assigned an Important severity rating.

    Path Traversal Vulnerability in Visual Studio

    The first vulnerability, tracked as CVE-2025-62449, stems from improper limitations in pathname handling and is classified as a path traversal flaw (CWE-22).

    This weakness allows attackers to access files and directories outside of restricted areas on a local system.

    With a CVSS score of 6.8, this vulnerability requires low attack complexity and local access with limited privileges.

    The threat actor needs user interaction to trigger the vulnerability, but once exploited, could achieve high confidentiality and integrity impact, along with limited availability impact.

    The attack vector is local, meaning the attacker must have some level of access to the affected system.

    CVE IDProductImpactWeaknessCVSS Score
    CVE-2025-62449Visual StudioSecurity Feature BypassCWE-22: Path Traversal6.8
    CVE-2025-62453GitHub CopilotSecurity Feature BypassCWE-1426: AI Output Validation5.0

    The risk intensifies, as many developers use Visual Studio as their primary development environment, potentially exposing sensitive source code and configuration files to unauthorized access.

    AI Output Validation Flaw in GitHub Copilot

    The second vulnerability, CVE-2025-62453, involves improper validation of generative AI output (CWE-1426) and a failure in the protection mechanism (CWE-693).

    This flaw specifically targets GitHub Copilot’s AI-generated code suggestions.

    With a CVSS score of 5.0, this vulnerability could allow attackers to manipulate AI output to bypass security checks or inject malicious code recommendations.

    This vulnerability is particularly concerning as developers often trust and implement code suggestions from AI assistants without thorough scrutiny.

    Attackers exploiting this flaw could inject backdoors or security flaws directly into projects through compromised code suggestions. Both vulnerabilities require user interaction and local system access, but carry significant risks for development teams.

    Microsoft has released patches through official CVE channels, and developers using GitHub Copilot and Visual Studio should apply updates immediately.

    The disclosure highlights growing security concerns around AI-assisted development tools and the importance of validating generated code before implementation.

    Organizations should review their development practices and security policies surrounding AI code generation tools.

    Development teams are advised to check Microsoft’s official security advisories for available patches and to implement proper code review processes for all AI-generated suggestions.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post GitHub Copilot and Visual Studio Vulnerabilities Allow Attacker to Bypass Security Feature appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An advanced hacking group is actively exploiting zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix systems. These attacks, spotted in real-world operations, allow hackers to deploy custom webshells and gain deep access to corporate networks.

    The findings highlight how attackers are targeting key systems that manage user logins and network controls, putting businesses at high risk.

    Cisco and Citrix 0-Days Exploited

    The trouble started with Amazon’s MadPot honeypot service, a tool designed to lure and study cyber threats. It caught attempts to exploit a Citrix flaw known as “Citrix Bleed Two” (CVE-2025-5777) before anyone knew about it publicly.

    This zero-day lets attackers run code remotely without permission. Digging deeper, Amazon’s experts linked the same hackers to a hidden weakness in Cisco ISE, now called CVE-2025-20337.

    This bug uses faulty data handling, or “deserialization,” to let outsiders execute code before even logging in. The result? Full admin control over the affected systems.

    What makes this scary is the timing. Hackers were hitting these flaws in the wild on live internet-facing setups before Cisco issued a CVE number or full patches for all versions of ISE.

    This “patch-gap” tactic shows the attackers’ smarts: they closely monitor updates and strike fast when defenses are weak. Amazon shared the Cisco details with the company, helping to speed up fixes, but the damage was already underway.

    Once inside, the hackers planted a sneaky custom webshell disguised as a normal Cisco part called “IdentityAuditAction.” Unlike basic malware, this one is built just for Cisco ISE.

    It runs entirely in the computer’s memory, avoiding files that forensics teams could easily spot. Using tricks like Java reflection, it hooks into the system’s web server (Tomcat) to watch all traffic. To hide commands, it encrypts them with DES and a weird Base64 twist, plus it checks for special web headers to activate.

    A peek at the code reveals their cunning. In one routine, it decodes hidden instructions from web requests, swaps characters like “*” for “a,” and uses a secret key (“d384922c”) to unlock the payload. This lets the hackers run arbitrary code without leaving traces, making detection tough.

    Amazon’s analysis shows the group was widely blasting these exploits across the internet, not just targeting specific targets. Their tools show deep knowledge of Java apps, Tomcat, and Cisco’s setup, suggesting a well-funded team with insider vuln info or top research skills.

    This fits a growing pattern: attackers targeting edge defenses such as identity managers and remote gateways that guard entire networks.

    For security pros, this is a wake-up call. Even top-notch systems can fall to pre-login exploits. Amazon urges teams to layer defenses: use firewalls to block access to management portals, watch for unusual web traffic, and build detection for odd behaviors. Quick patching is key, but so is assuming breaches and planning responses.

    This campaign reminds us that zero-days in critical tools like Cisco and Citrix can open the door to chaos. Companies must stay vigilant as hackers evolve.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Actively Exploiting Cisco and Citrix 0-Days in the Wild to Deploy Webshell appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶