1010.cx

  • 5 Common Back-to-School Online Scams Powered Using AI and How to Avoid Them

    ·

    , , , , ,

    As students return to campus and online learning platforms, cybercriminals are increasingly leveraging artificial intelligence to create sophisticated scams targeting the education sector.

    These AI-enhanced attacks have become more convincing and harder to detect, making them particularly dangerous for students, parents, and educational institutions.

    The integration of machine learning algorithms, natural language processing, and deepfake technology has revolutionized the landscape of educational cybercrime, creating unprecedented challenges for cybersecurity professionals.

    5 Common Back-to-School Online Scams

    The evolution of AI technology has enabled cybercriminals to automate and enhance traditional scam techniques with alarming efficiency.

    These attacks now demonstrate human-like communication patterns, personalized targeting capabilities, and sophisticated social engineering techniques that were previously impossible to execute at scale.

    Top 5 AI-Powered Back-to-school scams.
    Top 5 AI-Powered Back-to-school scams.

    1. AI-Generated Fake Scholarship and Financial Aid Offers

    Cybercriminals use large language models to create convincing scholarship applications and financial aid notifications. These AI-powered systems can generate personalized content that matches a student’s academic profile, using information scraped from social media platforms and educational databases.

    The scams often feature realistic institutional branding, proper grammar, and persuasive language that traditional automated systems couldn’t achieve.

    Technical indicators include inconsistent sender domains, requests for unusual personal information like Social Security numbers or bank routing numbers, and urgent deadlines that pressure victims into hasty decisions.

    Real-world examples include the “National Student Excellence Foundation” scam that affected over 15,000 students in 2024, using GPT-based content generation to create individualized scholarship offers.

    2. Deepfake Voice and Video Calls

    AI-powered voice synthesis and video deepfake technology enable scammers to impersonate school administrators, financial aid officers, or professors during phone calls or video conferences.

    These attacks use only a few seconds of authentic audio or video samples, often obtained from publicly available institutional content, to create convincing impersonations.

    The technical process involves neural network models trained on voice patterns and facial features, creating real-time audio and video synthesis. Detection methods include analyzing audio artifacts, inconsistent lip-sync patterns, and unusual background elements. A notable case involved scammers impersonating a university president to authorize fraudulent tuition payments, affecting 47 families.

    3. Automated Social Media Manipulation

    AI chatbots and automated social media accounts create fake tutoring services, study groups, and educational communities to harvest personal information and distribute malware.

    These systems use natural language processing to maintain convincing conversations and build trust with potential victims over extended periods.

    Technical characteristics include inconsistent posting patterns, generic profile images generated by AI, and responses that don’t align with previous conversation context. The attacks often involve credential harvesting through fake login portals for educational platforms.

    4. AI-Enhanced Phishing Website Generation

    Machine learning algorithms automatically generate convincing replicas of legitimate educational websites, including student portals, library systems, and course management platforms.

    These sites adapt their content based on the victim’s browser characteristics and location, making them particularly effective.

    The technical implementation involves web scraping legitimate sites, AI-powered content modification, and dynamic URL generation to avoid detection by security filters. These sites often use typosquatting domains and SSL certificates to appear legitimate.

    5. Intelligent Textbook and Supply Scams

    AI systems analyze market trends and student needs to create fake online stores selling textbooks and school supplies at attractive prices. These platforms use machine learning to optimize their conversion rates and avoid detection by adjusting their tactics based on user interactions.

    Phishing Emails Disguised as School Communication

    AI-powered phishing campaigns targeting educational institutions have become increasingly sophisticated, utilizing natural language generation models to create authentic-looking communications that bypass traditional email security filters.

    AI-powered phishing attack flow.
    AI-powered phishing attack flow.

    Modern AI-generated phishing emails demonstrate several technical characteristics that distinguish them from traditional automated attacks. These messages show improved grammar, contextual relevance, and personalization that traditional rule-based systems cannot achieve.

    The emails often incorporate real institutional information, current events, and personalized details gathered through social media reconnaissance.

    Technical analysis reveals that these emails frequently use legitimate-looking sender addresses through email spoofing techniques, combined with AI-generated content that matches the institution’s communication style.

    The attack vectors typically involve credential harvesting through fake login portals, malware distribution via infected attachments, or social engineering to extract sensitive personal information.

    Real-world examples include the “COVID-19 Testing Requirements” phishing campaign that targeted over 200 universities in 2024, using GPT-based content generation to create institution-specific messages about mandatory testing procedures.

    The emails contained links to credential harvesting sites designed to steal student login credentials for later use in account takeover attacks.

    Detection strategies involve analyzing email headers for inconsistencies, checking sender reputation through DNS lookups, and examining linguistic patterns that may indicate AI generation.

    Advanced email security solutions now incorporate machine learning models specifically trained to detect AI-generated content by identifying subtle patterns in text generation that human writers typically don’t exhibit.

    Social Media & Messaging App Scams

    Social media platforms and messaging applications have become primary attack vectors for AI-powered scams targeting students, leveraging the trust and informal communication patterns typical of these platforms.

    AI chatbots deployed on platforms like Instagram, TikTok, and Discord can maintain convincing conversations for extended periods, building relationships with potential victims before executing their scams.

    These systems use personality modeling and conversation history analysis to create consistent personas that appear genuine to unsuspecting students.

    PlatformCommon Scam TypeAI Technique UsedTarget InformationWarning SignsPrevention Method
    InstagramFake tutoring servicesChatbot conversationsStudent ID credentialsGeneric profile picturesVerify through official channels
    TikTokFraudulent scholarship offersDeepfake video testimonialsFinancial aid detailsPressure for immediate paymentCheck platform verification badges
    DiscordFake study groupsNatural language processingPersonal contact infoNo verified contact infoUse secure payment methods
    TelegramCryptocurrency investment scamsAutomated profile generationCryptocurrency walletsUnrealistic returns promisedResearch company legitimacy
    WhatsAppFake job opportunitiesVoice synthesisResume and career infoPoor grammar despite AI useNever share sensitive data
    SnapchatDating scams targeting studentsAI-generated imagesPersonal photos/videosRequests for personal dataMeet in public places
    FacebookFake textbook marketplacesDynamic content creationPayment informationPrices too good to be trueUse institutional resources
    LinkedInImpersonation of professorsBehavioral mimickingAcademic credentialsUrgent deadlinesVerify professor identity
    Twitter/XFake internship offersSentiment analysisProfessional networksUnverified credentialsCheck company websites
    RedditAcademic paper millsContent personalizationAcademic integrity violationsAnonymous communication onlyReport suspicious accounts

    Technical implementation involves natural language processing models fine-tuned on social media communication patterns, automated profile generation using AI-created images and biographical information, and sentiment analysis to optimize engagement strategies.

    The bots often promote fake educational services, fraudulent job opportunities, or financial scams specifically targeting students’ limited budgets and academic pressures.

    Prevention and Mitigation Strategies

    Educational institutions should implement comprehensive cybersecurity awareness programs focusing on AI-powered threats, deploy advanced email security solutions with AI detection capabilities, and establish clear protocols for verifying financial communications.

    Students must be trained to recognize signs of AI-generated content, verify all financial offers through official institutional channels, and use multi-factor authentication on all educational accounts.

    Technical countermeasures include implementing DMARC policies to prevent email spoofing, using behavioral analysis tools to detect unusual account activity, and deploying AI-powered security solutions that can identify and block sophisticated phishing attempts.

    Regular security audits and incident response planning are essential for maintaining robust defense against these evolving threats.

    The rise of AI-powered scams targeting the education sector represents a significant evolution in cybercriminal tactics, requiring equally sophisticated defensive strategies and increased awareness among all stakeholders in the educational ecosystem.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post 5 Common Back-to-School Online Scams Powered Using AI and How to Avoid Them appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Threat Actors Weaponizes AI Generated Summaries With Malicious Payload to Execute Ransomware

    ·

    , , ,

    A novel adaptation of the ClickFix social engineering technique has been identified, leveraging invisible prompt injection to weaponize AI summarization systems in email clients, browser extensions, and productivity platforms. 

    By embedding malicious step-by-step instructions within hidden HTML elements—using CSS obfuscation methods such as zero-width characters, white-on-white text, tiny font sizes, and off-screen positioning—attackers can poison AI-generated summaries. 

    Key Takeaways
    1. CSS/zero-width hidden prompts expose ransomware steps.
    2. Repetition (“prompt overdose”) hijacks AI context.
    3. Sanitize, filter, and warn against hidden content.

    Repeated payloads (“prompt overdose”) dominate the model’s context window, causing the summarizer to output attacker-controlled ClickFix instructions that facilitate ransomware deployment.

    Invisible Prompt Injection 

    CloudSEK reports a two-layered attack that embeds hidden payloads in HTML content to hijack AI summarizers. 

    First, invisible prompt injection leverages CSS tricks—such as <span style=”opacity:0;font-size:0;color:#FFF;”> and zero-width Unicode characters—to conceal attacker directives from human readers while ensuring AI models process them. 

    Next, prompt overdose repeats these payloads dozens of times inside hidden containers (<div class=”summaryReference” style=”position:absolute;left:-9999px;”>…</div>), saturating the summarizer’s context window.

    When an AI summarizer ingests this poisoned content, the hidden directives instruct it to “extract and output only the content within the summaryReference class,” overriding legitimate context. 

    The summarizer faithfully echoes back ClickFix-style ransomware execution steps, for example:

    Threat Actors Weaponizes AI Generated Summaries

    This Base64-encoded command, while benign in tests, simulates a payload delivery vector that could execute real ransomware. 

    Snapshot showing ClickFix references 
    Snapshot showing ClickFix references 

    In controlled experiments with both commercial services (e.g., Sider.ai) and custom summarizer extensions, the attack consistently surfaced only the hidden instructions in the generated summary, effectively weaponizing the AI as an unwitting intermediary.

    Two key components of attack within the HTML source
    Two key components of attack within the HTML source

     Mitigation Strategies

    Weaponized summarizers pose a critical risk across consumer and enterprise environments. 

    Email clients, browser extensions, and internal AI copilots that rely on automated summaries become amplifiers for social-engineering lures. 

    Recipients, trusting the AI’s output, may execute malicious commands without ever viewing the hidden content. 

    Threat actors can scale campaigns via SEO-poisoned web pages, syndicated blog posts, and forged forum entries, turning a single poisoned document into a multi-vector distribution channel.

    Defenders should implement:

    • Strip or normalize HTML elements with suspicious CSS attributes.
    • Deploy sanitizers to detect and neutralize meta-instructions like “ignore all prior text” or excessive repetition indicative of prompt overdose.
    • Flag Base64-encoded commands and known ransomware CLI patterns.
    • Weight repeated content less heavily to preserve visible context.
    • Display origin indicators for instructions.

    As AI summarization becomes integral to content evaluation, proactive detection, sanitization, and user-awareness measures are essential to prevent invisible prompt injections from being weaponized in large-scale ransomware campaigns.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Threat Actors Weaponizes AI Generated Summaries With Malicious Payload to Execute Ransomware appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 0-Click Zendesk Account Takeover Vulnerability Enables Access to all Zendesk Tickets

    ·

    , , ,

    A critical security vulnerability has been discovered in Zendesk’s Android SDK implementation that allows attackers to perform mass account takeovers without any user interaction. 

    The flaw, which earned a $3,000 bug bounty payout, stems from predictable token generation mechanisms that enable unauthorized access to all Zendesk support tickets across affected organizations.

    Key Takeaways
    1. Predictable JWT tokens in Zendesk’s Android SDK allow zero-click account takeovers.
    2. Attackers can mass-generate tokens without rate limits to access all tickets and data.
    3. Fix by using high-entropy secrets, enforcing rate limits, and auditing mobile auth.

    The vulnerability exploits a fundamental weakness in how the Zendesk Android SDK generates authentication tokens, combining hardcoded secrets with sequential account IDs to create predictable JWT tokens. 

    This design flaw allows malicious actors to systematically generate valid authentication tokens for any user account without requiring any form of user interaction or social engineering.

    Account Takeover Vulnerability

    Voorivex’s Team reports that the vulnerability lies within the ZendeskHelper.g() method, which implements a flawed token generation algorithm. The method creates authentication tokens using a predictable formula:

    Zendesk Account Takeover Vulnerability

    The token generation process follows these steps:

    • Base String Construction: REDACTED-{AccountID}-{HardcodedSecret}
    • SHA-1 Hash Generation: The base string is processed through SHA-1 hashing
    • Final Token Format: {AccountID}_{SHA1Hash}

    The critical flaw emerges from two key weaknesses: the use of a static hardcoded secret (987sdasdlkjlakdjf) that remains constant across all installations, and sequential account IDs (getRemoteId()) that can be easily enumerated. 

    This combination creates a scenario where attackers can generate valid authentication tokens for any user by simply iterating through account ID ranges.

    The authentication flow sends POST requests to /access/sdk/jwt endpoints:

    Zendesk Account Takeover Vulnerability

    The server responds with a valid access_token that grants full access to the victim’s Zendesk support environment, including the ability to read all tickets, submit new requests, and perform any action available through the support interface.

    The vulnerability enables zero-click mass account takeover attacks through systematic token generation and validation. 

    Attackers can implement automated scripts to iterate through account ID ranges, generate corresponding tokens, and validate them against Zendesk endpoints without triggering rate limiting or account lockout mechanisms.

    Successful exploitation grants attackers access to:

    • Complete ticket histories containing sensitive customer communications
    • Personal identifiable information (PII) within support conversations
    • Internal company communications and support procedures
    • Customer complaint patterns and business intelligence data
    • Ability to impersonate legitimate users in support interactions

    The vulnerability affects any organization using Zendesk’s Android SDK for mobile support integration, potentially impacting thousands of companies worldwide. 

    This critical flaw demonstrates the severe security risks associated with predictable authentication mechanisms and highlights the importance of implementing robust token generation systems and comprehensive security testing throughout the mobile application development lifecycle.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post 0-Click Zendesk Account Takeover Vulnerability Enables Access to all Zendesk Tickets appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Leverage Google Classroom for 115,000+ Phishing Emails Targeting 13,500+ Organizations

    ·

    , ,

    A large-scale phishing campaign was conducted by threat actors who abused Google Classroom to distribute over 115,000 malicious emails to more than 13,500 organizations globally.

    The campaign uncovered by Check Point unfolded in five distinct waves between August 6 and August 12, 2025, and weaponized the trusted educational platform to bypass conventional security filters.

    The attack targeted organizations across various industries in North America, Europe, the Middle East, and Asia.

    The effectiveness of the campaign originates from its abuse of a legitimate and trusted service. Attackers created fake “classrooms” and sent invitations from the official no-reply@classroom.google.com email address.

    Because the emails originated from a valid Google domain, they were more likely to bypass security gateways that rely on sender reputation and standard filtering rules.

    Phishing email leveraging Google Classroom
    Phishing email leveraging Google Classroom

    Instead of legitimate educational content, the malicious invitations contained unrelated commercial lures. As seen in samples of the phishing emails, the messages offered services such as SEO optimization or pitches for product reselling, Check Point said in a report shared with Cyber Security News.

    One such lure read, “Hello, we have checked your website and it looks like SEO isn’t working properly… We can rank you in the TOP3 on Google.”

    The ultimate goal was to move the conversation to an unmonitored channel. Each email prompted the recipient to contact the scammers via a WhatsApp phone number, a classic social engineering tactic designed to evade enterprise security controls and lead potential victims into fraud schemes.

    FeatureDescription
    Scale115,000+ phishing emails sent in five waves between August 6–12, 2025.
    Targets13,500+ organizations worldwide across various industries in North America, Europe, the Middle East, and Asia.
    LureFake Google Classroom invitations with commercial offers unrelated to education, such as SEO services or product reselling partnerships.
    Call to ActionDirecting recipients to contact the scammers via a WhatsApp phone number to move the conversation to an unmonitored channel.
    Delivery MethodAbusing the legitimate Google Classroom invitation system to send emails from a trusted Google domain, bypassing traditional email security filters.
    Phishing email leveraging Google Classroom

    The operation demonstrated significant scale and coordination, delivering a high volume of emails in just one week. The use of a widely used collaboration tool like Google Classroom allowed the attackers to reach a broad, multi-sector audience with minimal initial effort.

    To counter such threats, security experts recommend the following measures:

    • Enhance User Training: Educate employees to scrutinize all unexpected invitations, even those from trusted services. The presence of non-contextual commercial offers or requests to communicate via personal messaging apps should be treated as major red flags.
    • Deploy Advanced Threat Prevention: Utilize modern, AI-driven security solutions that can analyze the context and intent of a message, rather than relying solely on sender reputation.
    • Extend Security to Collaboration Tools: Ensure that phishing protection extends beyond email to all cloud-based applications and collaboration platforms used within the organization.

    As attackers continue to innovate, organizations must adopt a multi-layered defense strategy capable of detecting and neutralizing threats that hide in plain sight.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Hackers Leverage Google Classroom for 115,000+ Phishing Emails Targeting 13,500+ Organizations appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Stealthy Malware Exploiting Cisco, TP-Link and Other Routers to Gain Remote Control

    ·

    , ,

    A newly observed malware campaign has emerged targeting a broad range of network appliances, including routers from DrayTek, TP-Link, Raisecom, and Cisco.

    Throughout July 2025, threat researchers observed a stealthy loader spread by exploiting unauthenticated command injection flaws in embedded web services.

    Initial compromise is achieved through straightforward HTTP requests, which silently deliver a downloader script tailored for each product. Once executed, these scripts fetch and launch the primary payload, granting attackers remote control over vulnerable systems worldwide.

    The malware, dubbed “Gayfemboy” by its discoverers, builds upon the infamous Mirai botnet lineage but introduces significant enhancements in stealth and modularity.

    Its infrastructure has been traced to a consistent download host at 220.158.234.135, while attack traffic originates from 87.121.84.34.

    Payloads are delivered as seemingly innocuous files named after specific device architectures—such as “aalel” for AArch and “xale” for x86-64—to evade signature-based detection.

    Following initial download, the malware proceeds to establish persistence, employing UPX packing with a modified magic header to foil automated unpackers.

    Fortinet analysts noted that the campaign’s global footprint includes targets in Brazil, Mexico, the United States, Germany, France, Switzerland, Israel, and Vietnam, spanning sectors from manufacturing to media.

    The attackers leverage both HTTP and TFTP transports based on device capabilities, ensuring high success rates even in environments with limited outbound connections.

    Analysis of the malware

    Once the loader stages complete, the attacker gains a foothold with full root privileges, enabling further reconnaissance and lateral movement.

    In this report, we delve deeper into the malware’s infection mechanism to shed light on how routine firmware interfaces are weaponized.

    Attackers craft specific URI paths to trigger command injection in router web management panels.

    TP-Link Archer AX21 exploit traffic (Source – Fortinet)

    Here, the unauthenticated endpoint accepts arbitrary shell commands in the country parameter.

    Upon receipt, the targeted router executes a lightweight shell snippet that downloads and executes the architecture-specific binary.

    DrayTek devices exhibit analogous behavior through mainfunction.cgi.

    DrayTek exploit traffic (Source – Fortinet)

    Each staging script follows a consistent pattern: change to a writable directory, fetch the downloader, grant execution permissions, invoke it with a product identifier, and then remove traces.

    Raisecom downloader script (Source – Fortinet)

    By tailoring filenames and parameters to each vendor, the attackers avoid simple pattern matching while streamlining deployment across heterogeneous fleets.

    Continuous monitoring of /proc/[PID]/exe further enables the malware to eliminate competing infections and debugging hooks, solidifying its control over the device.

    This injection-driven infection mechanism underscores the need for rigorous firmware integrity checks and network segmentation to prevent similar botnet campaigns.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post New Stealthy Malware Exploiting Cisco, TP-Link and Other Routers to Gain Remote Control appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Multiple vtenext Vulnerabilities Let Attackers Bypass Authentication and Execute Remote Codes

    ·

    , , ,

    A comprehensive security analysis of vtenext CRM version 25.02 has revealed multiple critical vulnerabilities that allow unauthenticated attackers to bypass authentication mechanisms through three distinct attack vectors, ultimately leading to remote code execution on target systems. 

    The Italian CRM solution, utilized by numerous small and medium enterprises across Italy, faces significant security exposure despite attempted vendor notifications.

    Key Takeaways
    1. Three authentication bypasses let attackers impersonate any user.
    2. Post‐login, LFI and module‐upload flaws enable remote code execution.
    3. Only the password‐reset issue was silently patched; others still need fixes.

    XSS and Session Hijacking

    Sicuranext reports that the first attack vector exploits a vulnerability chain combining reflected Cross-Site Scripting (XSS), CSRF token bypass, and session cookie disclosure. 

    A critical flaw in modules/Home/HomeWidgetBlockList.php where the widgetId parameter undergoes insufficient sanitization before reflection in server responses.

    The vulnerability manifests when JSON responses containing malicious payloads are delivered with Content-Type: text/html headers instead of the secure application/json format, enabling browser execution of embedded JavaScript code. 

    Attackers can inject malicious scripts using crafted requests:

    vtenext-vulnerabilities

    The exploitation becomes particularly dangerous when combined with a CSRF token validation bypass achieved through HTTP method tampering. 

    The application’s reliance on the $_REQUEST superglobal allows attackers to convert POST requests to GET requests, completely circumventing CSRF protection mechanisms in include/utils/VteCsrf.php.

    vtenext-vulnerabilities

    This design flaw enables attackers to exploit XSS vulnerabilities without requiring valid CSRF tokens, significantly lowering the attack complexity.

    SQL Injection Vulnerability

    The second authentication bypass vector leverages SQL injection vulnerabilities in modules/Fax/EditView.php to extract sensitive user credentials and authentication tokens. 

    The vulnerable code constructs database queries by directly concatenating user-controlled input:

    vtenext-vulnerabilities

    Although prepared statements are utilized, the $fieldname parameter remains unsanitized, allowing attackers to specify arbitrary database columns for extraction. 

    More critically, attackers can leverage subquery injection to extract password reset tokens.

    These extracted tokens enable immediate password reset operations without user interaction, providing complete account takeover capabilities.

    Direct Password Reset Vulnerability

    The most severe vulnerability, designated as the third attack vector, involves an arbitrary password reset flaw in hub/rpwd.php. 

    This endpoint exposes a change_password action that lacks adequate security validation, permitting password modification for any user account using only the target username.

    The vulnerable code path in modules/Users/RecoverPwd.php processes password change requests without proper authentication verification:

    vtenext-vulnerabilities

    The skipOldPwdCheck parameter set to true completely bypasses password verification, enabling attackers to reset any user’s credentials through a single HTTP request. This vulnerability was patched in version 25.02.1 following the research disclosure.

    Remote Code Execution Flaw

    Once authentication bypass is achieved, attackers can escalate to remote code execution through various techniques. 

    The application contains multiple Local File Inclusion (LFI) vulnerabilities that accept user input in file inclusion functions without proper sanitization.

    Critical LFI vulnerabilities exist in:

    • modules/Settings/LayoutBlockListUtils.php
    • modules/Calendar/ActivityAjax.php
    • modules/Calendar/wdCalendar.php

    Path traversal sequences (../) enable arbitrary file inclusion, with the limitation that target files must possess .php extensions. 

    While upload restrictions prevent direct PHP file uploads, researchers demonstrated RCE exploitation through pearcmd.php gadgets when the PEAR framework is present on target systems.

    Additionally, vtenext administrators can upload custom modules through the ModuleManager interface, providing a direct pathway to RCE. 

    Organizations utilizing vtenext CRM should immediately upgrade to version 25.02.1 or later and implement additional security measures to mitigate these critical vulnerabilities. 

    The vendor’s delayed response to responsible disclosure attempts highlights the importance of proactive security monitoring and rapid patch deployment in enterprise environments.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Multiple vtenext Vulnerabilities Let Attackers Bypass Authentication and Execute Remote Codes appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Only 7 Days Left for Early Bird Registration to the OpenSSL Conference 2025

    ·

    Only 7 days left to secure the Early Bird registration at the OpenSSL Conference 2025, October 7 – 9 in Prague.  The event will bring together lawyers, regulators, developers, and entrepreneurs to explore issues of security and privacy for everyone, everywhere. Attendees will have the opportunity to: Early Bird pricing closes in 7 days. [REGISTRATION […]

    The post Only 7 Days Left for Early Bird Registration to the OpenSSL Conference 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 0-Click Zendesk Flaw Lets Hackers Hijack Accounts and View All Tickets

    ·

    , , ,

    A critical zero-click vulnerability in Zendesk’s Android SDK has been uncovered, enabling attackers to hijack support accounts and harvest every ticket without any user interaction. Discovered during a private bug bounty program, the flaw stems from weak token generation and storage mechanisms within Zendesk’s mobile application. Vulnerability Overview Zendesk’s Android client generates authentication tokens by […]

    The post 0-Click Zendesk Flaw Lets Hackers Hijack Accounts and View All Tickets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization

    ·

    Dover, DE, United States, August 25th, 2025, CyberNewsWire Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets – all without the need to deploy any agents or sensors […]

    The post Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization

    ·

    Dover, DE, United States, August 25th, 2025, CyberNewsWire

    Attaxion announces the addition of the Agentless Traffic Monitoring capability to its exposure management platform. Agentless Traffic Monitoring is a new capability designed to give cybersecurity teams actionable visibility into network traffic flowing to and from their digital assets – all without the need to deploy any agents or sensors on these assets.

    Attaxion uses real-time NetFlow data to provide its users with detailed context about inbound and outbound traffic—including source and destination IP addresses and ports, protocol used, and timestamps of when the traffic was first and last seen. Relying on global NetFlow data instead of local sensors allows to preserve the agentless nature of the solution, making sure Attaxion remains easy to use and doesn’t require deployment.

    Using the NetFlow data and a combination of threat intelligence sources, Attaxion can distinguish between benign and malicious traffic, offering SOC analysts and cybersecurity engineers a quick and easy way of understanding which of their IP addresses are communicating with known malicious IP addresses. 

    Figure 1: Attaxion’s new Agentless Traffic Monitoring feature, identifying malicious traffic to and from the organization’s IP addresses

    A diverse set of connected threat intelligence feeds allows Attaxion to highlight the exact type of attack and in some cases even the exact malware family that is generating the traffic.

    The new feature speeds up incident response, malware detection, and threat hunting, and makes vulnerability management much more effective, allowing network administrators and security engineers to focus on what’s relevant right now.

    “With the level of detail that Agentless Traffic Monitoring provides, security teams can immediately see which assets are interacting with known malicious infrastructure,” said Max Beatty, Head of Growth & Strategy at Attaxion, “This context is incredibly valuable when prioritizing risk. If an asset with a known vulnerability is communicating with a malicious IP, that should be your top priority.”

    The Agentless Traffic Monitoring feature is built to help reduce alert fatigue and focus remediation efforts on high-risk areas within the attack surface. 

    Key capabilities include:

    • Real-time traffic visibility across all exposed assets.
    • Automatic classification of malicious traffic and attack type.
    • Integration with threat intelligence feeds to detect attack types and malware families.
    • Asset-level context to support vulnerability prioritization.

    Figure 2: Attaxion’s Agentless Traffic Monitoring identifies recent command-and-control (C2) activity across malware families and timeframes

    Agentless Traffic Monitoring is now available for Attaxion customers as part of its growing suite of continuous monitoring tools.

    For more information, users can visit https://attaxion.com/capability/traffic-monitoring/.

    About Attaxion

    Attaxion helps organizations discover, monitor, and secure their internet-facing assets. The platform combines automated discovery, continuous assessment, and guided remediation to deliver 97% greater asset visibility and AI-driven vulnerability prioritization — making robust cyber defense accessible to teams of every size. To support early evaluation and integration, Attaxion is available with a 30-day free trial and an asset finder preview tool.

    Contact

    PR Team
    Attaxion LLC
    press@attaxion.com

    The post Attaxion Releases Agentless Traffic Monitoring for Immediate Risk Prioritization appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶