Security News
![SEC confirms X account was hacked in SIM swapping attack](/static/build/img/news/sec-confirms-x-account-was-hacked-in-sim-swapping-attack-small.jpg)
The U.S. Securities and Exchange Commission confirmed today that its X account was hacked through a SIM-swapping attack on the cell phone number associated with the account. Today, the SEC has confirmed that a cell phone account associated with the X account suffered a SIM-swapping attack.
![Cracked macOS apps drain wallets using scripts fetched from DNS records](/static/build/img/news/cracked-macos-apps-drain-wallets-using-scripts-fetched-from-dns-records-small.jpg)
Hackers are using a stealthy method to deliver to macOS users information-stealing malware through DNS records that hide malicious scripts. The campaign appears directed at users of macOS Ventura and later and relies on cracked applications repackaged as PKG files that include a trojan.
![FTC orders Intuit to stop pushing "free" software that isn't really free](/static/build/img/news/ftc-orders-intuit-to-stop-pushing-free-software-that-isn-t-really-free-small.jpg)
Today, the U.S. Federal Trade Commission ordered Intuit to stop promoting its software products and services as "Free" unless they're actually free for all consumers. As the FTC said, around two-thirds of all tax filers in the U.S. could not use TurboTax for free as advertised by the accounting and tax software provider, instead being hit with charges when it was time to file.
![Slug slimes aerospace biz AerCap with ransomware, brags about 1TB theft](/static/build/img/news/slug-slimes-aerospace-biz-aercap-with-ransomware-brags-about-1tb-theft-small.jpg)
AerCap, the world's largest aircraft leasing company, has reported a ransomware infection that occurred earlier this month, but claims it hasn't yet suffered any financial losses yet and all its systems are under control. A ransomware crew called Slug has claimed responsibility for the intrusion and listed AerCap as its first public target.
![Malicious web redirect scripts stealth up to hide on hacked sites](/static/build/img/news/malicious-web-redirect-scripts-stealth-up-to-hide-on-hacked-sites-small.jpg)
Security researchers looking at more than 10,000 scripts used by the Parrot traffic direction system noticed an evolution marked by optimizations that make malicious code stealthier against security mechanisms. The operators behind Parrot sell the traffic to threat actors, who use it on users visiting infected sites for profiling and redirecting relevant targets to malicious destinations such as phishing pages or locations that deliver malware.
![Apple fixes first zero-day bug exploited in attacks this year](/static/build/img/news/apple-fixes-first-zero-day-bug-exploited-in-attacks-this-year-small.jpg)
Apple released security updates to address this year's first zero-day vulnerability exploited in attacks that could impact iPhones, Macs, and Apple TVs. The zero-day fixed today is tracked as CVE-2024-23222 and is a WebKit confusion issue that attackers could exploit to gain code execution on targeted devices. "Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited," Apple said today.
![Ivanti: VPN appliances vulnerable if pushing configs after mitigation](/static/build/img/news/ivanti-vpn-appliances-vulnerable-if-pushing-configs-after-mitigation-small.jpg)
Ivanti warned admins to stop pushing new device configurations to appliances after applying mitigations because this will leave them vulnerable to ongoing attacks exploiting two zero-day vulnerabilities. "Customers should stop pushing configurations to appliances with the XML in place, and not resume pushing configurations until the appliance is patched," Ivanti said in a new update published on Saturday.
![North Korean Hackers Weaponize Research Lures to Deliver RokRAT Backdoor](/static/build/img/news/north-korean-hackers-weaponize-research-lures-to-deliver-rokrat-backdoor-small.jpg)
Media organizations and high-profile experts in North Korean affairs have been at the receiving end of a new campaign orchestrated by a threat actor known as ScarCruft in December 2023. "ScarCruft...
![MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries](/static/build/img/news/mavengate-attack-could-let-hackers-hijack-java-and-android-via-abandoned-libraries-small.jpg)
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attack method called MavenGate. "Access to...
![EFF adds Street Surveillance Hub so Americans can check who's checking on them](/static/build/img/news/eff-adds-street-surveillance-hub-so-americans-can-check-who-s-checking-on-them-small.jpg)
For a country that prides itself on being free, America does seem to have an awful lot of spying going on, as the new Street Surveillance Hub from the Electronic Frontier Foundation shows. The Hub contains detailed breakdowns of the type of surveillance systems used, from bodycams to biometrics, predictive policing software to gunshot detection microphones and drone-equipped law enforcement.