Hackers have misused SharePoint Zero-Day to steal keys since July 7th to maintain permanent access
According to the findings from Check Point Research, the recently disclosed Microsoft SharePoint vulnerability was already being exploited as of July 7, 2025. The cybersecurity company said its activities were strengthened on July 18 and 19 across the government, communications and software sectors of North America and Western Europe, and the first attempt at exploitation […]
Iran-linked DCHSPY Android malware is equipped with a VPN app that spies against the rebels
July 21, 2025Ravi LakshmananSpyware/Mobile Security Cybersecurity researchers have been distributed to targets by unearthing new Android Spyware artifacts that are likely to belong to Iran’s Ministry of Information Security (MOI) and embellishing the VPN app and StarLink, a satellite internet connection service provided by SpaceX. Mobile security vendor Lookout said it discovered four samples of […]
China-linked hackers launch targeted spy campaigns on Africa’s IT infrastructure
July 21, 2025Ravi LakshmananBrowser Security/Malware The China-related cyberspy group, tracked as APT41, is attributed to a new campaign targeting government IT services in the African region. “The attackers used internal services, IP addresses, and hard coding names for proxy servers embedded within the malware,” said Kaspersky researchers Denis Kulik and Daniil PogoreLov. “One of the […]
SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
Even in well-secured environments, attackers are getting in—not with flashy exploits, but by quietly taking advantage of weak settings, outdated encryption, and trusted tools left unprotected. These attacks don’t depend on zero-days. They work by staying unnoticed—slipping through the cracks in what we monitor and what we assume is safe. What once looked suspicious now […]
Evaluating the role of AI in Zero Trust
By 2025, Zero Trust had evolved from a conceptual framework to an essential pillar of modern security. It is no longer theoretical, and is a requirement that organizations must now adopt. A robust, defensible architecture built on the principles of zero trust is more than meeting baseline regulatory obligations. Supports cyber resilience, secures third-party partnerships, […]
LLM Security Best Practices [Cheat Sheet]
After reading this cheat sheet, you can: Identify and mitigate new threats such as rapid injection, model addiction and use of shadow AI. Apply practical security controls throughout the LLM lifecycle, from training pipelines to user access. Build detailed defenses for LLMS including data verification, API hardening and continuous monitoring. Operate LLM security using policy, […]
Bypass poison hacker bypass fido key using QR phishing and cross-device sign-in abuse
July 21, 2025Ravi LakshmananThreat Intelligence/Authentication Cybersecurity researchers have revealed a new attack technique that allows threat actors to bypass key protections of Fast Identity (FIDO) by deceiving users to approve authentication requests from the spoofed company login portal. A FIDO key is a hardware or software-based authenticator designed to eliminate phishing by combining logins to […]
Microsoft releases emergency patch for SharePoint RCE flaws exploited in an ongoing cyberattack
On Sunday, Microsoft released a security patch for the security flaws that were actively exploited in SharePoint, releasing details of another vulnerability that it said was addressed with “more robust protection.” Tech Giant admitted that “we are aware of active attacks targeting on-premises SharePoint Server customers by leveraging vulnerabilities that were partially addressed in the […]
Hardcoded credentials found in HPE instant on the device allow administrator access
July 21, 2025Ravi LakshmananNetwork Security/Vulnerabilities Hewlett-Packard Enterprise (HPE) has released a security update to address critical security flaws that affect the instantaneous access point where attackers can bypass authentication and gain administrative access to the sensitive system. The vulnerability tracked as CVE-2025-37103 has a CVSS score of 9.8 out of a maximum of 10.0. “Hardcoded […]
3,500 websites that have been secretly hijacked to mine cryptography using stealth JavaScript and WebSocket tactics
July 21, 2025Ravi LakshmananWeb Security/Cryptocurrency The new attack campaign, along with JavaScript Cryptocurrency Miners, violates over 3,500 websites around the world, marking the return of a browser-based cryptojacking attack that was once popularized by things like Coinhive. The service was shut down after browser makers took steps to ban miner-related apps and add-ons, but C/Side […]