A sophisticated phishing campaign is targeting WooCommerce users with fake security alerts, tricking victims into downloading a "critical patch" that actually installs a backdoor. The attack uses spoofed emails and a fake WooCommerce Marketplace with a homograph domain to deliver malicious...
Critical vulnerabilities in Craft CMS are being actively exploited in zero-day attacks. Threat actors are chaining CVE-2024-58136 (CVSS 9.0) and CVE-2025-32432 (CVSS 10.0) to gain unauthorized server access. The second vulnerability allows unauthenticated remote code execution through the ...
Microsoft has identified Storm-1977, a threat actor targeting education sector cloud tenants through password spraying attacks using the "AzureChecker.exe" tool. The malware retrieves encrypted attack targets and processes username/password combinations. In one case, attackers exploited a ...
Researchers have discovered DslogdRAT, a new malware exploiting CVE-2025-0282 in Ivanti Connect Secure (ICS). This critical vulnerability allows unauthenticated remote code execution and was patched in January 2025. The attack deploys a Perl web shell that installs DslogdRAT, which then co...
Microsoft confirms plans to fix a CPU spike issue in classic Outlook that causes 30-50% CPU usage when typing emails, affecting users on Version 2406 Build 17726.20126 or later. The fix will roll out between May 2025 for Beta Channel users and Late May 2025 for Current Channel users. Until...
