Fake IRS tax email delivers Emotet malware
We look at a current tax scam in circulation which looks to make an Emotet deposit on your PC. Tax season is upon us and,…
Month: March 2023
BugBountyHunter.com Updates. Greetings! | by Sean (zseano)
Artwork by https://www.instagram.com/laracallejaillustrations/ Greetings! In this post I plan to outline some changes I’ve made to bugbountyhunter since launch and future plans for the platform.…
WordPress force patching WooCommerce plugin with 500K installs
Automattic, the company behind the WordPress content management system, is force installing a security update on hundreds of thousands of websites running the highly popular…
The TikTok Hearing Revealed That Congress Is the Problem
In one sense, today’s US congressional hearing on TikTok was a big success: It revealed, over five hours, how desperately the United States needs national…
Researchers discover a new technique to hack and bypass Okta authentication
Researchers have discovered a new possible post-exploitation attack mechanism in Okta that allows attackers to access users’ passwords and credentials that are stored in the…
Brivo expands mobile credentials by adding employee badge to Apple Wallet
Brivo expands its mobile credential options by introducing support for employee badges in Apple Wallet. Brivo corporate customers can enable employees to add their employee…
BreachForums to be shut down after all for fear of law enforcement infiltration
After the arrest of the administrator of the Dark Web site BreachForums there was talk about keeping it alive, but now the forums will be…
Email content spoofing at IKEA.com | by Jonathan Bouman
Proof of concept BackgroundPreviously we discussed XSS, open redirect bugs and unrestricted file uploads. Today we will focus on email content spoofing. Phishing someone is…
Microsoft Teams, Virtualbox, Tesla zero-days exploited at Pwn2Own
During the second day of Pwn2Own Vancouver 2023, competitors were awarded $475,000 after successfully exploiting 10 zero-days in multiple products. The list of hacked targets…
Closing the Loop: Practical Attacks and Defences for GraphQL APIs | by Eugene Lim | CSG @ GovTech
GraphQL is a modern query language for Application Programming Interfaces (APIs). Supported by Facebook and the GraphQL Foundation, GraphQL grew quickly and has entered the…
BlackGuard stealer now targets 57 crypto wallets, extensions
A new variant of the BlackGuard stealer has been spotted in the wild, featuring new capabilities like USB propagation, persistence mechanisms, loading additional payloads in…
TikTok Paid for Influencers to Attend the Pro-TikTok Rally in DC
Ahead of TikTok CEO Shou Zi Chew’s much-anticipated testimony in the United States House of Representatives today, the embattled tech firm conducted a full-court press…