Blog – Page 850 – Cyber Mike

Microsoft Warns of ClickFix Phishing Campaign Targeting Hospitality Sector via Fake Booking[.]com Emails

Microsoft has shed light on an ongoing phishing campaign that targeted the hospitality sector by impersonating online travel agency Booking.com using an increasingly popular social engineering technique called ClickFix to deliver credential-stealing malware.
The activity, the tech giant said, started in December 2024 and operates with the end goal of conducting financial fraud and theft. It’s

Grafana Flaws Likely Targeted in Broad SSRF Exploitation Campaign

Threat actors are likely targeting Grafana path traversal bugs for reconnaissance in a SSRF exploitation campaign targeting popular platforms.

The post Grafana Flaws Likely Targeted in Broad SSRF Exploitation Campaign appeared first on SecurityWeek.

Microsoft Warns of Hospitality Sector Attacks Involving ClickFix

A cybercrime group named Storm-1865 has targeted hospitality organizations via fake Booking.com emails and the use of social engineering.

The post Microsoft Warns of Hospitality Sector Attacks Involving ClickFix appeared first on SecurityWeek.

ClickFix attack delivers infostealers, RATs in fake Booking.com emails

Microsoft is warning that an ongoing phishing campaign impersonating Booking.com is using ClickFix social engineering attacks to infect hospitality workers with various malware, including infostealers and RATs. […]

North Korea’s ScarCruft Deploys KoSpy Malware, Spying on Android Users via Fake Utility Apps

The North Korea-linked threat actor known as ScarCruft is said to have been behind a never-before-seen Android surveillance tool named KoSpy targeting Korean and English-speaking users.
Lookout, which shared details of the malware campaign, said the earliest versions date back to March 2022. The most recent samples were flagged in March 2024. It’s not clear how successful these efforts were.
“

Red Report 2025: Unmasking a 3X Spike in Credential Theft and Debunking the AI Hype

Credential theft surged 3× in a year—but AI-powered malware? More hype than reality. The Red Report 2025 by Picus Labs reveals attackers still rely on proven tactics like stealth & automation to execute the “perfect heist.” […]

DeepSeek’s Malware-Generation Capabilities Put to Test

Researchers have analyzed the ability of the Chinese gen-AI DeepSeek to create malware such as ransomware and keyloggers.

The post DeepSeek’s Malware-Generation Capabilities Put to Test appeared first on SecurityWeek.

North Korean Hackers Distributed Android Spyware via Google Play

The North Korea-linked APT37 has been observed targeting Android users with spyware distributed via Google Play.

The post North Korean Hackers Distributed Android Spyware via Google Play appeared first on SecurityWeek.

Medusa Ransomware Made 300 Critical Infrastructure Victims

CISA, FBI, and MS-ISAC warn of Medusa ransomware attacks targeting critical infrastructure organizations.

The post Medusa Ransomware Made 300 Critical Infrastructure Victims appeared first on SecurityWeek.

GitHub Uncovers New ruby-saml Vulnerabilities Allowing Account Takeover Attacks

Two high-severity security flaws have been disclosed in the open-source ruby-saml library that could allow malicious actors to bypass Security Assertion Markup Language (SAML) authentication protections.
SAML is an XML-based markup language and open-standard used for exchanging authentication and authorization data between parties, enabling features like single sign-on (SSO), which allows

Cyber News