Blog – Page 927 – Cyber Mike

Malicious npm Package Modifies Local ‘ethers’ Library to Launch Reverse Shell Attacks

Cybersecurity researchers have discovered two malicious packages on the npm registry that are designed to infect another locally installed package, underscoring the continued evolution of software supply chain attacks targeting the open-source ecosystem.
The packages in question are ethers-provider2 and ethers-providerz, with the former downloaded 73 times to date since it was published on

New npm attack poisons local packages with backdoors

Two malicious packages were discovered on npm (Node package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor. […]

macOS Users Warned of New Versions of ReaderUpdate Malware

macOS users are targeted with multiple versions of the ReaderUpdate malware written in Crystal, Nim, Rust, and Go programming languages.

The post macOS Users Warned of New Versions of ReaderUpdate Malware appeared first on SecurityWeek.

Sparring in the Cyber Ring: Using Automated Pentesting to Build Resilience

“A boxer derives the greatest advantage from his sparring partner…”
— Epictetus, 50–135 AD

Hands up. Chin tucked. Knees bent. The bell rings, and both boxers meet in the center and circle. Red throws out three jabs, feints a fourth, and—BANG—lands a right hand on Blue down the center.
This wasn’t Blue’s first day and despite his solid defense in front of the mirror, he feels the pressure.

Critical Next.js Vulnerability in Hacker Crosshairs

Threat actors have started probing servers impacted by a critical-severity vulnerability in the web application development framework Next.js.

The post Critical Next.js Vulnerability in Hacker Crosshairs appeared first on SecurityWeek.

How PAM Mitigates Insider Threats: Preventing Data Breaches, Privilege Misuse, and More

When people think of cybersecurity threats, they often picture external hackers breaking into networks. However, some of the most damaging breaches stem from within organizations. Whether through negligence or malicious intent, insiders can expose your organization to significant cybersecurity risks.
According to Verizon’s 2024 Data Breach Investigations Report, 57% of companies experience over

Security Firms Say Evidence Seems to Confirm Oracle Cloud Hack

Despite Oracle categorically denying that its Cloud systems have been breached, sample data released by the hacker seems to prove otherwise.

The post Security Firms Say Evidence Seems to Confirm Oracle Cloud Hack appeared first on SecurityWeek.

Hackers Using E-Crime Tool Atlantis AIO for Credential Stuffing on 140+ Platforms

Threat actors are leveraging an e-crime tool called Atlantis AIO Multi-Checker to automate credential stuffing attacks, according to findings from Abnormal Security.
Atlantis AIO “has emerged as a powerful weapon in the cybercriminal arsenal, enabling attackers to test millions of stolen credentials in rapid succession,” the cybersecurity company said in an analysis.
Credential stuffing is a

Windows 11 update breaks Veeam recovery, causes connection errors

Microsoft and Veeam are investigating a known issue that triggers connection errors on Windows 11 24H2 systems when restoring from Veeam Recovery Media. […]

Google fixes Chrome zero-day exploited in espionage campaign

Google has fixed a high-severity Chrome zero-day vulnerability exploited to escape the browser’s sandbox and deploy malware in espionage attacks targeting Russian organizations. […]

Cyber News