Microsoft has discovered phishing campaigns exploiting OAuth's redirection mechanisms to bypass conventional defenses. Attackers create malicious applications with redirect URIs pointing to malicious domains, then distribute phishing links prompting targets to authenticate. The attack abuses OAuth's error handling to redirect users from trusted providers to attacker-controlled sites for phishing or malware delivery. Campaigns targeted government and public sectors using e-signature, financial, and political lures. Some attacks led to malware downloads and endpoint compromise via PowerShell and DLL side-loading. Mitigation involves governing OAuth apps, limiting user consent, reviewing permissions, and implementing cross-domain detection across email, identity, and endpoint.
CVE-2026-0025 is a high-severity information disclosure vulnerability in Google Android affecting versions 14 through 16-qpr2. It arises from a permissions bypass in the hasImage method of Notification.java, allowing local attackers to access information across user boundaries without requiring any user interaction or additional execution privileges. This flaw can lead to local privilege escalation, compromising confidentiality, integrity, and availability of affected devices. Although no known exploits are currently in the wild, the vulnerability's ease of exploitation and broad impact make it a significant risk. Organizations using affected Android versions should prioritize patching once available and implement strict access controls to mitigate potential abuse. Countries with large Android user bases and high mobile device usage, such as the United States, India, Brazil, Germany, Japan, and South Korea, are particularly at risk. Defenders must monitor for updates from Google and apply security best practices to reduce exposure.
CVE-2026-0023 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14 through 16-qpr2. The flaw exists in the createSessionInternal method of PackageInstallerService.java, where a missing permission check allows a local app to update its ownership improperly. Exploitation requires only low privileges and no user interaction, enabling an attacker to escalate privileges locally. This vulnerability impacts confidentiality, integrity, and availability, as it allows unauthorized privilege escalation. No known exploits are currently reported in the wild. Android devices running affected versions are at risk, especially those with apps installed from untrusted sources. Mitigation involves applying patches once available and restricting app installation sources. Countries with large Android user bases and significant mobile ecosystems, such as the United States, India, Brazil, Germany, Japan, and South Korea, are most likely to be affected. Organizations should prioritize patching and monitoring for suspicious local privilege escalation attempts to reduce risk.
The report details the resurgence of the Funnull cybercriminal group, now utilizing a new arsenal called RingH23. It exposes their tactics, including compromising GoEdge CDN nodes, poisoning the MacCMS supply chain, and deploying sophisticated malware components like Badredis2s, Badnginx2s, and Badhide2s. The group has expanded its operations to inject malicious JavaScript, hijack cryptocurrency transactions, and redirect traffic to fraudulent sites. The campaign's impact is estimated to affect millions of users daily. The report also highlights Funnull's use of a suspicious new CDN infrastructure, CDN1.AI, likely created to evade detection.
A new malicious campaign involving seventeen npm packages has been identified, utilizing Pastebin and text steganography as a dead-drop resolver. The attackers employ a complex decoding mechanism to extract C2 URLs from seemingly benign text on Pastebin. The malware targets multiple platforms, including Windows, macOS, and Linux, downloading and executing platform-specific payloads. The infection chain involves multiple fallback domains hosted on Vercel, demonstrating a sophisticated approach to maintain persistence. This novel technique, along with other recent developments, indicates an accelerated pace of testing and development by the threat actor, suggesting continued iterations in their infection methodologies.
For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […] The post 2nd March – Threat Intelligence Report appeared first on Check Point Research .
The company is one of the many victims of the 2025 Oracle E-Business Suite (EBS) hacking campaign. The post Madison Square Garden Data Breach Confirmed Months After Hacker Attack appeared first on SecurityWeek .
Using Windows shortcut files, the APT deployed a new implant, a loader, a propagation tool, and two backdoors. The post North Korean APT Targets Air-Gapped Systems in Recent Campaign appeared first on SecurityWeek .
The internet giant is developing an evolution of the certificates based on Merkle Tree Certificates (MTCs). The post Google Working Towards Quantum-Safe Chrome HTTPS Certificates appeared first on SecurityWeek .
Both sides conduct hacking and other attacks, including the deployment of wiper malware, DDoS, and disruptions to critical infrastructure. The post US-Israel and Iran Trade Cyberattacks: Pro-West Hacks Cause Disruption as Tehran Retaliates appeared first on SecurityWeek .
The AI was abused to write exploits, create tools, and automatically exfiltrate over 150GB of data. The post Hackers Weaponize Claude Code in Mexican Government Cyberattack appeared first on SecurityWeek .
A sophisticated scam campaign is targeting users with a fake Zoom meeting website that automatically downloads and installs an unauthorized version of Teramind, a legitimate workforce monitoring solution. The attackers create a convincing imitation of a Zoom video call, complete with fake participants and audio, to lure victims. After a short delay, an 'Update Available' prompt appears, leading to the silent installation of the monitoring software. The altered Teramind installer is configured to run stealthily and avoid detection by security tools. This campaign is particularly dangerous as it misuses legitimate commercial software, making it difficult for traditional antivirus tools to detect. The attackers gain full surveillance capabilities over the victim's device, including keylogging, screen capture, and file monitoring.
A recent PlugX campaign utilized phishing emails with a 'Meeting Invitation' lure to deploy malware through DLL side-loading. The infection chain begins with a zip file containing a malicious .csproj file and MSBuild executable. The .csproj file downloads three components: a legitimate G DATA Antivirus executable, a malicious Avk.dll (PlugX variant), and an encrypted AVKTray.dat file. The malware uses DLL side-loading, API hashing, and XOR encryption for obfuscation. It establishes persistence via the Run registry key and communicates with a command and control server. The campaign showcases PlugX's continued evolution while maintaining its core characteristics, highlighting its ongoing relevance in cyber-espionage operations.
This analysis details how threat actors are exploiting Windows File Explorer's WebDAV functionality to deliver malware. WebDAV, a legacy protocol, is being used to trick users into downloading malicious files without going through web browsers, potentially bypassing security controls. Campaigns often use complex chains of scripts and legitimate files to deliver Remote Access Trojans (RATs). The tactic has been observed since February 2024, with increased activity from September 2024. Threat actors frequently abuse Cloudflare Tunnel demo accounts to host WebDAV servers. The report explains WebDAV links, how File Explorer can be manipulated, and various methods used by attackers, including URL shortcut files and LNK files. It also highlights the prevalence of German and English language campaigns targeting European corporate email accounts.
