GoKawiil - Latest Tech News & Aggregated Headlines

From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques

bleepingcomputer.com Unknown 2025-09-19 21:01:11

By John Hammond, Alden Schmidt, Lindsey Welch During the past fifteen business days, Huntress analysts have observed increased threat activity involving several notable techniques. One case involved a malicious AnyDesk installer, which initially mimicked a standard ClickFix attack through a fake Cloudflare verification page but then utilized Windows File Explorer and an MSI package masked as a PDF to deploy MetaStealer malware. Additionally, two incidents involving the Cephalus ransomware vari

Topics: attack clickfix file metastealer windows

Shop Amazon

DataTables CDN Outage – post incident review

news.ycombinator.com Unknown 2025-09-19 22:27:40

Outage - post incident review By Allan Jardine On 29th July 2025, the DataTables.net site had a major outage as a result of an attack. This took out the main site with its examples and documentation, the support forum, and the sub-domains, including, most importantly, the DataTables CDN. Digging into such an event, when something has gone so wrong, is not a fun thing to do, but it is important for me to do so I can learn what I can do better in future, for you so you can understand what happe

Topics: attack cdn datatables domain registrar

Shop Amazon

Self-propagating supply chain attack hits 187 npm packages

bleepingcomputer.com Unknown 2025-09-21 21:46:43

Security researchers have identified at least 187 npm packages compromised in an ongoing supply chain attack, with a malicious self-propagating payload to infect other packages. The coordinated worm-style campaign dubbed 'Shai-Hulud' started yesterday with the compromise of the @ctrl/tinycolor npm package, which receives over 2 million weekly downloads. Since then, the campaign has expanded significantly and now includes packages published under CrowdStrike's npm namespace. From tinycolor to

Topics: attack chain compromised npm packages

Shop Amazon

Self-Replicating Worm Hits 180+ Software Packages

krebsonsecurity.com Unknown 2025-09-22 05:08:02

At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on GitHub, experts warn. The malware, which briefly infected multiple code packages from the security vendor CrowdStrike, steals and publishes even more credentials every time an infected package is installed. The novel malware strain is being dubbed Shai-Hulud — after the name for the giant sandworms

Topics: attack code npm packages said

Shop Amazon

One Vigilante, 22 Cell Tower Fires, and a World of Conspiracies

wired.com Brendan I. Koerner 2025-09-22 06:00:00

As dawn spread over San Antonio on September 9, 2021, almond-colored smoke began to fill the sky above the city’s Far West Side. The plumes were whorling off the top of a 132-foot-tall cell tower that overshadows an office park just north of SeaWorld. At a hotel a mile away, a paramedic snapped a photo of the spectacle and posted it to the r/sanantonio subreddit. “Cell tower on fire around 1604 and Culebra,” he wrote. In typical Reddit fashion, the comments section piled up with corny jokes. “B

Topics: 5g attacks conspiracy smith violence

Shop Amazon

One Vigilante, 22 Cell Towers, and a World of Conspiracies

wired.com Brendan I Koerner 2025-09-22 21:00:00

As dawn spread over San Antonio on September 9, 2021, almond-colored smoke began to fill the sky above the city’s Far West Side. The plumes were whorling off the top of a 132-foot-tall cell tower that overshadows an office park just north of SeaWorld. At a hotel a mile away, a paramedic snapped a photo of the spectacle and posted it to the r/sanantonio subreddit. “Cell tower on fire around 1604 and Culebra,” he wrote. In typical Reddit fashion, the comments section piled up with corny jokes. “B

Topics: 5g attacks conspiracy smith violence

Shop Amazon

The first three things you’ll want during a cyberattack

bleepingcomputer.com Unknown 2025-09-26 13:02:12

The moment a cyberattack strikes, the clock starts ticking. Files lock up, systems stall, phones light up and the pressure skyrockets. Every second counts. What happens next can mean the difference between recovery and catastrophe. In that moment, you need three things above all else: clarity, control and a lifeline. Without them, even the most experienced IT team or managed service provider (MSP) can feel paralyzed by confusion as damage escalates. But with clarity, control and a lifeline, you

Topics: attack clarity control lifeline recovery

Shop Amazon

Apple warns customers targeted in recent spyware attacks

bleepingcomputer.com Unknown 2025-09-28 01:02:51

Apple warned customers last week that their devices were targeted in a new series of spyware attacks, according to the French national Computer Emergency Response Team (CERT-FR). CERT-FR is operated by ANSSI, the National Cybersecurity Agency, and is responsible for preventing and mitigating cybersecurity-related incidents impacting public and critical organizations. According to a Thursday advisory, CERT-FR is aware of at least four instances of Apple threat notifications alerting the company

Topics: apple attacks cert devices notifications

Shop Amazon

DDoS defender targeted in 1.5 Bpps denial-of-service attack

bleepingcomputer.com Unknown 2025-09-29 21:09:41

A DDoS mitigation service provider in Europe was targeted in a massive distributed denial-of-service attack that reached 1.5 billion packets per second. The attack originated from thousands of IoTs and MikroTik routers, and it was mitigated by FastNetMon, a company that offers protection against service disruptions. “The attack reached 1.5 billion packets per second (1.5 Gpps) — one of the largest packet-rate floods publicly disclosed,” FastNetMon says in a press release. “The malicious traff

Topics: attack ddos fastnetmon second service

Shop Amazon

After Ukrainian testing, drone detection radar doubles range with simple software patch

arstechnica.com Unknown 2025-09-30 01:16:51

As part of its unprovoked invasion, Russia has been firing massed waves of drones and missiles into Ukraine for years, though the tempo has been raised dramatically in recent months. Barrages of 700-plus drones now regularly attack Ukraine during overnight raids. Russia also appears to have upped the ante dramatically by sending at least 19 drones into Poland last night, some of which were shot down by NATO forces. Many of these drones are Shahed/Geran types built with technology imported from

Topics: attack cost drone drones ukraine

Shop Amazon

Hackers left empty-handed after massive NPM supply-chain attack

bleepingcomputer.com Unknown 2025-09-30 17:56:15

The largest supply-chain compromise in the history of the NPM ecosystem has impacted roughly 10% of all cloud environments, but the attacker made little profit off it. The attack occurred earlier this week after maintainer Josh Junon (qix) fell for a password reset phishing lure and compromised multiple highly popular NPM packages, among them chalk and degub-js, that cumulatively have more than 2.6 billion weekly downloads. After gaining access to Junon’s account, the attackers pushed maliciou

Topics: attack cloud environments malicious packages

Shop Amazon

Jaguar Land Rover confirms data theft after recent cyberattack

bleepingcomputer.com Unknown 2025-10-01 01:29:16

Jaguar Land Rover (JLR) confirmed today that attackers also stole "some data" during a recent cyberattack that forced it to shut down systems and instruct staff not to report to work. JRL functions as a standalone entity under Tata Motors India after its purchase from Ford in 2008. With an annual revenue of over $38 billion (£29 billion), JLR employs approximately 39,000 people and makes more than 400,000 vehicles each year. The automobile manufacturer disclosed the attack on September 2, stat

Topics: attack company data group jlr

Shop Amazon

An attacker’s blunder gave us a look into their operations

news.ycombinator.com Jamie Levy 2025-10-02 23:42:32

Figure 8: Threat actor starts to rely on automated workflows The threat actor also appeared to be interested in other AI tools to help with data generation and writing. We saw multiple Google searches for “free ai no signup” and for “csv generator ai.” We also saw the threat actor using Toolbaz AI, which is a writing assistant; the CSV spreadsheet generator feature of DocsBot AI, which is an AI chatbot tool; and the AI data generator feature of Explo AI, which is an embedded analytics tool.

Topics: actor attacker figure threat various

Shop Amazon

US charges admin of LockerGoga, MegaCortex, Nefilim ransomware

bleepingcomputer.com Unknown 2025-10-03 05:08:15

The U.S. Department of Justice has charged Ukrainian national Volodymyr Viktorovich Tymoshchuk for his role as the administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations. Also known online as deadforz, Boba, msfv, and farnetwork, Tymoshchuk was involved in ransomware attacks that led to the breach of hundreds of companies, resulting in millions of dollars in damages, according to a superseding indictment unsealed today. Between July 2019 and June 2020, Tymoshchuk and hi

Topics: attacks charges lockergoga ransomware tymoshchuk

Shop Amazon

How An Attacker's Blunder Gave Us a Rare Look Inside Their Day-to-Day Operations

news.ycombinator.com Jamie Levy 2025-10-03 04:42:32

Figure 8: Threat actor starts to rely on automated workflows The threat actor also appeared to be interested in other AI tools to help with data generation and writing. We saw multiple Google searches for “free ai no signup” and for “csv generator ai.” We also saw the threat actor using Toolbaz AI, which is a writing assistant; the CSV spreadsheet generator feature of DocsBot AI, which is an AI chatbot tool; and the AI data generator feature of Explo AI, which is an embedded analytics tool.

Topics: actor attacker figure threat various

Shop Amazon

Get This Item to Make Hollow Knight: Silksong Much Easier

cnet.com See Full Bio 2025-10-04 13:02:34

Hollow Knight: Silksong received a lot of hype in the lead-up to its release on Thursday. When the long-awaited title finally came out, a flood of players rushed to download it, but it appears some caught up in the hype were not prepared for the game's crushing difficulty. But there is some help for struggling players near the very start of the game. Silksong protagonist Hornet is far more agile than the Knight from Hollow Knight, especially in her diagonal downward slash. But this angled attac

Topics: area attack crest game wanderer

Shop Amazon

Some Heart Attacks Might Be Triggered by Germs

gizmodo.com Ed Cara 2025-10-05 01:30:27

Germs might be even worse for us than we thought. New research suggests that certain infections could be a contributing factor to heart attacks. Scientists in Finland and the UK conducted the study, which examined arterial plaques taken from people who died from heart disease and others. They found these plaques often contained a dormant layer of bacterial biofilm; they also found evidence that bacteria released from this biofilm can then trigger heart attacks. Though not yet definitive, the st

Topics: attacks bacteria heart plaques researchers

Shop Amazon

Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack

bleepingcomputer.com Unknown 2025-10-05 13:47:51

In what is being called the largest supply chain attack in history, attackers have injected malware into NPM packages with over 2.6 billion weekly downloads after compromising maintainers' accounts in a phishing attack. One of the package maintainers whose accounts were hijacked in this supply-chain attack confirmed the incident earlier today, stating that he was aware of the compromise and adding that the phishing email came from support [at] npmjs [dot] help, a domain that hosts a website imp

Topics: ansi attack downloads phishing week

Shop Amazon

AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack

bleepingcomputer.com Unknown 2025-10-05 23:11:21

Investigations into the Nx "s1ngularity" NPM supply chain attack have unveiled a massive fallout, with thousands of account tokens and repository secrets leaked. According to a post-incident evaluation by Wiz researchers, the Nx compromise has resulted in the exposure of 2,180 accounts and 7,200 repositories across three distinct phases. Wiz also stressed that the incident's scope of impact remains significant, as many of the leaked secrets remain valid, and so the effect is still unfolding.

Topics: attack github nx secrets wiz

Shop Amazon

6 browser-based attacks all security teams should be ready for in 2025

bleepingcomputer.com Unknown 2025-10-10 00:01:11

What security teams need to know about the browser-based attack techniques that are the leading cause of breaches in 2025. “The browser is the new battleground.” “The browser is the new endpoint”. These are statements you’ll run into time and again as you read articles on websites like this one. But what does this actually mean from a security perspective? In this article, we’ll explore what security teams are trying to stop attackers from doing in the browser, breaking down what a “browser-b

Topics: attackers browser malicious phishing security

Shop Amazon

They know where you are: Cybersecurity and the shadow world of geolocation

bleepingcomputer.com Unknown 2025-10-12 13:02:12

Tony Soprano knew. When one of his follow poker players in season 5, episode 4 of The Sopranos asks Tony how he likes his new Cadillac Escalade, the fictional mobster responds, “I love it. After I pulled out that global positioning [system].” OK, his language was a little more spicy than “system,” but the point is that Tony knew the dangers of being trackable. The rest of us might not have the same concerns Tony had about being findable just about anywhere, but we should all realize how danger

Topics: attack attacks geolocation location threat

Shop Amazon

Cloudflare stops new world's largest DDoS attack over Labor Day weekend

zdnet.com Steven Vaughan-Nichols 2025-10-13 06:25:56

Hollie Adams/Bloomberg via Getty Images Follow ZDNET: Add us as a preferred source on Google. ZDNET's key takeaways The biggest, baddest DDoS attack to date was just fended off. The attack used the trivial, but nasty, UDP flood attack. You must protect yourself against DDoS attacks. Over the Labor Day weekend, Cloudflare says it successfully stopped a record-breaking distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps). This came only a few months afte

Topics: attack attacks cloudflare ddos hyper

Shop Amazon

This Common Heart Attack Drug May Actually Be Worthless for Most People

gizmodo.com Ed Cara 2025-10-14 01:50:06

A common treatment given after heart attacks may not be worthwhile for a large segment of the population. New trial data finds that most people who suffer a heart attack do not benefit from taking beta-blockers afterward. A large international team of researchers conducted the trial, which compared the outcomes of nearly 10,000 heart attack patients who were either given beta-blocker therapy or not. “This trial will reshape all international clinical guidelines.’ On average, people with prese

Topics: attack attacks beta blockers heart

Shop Amazon

Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps

bleepingcomputer.com Unknown 2025-10-14 17:52:30

Internet infrastructure company Cloudflare said it recently blocked the largest recorded volumetric distributed denial-of-service (DDoS) attack, which peaked at 11.5 terabits per second (Tbps). In volumetric DDoS attacks, attackers overwhelm the target with massive amounts of data, consuming the bandwidth or exhausting system resources, leaving legitimate users with no access to the targeted servers and services. "Cloudflare's defenses have been working overtime. Over the past few weeks, we've

Topics: attack attacks cloudflare ddos tbps

Shop Amazon

Pennsylvania AG Office says ransomware attack behind recent outage

bleepingcomputer.com Unknown 2025-10-14 20:20:01

The Office of the Pennsylvania Attorney General announced that a ransomware attack is behind the ongoing two-week service outage. In an official statement, Attorney General David W. Sunday Jr. said that the office refused to pay the attackers. “The interruption was caused by an outsider encrypting files in an effort to force the office to make a payment to restore operations. No payment has been made,” explained AG Sunday. “An active investigation is ongoing with other agencies, which limits

Topics: ag attack office ransomware time

Shop Amazon

Jaguar Land Rover production severely hit by cyber-attack

feeds.bbci.co.uk Unknown 2025-10-15 05:51:37

Jaguar Land Rover production severely hit by cyber-attack Jaguar Land Rover says a cyber-attack has "severely disrupted" vehicle production as well as its retail operation. The firm, which is owned by India's Tata Motors, says it took immediate action to lessen the effect of the hack and is working quickly to restart operations. There was no evidence any customer data had been stolen, it said. The attack began on Sunday and comes at a significant time for UK car sales, as the latest batch of

Topics: attack cyber jaguar land new

Shop Amazon

Zscaler data breach exposes customer info after Salesloft Drift compromise

bleepingcomputer.com Unknown 2025-10-16 22:00:00

Cybersecurity company Zscaler warns it suffered a data breach after threat actors gained access to its Salesforce instance and stole customer information, including the contents of support cases. This warning follows the compromise of Salesloft Drift, an AI chat agent that integrates with Salesforce, in which attackers stole OAuth and refresh tokens, enabling them to gain access to customer Salesforce environments and exfiltrate sensitive data. In an advisory, Zscaler says that its Salesforce

Topics: access attacks google salesforce zscaler

Shop Amazon

MATLAB dev says ransomware gang stole data of 10,000 people

bleepingcomputer.com Unknown 2025-10-21 09:00:06

MathWorks, a leading developer of mathematical simulation and computing software, revealed that a ransomware gang stole the data of over 10,000 people after breaching its network in April. The company disclosed the attack on May 27, when it linked ongoing service outages to a ransomware incident that disrupted access to some internal systems and online applications for its staff and customers. Impacted services included multi-factor authentication (MFA), account SSO (Single Sign-On), the MathW

Topics: attackers breach gang mathworks ransomware

Shop Amazon

Claude for Chrome

news.ycombinator.com Unknown 2025-10-24 23:01:56

We've spent recent months connecting Claude to your calendar, documents, and many other pieces of software. The next logical step is letting Claude work directly in your browser. We view browser-using AI as inevitable: so much work happens in browsers that giving Claude the ability to see what you're looking at, click buttons, and fill forms will make it substantially more useful. But browser-using AI brings safety and security challenges that need stronger safeguards. Getting real-world feedb

Topics: attack browser chrome claude safety

Shop Amazon

Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks

bleepingcomputer.com Unknown 2025-10-25 04:12:53

Hackers breached sales automation platform Salesloft to steal OAuth and refresh tokens from its Drift chat agent integration with Salesforce to pivot to customer environments and exfiltrate data. The ShinyHunters extortion group claims responsibility for these additional Salesforce attacks. Salesloft's SalesDrift is a third-party platform that connects the Drift AI chat agent with a Salesforce instance, allowing organizations to sync conversations, leads, and support cases into their CRM. Acc

Topics: access attacks data salesforce threat

Shop Amazon

Latest Tech News

From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques

DataTables CDN Outage – post incident review

Self-propagating supply chain attack hits 187 npm packages

Self-Replicating Worm Hits 180+ Software Packages

One Vigilante, 22 Cell Tower Fires, and a World of Conspiracies

One Vigilante, 22 Cell Towers, and a World of Conspiracies

The first three things you’ll want during a cyberattack

Apple warns customers targeted in recent spyware attacks

DDoS defender targeted in 1.5 Bpps denial-of-service attack

After Ukrainian testing, drone detection radar doubles range with simple software patch

Hackers left empty-handed after massive NPM supply-chain attack

Jaguar Land Rover confirms data theft after recent cyberattack

An attacker’s blunder gave us a look into their operations

US charges admin of LockerGoga, MegaCortex, Nefilim ransomware

How An Attacker's Blunder Gave Us a Rare Look Inside Their Day-to-Day Operations

Get This Item to Make Hollow Knight: Silksong Much Easier

Some Heart Attacks Might Be Triggered by Germs

Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack

AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack

6 browser-based attacks all security teams should be ready for in 2025

They know where you are: Cybersecurity and the shadow world of geolocation

Cloudflare stops new world's largest DDoS attack over Labor Day weekend

This Common Heart Attack Drug May Actually Be Worthless for Most People

Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps

Pennsylvania AG Office says ransomware attack behind recent outage

Jaguar Land Rover production severely hit by cyber-attack

Zscaler data breach exposes customer info after Salesloft Drift compromise

MATLAB dev says ransomware gang stole data of 10,000 people

Claude for Chrome

Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks

About GoKawiil

Privacy

Advertising

Latest Tech News

Trending Topics

Hot Now

Popular

Emerging

About GoKawiil

Privacy

Advertising