GoKawiil
Tech News
N-able took its cloud-hosted N-Central offering offline to patch a wave of vulnerabilities publicly disclosed on GitHub by researcher Ben Bales, who called the flaw set Able2Shell. The company also urged customers running self-hosted N-Central deployments to shut them down, warning the published exploits could let attackers steal credentials, create admin accounts, or gain root access.
Arctic Wolf has documented a social-engineering campaign affecting more than 400 incidents in which attackers flood employees' inboxes with mail-bomb spam, then contact them via Microsoft Teams' external chat feature posing as IT support. Victims are talked into granting remote access through tools like Quick Assist or AnyDesk, after which attackers move from recon to credential theft, lateral movement and payload execution in under 15 minutes.
A threat actor group calling itself "BYOD" published records for 3,615 Trump Mobile customer accounts on the dark web, including names, emails, phone numbers, home addresses and order histories. The group says it broke in via a remote access trojan placed on an employee device at Liberty Mobile, the MVNO that powers Trump Mobile's network, and the leak reportedly includes personal details of Trump Organization CIO Eric Brunnett.
Security researchers at Flare identified a ClickFix social-engineering campaign distributing the CrocoRat remote access Trojan and cryptocurrency stealer via a misspelled domain showing a fake house-wiring image. Instead of fetching malware directly, the pasted PowerShell command queries an attacker-controlled DNS TXT record, which returns instructions for the next stage of the attack.
A cybersecurity incident has potentially compromised the personal information of 3,615 individuals linked to Trump Mobile, including names, addresses, emails, and phone numbers. The breach was claimed by the hacking group BYOD, which reportedly gained access through a remote access trojan on a Liberty Mobile employee and also accessed Trump Mobile’s website backend. Some affected individuals may not have fully registered with the service, yet their data was still exposed.
Fortinet's FortiGuard Labs identified a new variant of the SectopRAT remote access Trojan concealed within legitimate digital-audio software from an Italian company. Researcher Xiaopeng Zhang said attackers modified the FrameworkBase.dll file after the software was already installed on victim machines, secretly loading the SectopRAT payload rather than compromising the vendor itself.
Security researchers at SafeDep discovered that a malicious npm package called mathmain, disguised as a copy of the popular mathjs library, contains a hidden remote access implant. The malicious code stays encrypted and dormant until a specific equation is solved using the library's lusolve() solver function, which acts as a decryption key to unlock and execute the payload.
Cybersecurity agencies from Japan, the US, Australia and Germany issued a joint advisory identifying North Korea's WaterPlum group as the actor behind malware hidden in fake job application coding tests. The scheme has infected over 30,000 devices across 100 countries and compromised more than 7,000 crypto wallets, netting $10.71 million believed to fund the North Korean government.
A malware-as-a-service platform called VectraRAT is being sold on underground markets for roughly $250 monthly, giving buyers a Windows-based remote access implant, command-and-control infrastructure, and a management panel. The package effectively bundles everything needed to compromise and control enterprise Windows systems without requiring technical expertise from the attacker.
Attackers are exploiting a chain of legitimate Google services, including redirect links, to disguise malicious URLs and slip past email security filters. Victims who follow the multi-hop links are directed either to credential-harvesting phishing pages or prompted to install ScreenConnect remote access software.
ConnectWise disclosed a new security flaw in its ScreenConnect remote access platform affecting file transfer behavior in both cloud and on-premises deployments. The vulnerability has no CVE identifier yet and no official patch, though the company says a fix is coming later this week. In the meantime, ConnectWise published manual mitigation steps requiring administrators to disable file transfer permissions across user roles.