TheNde
Security· · 1 min

Malware Mayhem.

Cybersecurity is heating up with a string of vulnerabilities and malware attacks making headlines. From malware hitting Ukrainian devices to critical flaws in popular software, the landscape is shifting. Today’s news is a wake-up call for everyone in the digital space.

In brief
  1. Malware Mayhem
  2. Critical Vulnerabilities on the Rise
  3. Software Security Updates Needed
01 · Security

Malware Mayhem

ClickFix CAPTCHA malware tactic
ClickFix CAPTCHA malware tactic

UAC-0145 is targeting Ukrainian devices with a sneaky ClickFix CAPTCHA method to deliver malware. This tactic highlights the evolving strategies cybercriminals use to exploit vulnerabilities.

Meanwhile, Microsoft is raising alarms over ACR Stealer malware. It’s stealing sensitive data from enterprise customers, using deceptive social engineering tactics to pounce on unsuspecting users.

02 · Security

Critical Vulnerabilities on the Rise

Critical NGINX vulnerability
Critical NGINX vulnerability

A critical vulnerability in NGINX could crash workers and potentially allow remote code execution. If you’re using NGINX, it’s time to patch up and secure those servers.

Also, WordPress is facing severe risks with its newly discovered 'wp2shell' RCE flaws. Public exploits are now available, making immediate updates essential to avoid getting owned.

03 · Security

Software Security Updates Needed

7-Zip fixes critical RCE flaw
7-Zip fixes critical RCE flaw

7-Zip has rolled out a patch to fix a remote code execution flaw that could be exploited via malicious archives. If you’re using 7-Zip, don’t wait – update now to avoid potential exploits.

SonicWall's SMA has also been compromised by zero-day vulnerabilities. Attackers exploited these flaws before they were even disclosed, showcasing a critical need for security vigilance.

Key numbers
500 million

Over 500 million websites use WordPress, making the recent RCE flaws particularly concerning.

Source
30

More than 30 age assurance laws are now in force worldwide, pushing companies to rethink verification methods.

Source
3

7-Zip's latest version fixes three critical vulnerabilities, highlighting the importance of regular updates.

Source
Top stories
Bleeping Computer

Hackers Abuse ViPNet Software Targeting Russian Agencies

Advanced threat actors are exploiting ViPNet software to target Russian government agencies. This campaign, dubbed HelloNet, has been active since May and is deploying malware through the software's update mechanism.

Bleeping Computer

Microsoft Warns of Surge in ACR Stealer Attacks

Microsoft has detected a spike in ACR Stealer attacks leveraging social engineering tactics. This malware targets browser-stored credentials and sensitive documents – a major risk for enterprises.

Quick links
  1. Critical NGINX Vulnerability Can Crash WorkersA new critical flaw in NGINX could cause crashes and allow remote code execution. — The Hacker News
  2. SonicWall SMA Zero-Days ExploitedZero-day vulnerabilities in SonicWall's SMA have been exploited before their disclosure. — The Hacker News
  3. WordPress Core 'wp2shell' RCE Flaws ExposedCritical RCE vulnerabilities in WordPress Core have public exploits; patch immediately. — Bleeping Computer
  4. Age Verification Faces New ChallengesWith age verification laws on the rise globally, innovative methods are emerging to comply. — Bleeping Computer
  5. Hackers Target Russian Agencies with ViPNet SoftwareA malicious campaign is abusing ViPNet software to target Russian government organizations. — Bleeping Computer