TheNde
Sicurezza· · 2 min

Rising Malware Threats.

Today’s cybersecurity news is buzzing with fresh threats and vulnerabilities. From malware that bypasses Chrome's security to phishing attacks using Microsoft Azure alerts, it's clear that attackers are getting creative. Staying informed is more critical than ever.

In breve
  1. Rising Malware Threats
  2. Phishing Campaigns Escalate
  3. Critical Vulnerabilities Demand Attention
01 · Sicurezza

Rising Malware Threats

Chrome's security under threat from new malware.
Chrome's security under threat from new malware.

VoidStealer malware has found a sneaky way to plunder Chrome’s master key, using a debugger trick that bypasses Chrome's Application-Bound Encryption. This is a significant leap in infostealer capabilities, allowing attackers to access sensitive browser data without complex methods.

Meanwhile, the Trivy vulnerability scanner was hit hard in a supply-chain attack. The breach allowed hackers to distribute credential-stealing malware through GitHub Actions, compromising many developers who rely on this tool. As attacks like these grow, the importance of robust security measures cannot be overstated.

02 · Sicurezza

Phishing Campaigns Escalate

Phishing attacks are evolving to target popular messaging platforms.
Phishing attacks are evolving to target popular messaging platforms.

The FBI has issued a warning about Russian hackers targeting apps like Signal and WhatsApp with mass phishing attacks. These campaigns are becoming increasingly sophisticated, exploiting user trust to steal sensitive information.

Additionally, Microsoft Azure Monitor alerts are being misused in callback phishing scams. Attackers impersonate official alerts, tricking users into calling fraudulent numbers under the guise of security warnings. This highlights the need for vigilance even in trusted services.

03 · Sicurezza

Critical Vulnerabilities Demand Attention

Oracle's critical patch highlights the urgency of security updates.
Oracle's critical patch highlights the urgency of security updates.

Oracle has patched a critical RCE vulnerability in its Identity Manager that could allow unauthenticated attackers to execute remote code. Organizations must act quickly to implement this patch to avoid potential breaches.

Also, CISA has flagged vulnerabilities in Apple and Laravel, mandating patches by April 3. Timely updates are essential to maintain security in the face of increasing threats.

Numeri chiave
$442 billion

Estimated losses from malware infections last year, underscoring the urgency of improved security measures.

Fonte
47 npm Packages

The number of packages affected by the Trivy supply chain attack, highlighting the widespread impact of such vulnerabilities.

Fonte
In primo piano
BleepingComputer

VoidStealer malware steals Chrome master key via debugger trick

VoidStealer is innovating by bypassing Chrome's Application-Bound Encryption. This malware extracts sensitive data directly from the browser's memory, raising alarms about browser security.

The Hacker News

FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks

The FBI is alerting users to a targeted phishing campaign by Russian hackers against popular messaging platforms. Users should exercise caution and verify communications.

Link rapidi
  1. Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm PackagesA supply chain attack compromised Trivy, spreading malware across numerous npm packages. — The Hacker News
  2. CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026CISA has identified critical vulnerabilities in popular platforms, mandating patches to enhance security. — The Hacker News
  3. Microsoft Azure Monitor alerts abused for callback phishing attacksPhishing campaigns are exploiting Azure Monitor alerts to trick users into revealing personal information. — BleepingComputer
  4. Critical Quest KACE Vulnerability Potentially Exploited in AttacksExploitation of a critical vulnerability in Quest KACE is being actively investigated by security firms. — SecurityWeek
  5. Google adds ‘Advanced Flow’ for safe APK sideloading on AndroidGoogle's new APK sideloading process aims to enhance security for power users. — BleepingComputer