Aggregator

该文章解释了错误代码521的含义及其对网络连接的影响，并提供了可能的解决方案以帮助用户解决问题。

HackerNews 编译，转载请注明出处： 网络安全研究人员发现，近期出现大量冒充微软、DocuSign等知名品牌的钓鱼邮件，其附件PDF中包含恶意二维码或链接，诱导受害者拨打攻击者控制的电话。这种新型攻击手法被称为“电话导向攻击投递”（Telephone-Oriented Attack Delivery，简称TOAD，也称“回拨式钓鱼”）。 思科Talos研究员Omid Mirzaei向The Hacker News透露，2025年5月5日至6月5日期间的分析显示，微软和DocuSign是PDF附件钓鱼邮件中最常被冒充的品牌，而NortonLifeLock、PayPal和Geek Squad也频繁出现在此类攻击中。 这些攻击利用用户对知名品牌的信任，通过PDF附件嵌入看似合法的二维码或链接，将受害者重定向至伪造的微软登录页面或Dropbox等服务的钓鱼网站。部分攻击甚至利用PDF注释功能隐藏恶意URL，伪装成便签、评论或表单字段，同时链接到真实网页以增强可信度。 在TOAD攻击中，受害者会被诱导拨打邮件中的“客服电话”，攻击者则冒充品牌客服代表，诱骗受害者泄露敏感信息或安装恶意软件。攻击者通常通过伪造紧迫感、播放虚假等待音乐、甚至伪造来电显示等手段，增强欺骗效果。 美国联邦调查局（FBI）2025年5月曾警告，一个名为“Luna Moth”的金融犯罪集团利用类似手法，冒充IT部门人员入侵企业网络。Mirzaei指出：“攻击者通过语音通话直接操控受害者情绪，利用人们对电话沟通的天然信任实施社会工程学攻击。” 大多数攻击者使用VoIP号码隐藏身份，部分号码甚至连续使用四天，以便通过同一号码实施多阶段社会工程学攻击。思科Talos强调：“品牌冒充是最常见的社会工程学手段之一，建立品牌冒充检测引擎对防御此类攻击至关重要。” 近期，攻击者还利用微软365（M365）的“Direct Send”功能发送钓鱼邮件。该功能允许攻击者无需入侵账户，即可伪造内部用户身份发送邮件。自2025年5月以来，已有超过70家组织成为此类攻击的目标。 这些伪造邮件不仅看似来自组织内部，还利用智能主机地址的可预测性（如“<tenant_name>.mail.protection.outlook.com”）绕过身份验证。攻击者有时会诱导受害者安装AnyDesk或TeamViewer等远程控制软件，或通过伪造支付页面窃取信用卡信息。 例如，2025年6月17日的一封钓鱼邮件伪装成语音邮件通知，附件PDF中的二维码指向伪造的微软365登录页面。安全研究员Tom Barnea指出：“攻击者利用M365 Direct Send功能发送内部邮件，这类邮件比外部邮件更容易绕过审查，成为低门槛的钓鱼载体。” 与此同时，Netcraft的最新研究发现，当用户向大型语言模型（LLM）询问50个不同品牌的登录网址时，模型有三分之一的时间会返回错误结果：近30%的域名未注册或闲置，5%指向完全无关的网站。这意味着用户可能因AI聊天机器人的错误引导而访问钓鱼网站。 Netcraft还发现，攻击者试图通过GitHub发布包含恶意功能的虚假API来“污染”AI编程助手（如Cursor）。安全研究员Bilaal Rashid表示：“攻击者不仅发布代码，还创建博客教程、论坛问答和数十个GitHub仓库进行推广。他们使用精心设计的虚假账户，伪装成可信开发者，诱导AI训练模型收录恶意代码。” 此外，攻击者还通过名为“Hacklink”的非法市场，向被入侵的政府（.gov）或教育（.edu）网站注入JavaScript或HTML代码，操纵搜索引擎优先展示钓鱼网站。安全研究员Andrew Sebborn解释：“Hacklink允许犯罪分子购买数千个被入侵网站的权限，插入指向钓鱼或非法网站的链接。这些链接与特定关键词关联，当用户搜索相关内容时，被入侵网站会出现在搜索结果中。” 更令人担忧的是，攻击者无需完全控制网站，即可篡改搜索结果中的文本内容，进一步损害品牌信誉和用户信任。     消息来源： thehackernews ； 本文由 HackerNews.cc 翻译整理，封面来源于网络； 转载请注明“转自 HackerNews.cc”并附上原文

A vulnerability has been found in Google Chrome 127.x/128.x and classified as problematic. Affected by this vulnerability is an unknown functionality of the component AppBound Cookie Encryption. The manipulation leads to information exposure through discrepancy. This vulnerability is known as CVE-2025-34091. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Chrome 127.x/128.x. It has been declared as problematic. This vulnerability affects unknown code of the component Inter-Process Communication. The manipulation leads to untrusted search path. This vulnerability was named CVE-2025-34090. An attack has to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

文章介绍了网络威胁分析和安全建议，由值班处理员Johannes Ullrich负责，当前威胁级别为绿色。还提供了即将举行的网络应用安全课程信息及相关的网络安全资源链接。

Cybersecurity Awareness Programs Need Focus on Human Risk and Changing Behaviors
Thanks to Cybersecurity Awareness Month, everyone knows security is a priority, but what are we doing differently to change the culture? If our goal is to reduce risk - and not just to meet regulatory expectations - then we need to focus on behavior, not just boxes on a checklist.

23andMe's Ex-CEO Anne Wojcicki Made Privacy Pledge With Successful Bid of $305M
A bankruptcy court gave the green light for TTAM Research Institute - a firm launched by 23andMe's co-founder and former CEO Anne Wojcicki - to buy 23andMe for $305 million. TTAM has promised to uphold the consumer genetics testing firm's current privacy policies and implement more data safeguards.

Google’s Mandiant Warns About Remote Attacks Disrupting Grid Stability
Vulnerabilities in networked devices programmed to instantaneously trip power grid substation circuit breakers could be the means hackers use to cause the next blackout, warn researchers. There are "systemic patterns across substations, utilities and industrial sites worldwide," Mandiant warned.

Iranian-Linked Hackers Claim to Have 100GB of Emails From Trump's Inner Circle
An Iranian hacking group collectively using the pseudonym "Robert" claims to have 100 gigabytes of emails from President Donald Trump's inner circle as Tehran seemingly attempts to project strength in cyberspace in the wake of U.S.-led attacks on three of its key nuclear sites.

Hackers Targeted French Government Entities, ANSSI Said
A hacking campaign linked to Chinese threat actors chained zero-days in Ivanti server software to target French government, defense and media entities, the national cyber agency said. The hacker has similarities to a Chinese threat actor tracked as UNC5174.

Cybersecurity Awareness Programs Need Focus on Human Risk and Changing Behaviors
Thanks to Cybersecurity Awareness Month, everyone knows security is a priority, but what are we doing differently to change the culture? If our goal is to reduce risk - and not just to meet regulatory expectations - then we need to focus on behavior, not just boxes on a checklist.

23andMe's Ex-CEO Anne Wojcicki Made Privacy Pledge With Successful Bid of $305M
A bankruptcy court gave the green light for TTAM Research Institute - a firm launched by 23andMe's co-founder and former CEO Anne Wojcicki - to buy 23andMe for $305 million. TTAM has promised to uphold the consumer genetics testing firm's current privacy policies and implement more data safeguards.

Google’s Mandiant Warns About Remote Attacks Disrupting Grid Stability
Vulnerabilities in networked devices programmed to instantaneously trip power grid substation circuit breakers could be the means hackers use to cause the next blackout, researchers warn. There are "systemic patterns across substations, utilities and industrial sites worldwide," Mandiant warned.

Iranian-Linked Hackers Claim to Have 100GB of Emails From Trump's Inner Circle
An Iranian hacking group collectively using the pseudonym "Robert" claims to have 100 gigabytes of emails from President Donald Trump's inner circle as Tehran seemingly attempts to project strength in cyberspace in the wake of U.S.-led attacks on three of its key nuclear sites.

Hackers Targeted French Government Entities, ANSSI Said
A hacking campaign linked to Chinese threat actors chained zero-days in Ivanti server software to target French government, defense and media entities, the national cyber agency said. The hacker has similarities to a Chinese threat actor tracked as UNC5174.

腾讯云安全基于20余年攻防经验，打造覆盖情报共享、应用的全链路方案，发布《基于威胁情报原子能力的安全产品开发应用实践》，力图打破数据孤岛，释放情报价值，推动安全产品迭代与安全体系效能升级。

微软介绍最年轻安全研究员迪伦，13岁起向微软提交漏洞。为接纳他，微软修改漏洞赏金计划条款至最低13岁。迪伦多次提交漏洞报告，并在黑客活动中获奖。现为高三学生，未来或继续从事网络安全工作。

德国要求苹果和谷歌下架中国AI应用DeepSeek，因其涉嫌违反欧盟GDPR并将数据传输至中国。此事件被视为欧盟AI监管落地的首例，凸显中欧在数据主权、隐私保护和技术竞争上的深层博弈。