GBHackers on Security | #1 Globally Trusted Cyber Security News Platform

Network penetration testing is a cybersecurity practice that simulates cyberattacks on an organization’s network to identify vulnerabilities and improve security defenses. Ethical hackers, or penetration testers, use tools and techniques to mimic real-world hacking attempts, targeting network components like routers, firewalls, servers, and endpoints. The goal is to uncover weaknesses before malicious actors exploit them, […]

The post Network Penetration Testing Checklist – 2025 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

At the upcoming Black Hat Asia 2025 conference, cybersecurity experts will unveil a groundbreaking vulnerability in modern dashcam technology, exposing how hackers can exploit these devices to breach privacy and steal sensitive data. The session, titled DriveThru Car Hacking: Fast Food, Faster Data Breach, will be held on April 3, 2025, at Marina Bay Sands, […]

The post Hackers can Crack Into Car Cameras Within Minutes Exploiting Vulnerabilities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Belgium’s State Security Service (VSSE) has suffered what is being described as its most severe security breach to date. For nearly two years, a group of Chinese hackers exploited a vulnerability in Barracuda’s Email Security Gateway Appliance, a cybersecurity tool used by the VSSE, to access approximately 10% of the agency’s email traffic. The breach, […]

The post Chinese Hackers Breach Belgium State Security Service as Investigation Continues appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hacktivism, once synonymous with symbolic website defacements and distributed denial-of-service (DDoS) attacks, has evolved into a sophisticated tool for cyber warfare and influence operations. Recent research highlights how state-sponsored actors are increasingly leveraging hacktivist tactics to conduct large-scale cyber campaigns, blurring the lines between grassroots activism and government-directed operations. These groups, often cloaked in anonymity […]

The post Hacktivist Groups Emerge With Powerful Tools for Large-Scale Cyber Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Multi-factor authentication (MFA), long considered a cornerstone of cybersecurity defense, is facing a formidable new threat: “Pass-the-Cookie” attacks. Recent findings reveal from Long Wall shows that threat actors exploit browser session cookies to bypass MFA entirely, granting full access to corporate accounts without requiring passwords or authentication tokens. This technique poses a significant risk to organizations […]

The post New Pass-the-Cookie Attacks Bypass MFA, Giving Hackers Full Account Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated cyberespionage campaign linked to Chinese state-sponsored actors has exploited a previously patched Check Point VPN vulnerability (CVE-2024-24919) to infiltrate organizations across Europe, Africa, and the Americas, according to cybersecurity researchers. The attacks, observed between June 2024 and January 2025, primarily targeted the manufacturing sector, deploying ShadowPad malware and, in limited cases, the NailaoLocker […]

The post Chinese Hackers Exploit Check Point VPN Zero-Day to Target Organizations Globally appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A critical security flaw (CVE-2025-20059) has been identified in supported versions of Ping Identity’s PingAM Java Agent, potentially enabling attackers to bypass policy enforcement and access protected resources. The vulnerability—classified as a Relative Path Traversal (CWE-23) weakness—affects all PingAM Java Agent deployments integrated with PingOne Advanced Identity Cloud, prompting urgent calls for remediation. Vulnerability Scope and Severity […]

The post PingAM Java Agent Vulnerability Allows Attackers to Bypass Security appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sophisticated malware campaign leveraging GitHub repositories disguised as game modifications and cracked software has been uncovered, exposing a dangerous convergence of social engineering tactics and automated credential harvesting. Security researchers identified over 1,100 malicious repositories distributing variants of the Redox stealer, a Python-based malware designed to exfiltrate sensitive data including cryptocurrency wallet keys, browser cookies, […]

The post New GitHub Scam Uses Fake “Mods” and “Cracks” to Steal User Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Netskope Threat Labs uncovered a sprawling phishing operation involving 260 domains hosting approximately 5,000 malicious PDF files. These documents, disguised as legitimate resources, employ fake CAPTCHA prompts to redirect victims to phishing sites designed to harvest credit card details and personal information. The campaign, active since the second half of 2024, has impacted over 1,150 […]

The post 260 Domains Hosting 5,000 Malicious PDFs to Steal Credit Card Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new wave of cyberattacks leveraging the Winos4.0 malware framework has targeted organizations in Taiwan through malicious PDF attachments disguised as tax inspection alerts, according to a January 2025 threat analysis by FortiGuard Labs.  The campaign employs multi-stage payload delivery, anti-forensic techniques, and automated security bypass mechanisms to establish persistent access to victim networks while […]

The post Winos4.0 Malware Targets Windows Users Through Malicious PDF Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A sweeping analysis of the Common Crawl dataset—a cornerstone of training data for large language models (LLMs) like DeepSeek—has uncovered 11,908 live API keys, passwords, and credentials embedded in publicly accessible web pages.  The leaked secrets, which authenticate successfully with services ranging from AWS to Slack and Mailchimp, highlight systemic risks in AI development pipelines […]

The post DeepSeek Data Leak Exposes 12,000 Hardcoded API Keys and Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The Lotus Blossom hacker group, also known as Spring Dragon, Billbug, or Thrip, has been identified leveraging legitimate cloud services like Dropbox, Twitter, and Zimbra for command-and-control (C2) communications in their cyber espionage campaigns. Cisco Talos researchers attribute these sophisticated operations to the group with high confidence, citing the use of a custom backdoor family […]

The post Lotus Blossom Hacker Group Uses Dropbox, Twitter, and Zimbra for C2 Communications appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A newly identified malware, dubbed “Squidoor,” has emerged as a sophisticated threat targeting government, defense, telecommunications, education, and aviation sectors in Southeast Asia and South America. Attributed to a suspected Chinese threat actor under the activity cluster CL-STA-0049, Squidoor employs advanced techniques to infiltrate networks, maintain persistence, and exfiltrate sensitive data. This modular backdoor is […]

The post Squidoor: Multi-Vector Malware Exploiting Outlook API, DNS & ICMP Tunneling for C2 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Cyber adversaries have evolved into highly organized and professional entities, mirroring the operational efficiency of legitimate businesses, according to the CrowdStrike 2025 Global Threat Report. The report highlights a significant shift in the cyber threat landscape during 2024, with attackers employing advanced tactics and leveraging emerging technologies such as generative artificial intelligence (GenAI) to scale […]

The post Unpatched Vulnerabilities Attract Cybercriminals as EDR Visibility Remains Limited appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

In Q3 2024, Cofense Intelligence uncovered a targeted spear-phishing campaign aimed at employees working in social media, marketing, and related roles. The attackers impersonated Fortune 500 companies, including Meta, Coca-Cola, and PayPal, to lure victims into applying for fake job opportunities as social media managers. Unlike traditional credential phishing campaigns, this operation also exfiltrated sensitive […]

The post Threat Actors Attack Job Seekers of Fortune 500 Companies to Steal Personal Details appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

The DragonForce ransomware group has launched a significant cyberattack on critical infrastructure in Saudi Arabia, targeting a prominent real estate and construction company in Riyadh. This marks the first time the group has targeted a major enterprise in the Kingdom, with over 6 terabytes of sensitive data exfiltrated. The attack, announced on February 14, 2025, […]

The post DragonForce Attacks Critical Infrastructure to Exfiltrate Data and Halt Operations appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

In a concerning development, cybersecurity researchers at Trellix have uncovered a sophisticated malware campaign that exploits a legitimate antivirus driver to bypass system protections. The malware, identified as “kill-floor.exe,” leverages the Avast Anti-Rootkit driver (aswArPot.sys) to gain kernel-level access, effectively neutralizing security software and taking control of infected systems. This tactic highlights the growing trend […]

The post New Malware Uses Legitimate Antivirus Driver to Bypass All System Protections appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Microsoft has removed two widely-used Visual Studio Code (VS Code) extensions, “Material Theme Free” and “Material Theme Icons Free,” from its marketplace after cybersecurity researchers discovered malicious code embedded within them. These extensions, developed by Mattia Astorino (also known as equinusocio), had amassed nearly 9 million installations combined, with Astorino’s total extension downloads exceeding 13 […]

The post VS Code Extension with 9 Million Installs Attacks Developers with Malicious Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new ransomware group, dubbed Anubis, has emerged as a significant threat in the cybersecurity landscape. Active since late 2024, Anubis employs advanced techniques and operates across multiple platforms, including Windows, Linux, NAS, and ESXi environments. The group is leveraging ransomware-as-a-service (RaaS) and other affiliate-based monetization models to expand its reach and impact. Technical Capabilities […]

The post New Anubis Ransomware Targets Windows, Linux, NAS, and ESXi x64/x32 Environments appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A new wave of cyberattacks targeting WordPress websites has been uncovered, with attackers leveraging fake plugins to inject malicious links into site footers. These links, often promoting casino-related spam, compromise website integrity and can severely impact search engine optimization (SEO). The attackers use sophisticated techniques to disguise their malicious plugins, making detection and removal challenging […]

The post WordPress Admins Warned of Fake Plugins Injecting Malicious Links into Websites appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.