A new attack technique called "Win-DDoS" can turn thousands of Windows domain controllers into a powerful DDoS botnet without compromising the devices.

A new "BadCam" attack can turn Lenovo webcams into a BadUSB device, allowing remote hackers to run malicious code and reinfect systems even after a wipe.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Eclypsium researchers have uncovered a new class of BadUSB attacks, which leverage critical flaws in Linux-based Lenovo webcams to deliver persistent payloads and bypass security.

A new "EPM poisoning" attack bypasses Windows security by hijacking the RPC protocol, allowing an unprivileged user to escalate privileges and steal NTLM hashes.

A new book reveals critical vulnerabilities in Google's Privacy Sandbox, showing how its new APIs could be exploited to harvest user data.

A new "DOM-based extension clickjacking" vulnerability discovered at DEF CON allows attackers to steal passwords and 2FA codes from popular password managers.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Presented at DEF CON 33, GroupPolicyBackdoor is a Python framework for stealthy GPO manipulation, link poisoning, and AD privilege escalation.

TL;DR Two Accenture researchers showed that plugging a USB device into Windows can hand an attacker SYSTEM. The chain needs no admin rights and no logged-in user. Both the vulnerability details an…