Researchers have uncovered the AndroxGh0st malware, which targets Laravel applications to steal sensitive data from .env files, compromising AWS, SendGrid, and Twilio credentials.

Learn more: https://thehackernews.com/2024/03/androxgh0st-malware-targets-laravel.html

Struggling to manage endless vendor risk assessments in a world overrun by SaaS apps?

Learn how to streamline and accelerate your security reviews to boost security, save time, and align with business objectives.

https://thehackernews.com/2024/03/how-to-accelerate-vendor-risk.html

🚨 New report reveals 800+ packages in the npm registry contain hidden code discrepancies. 18 packages found intentionally exploiting a vulnerability known as "manifest confusion."

Read: https://thehackernews.com/2024/03/over-800-npm-packages-found-with.html

Russia-linked cyber threat group Turla has infected systems of a European NGO, deploying a backdoor called TinyTurla-NG to steal sensitive data.

Learn more: https://thehackernews.com/2024/03/russia-hackers-using-tinyturla-ng-to.html

🚨 Researchers uncover AcidPour malware attacks targeting Ukraine telecoms, a variant linked to Russian military intelligence & AcidRain malware. AcidPour aims to disable devices & cripple critical communications.

Read: https://thehackernews.com/2024/03/russian-hackers-target-ukrainian.html

🔐 U.S. Department of Justice and 16 state Attorneys General have filed a lawsuit against Apple, accusing it of hiding behind claims of 'privacy' and 'security' to justify anticompetitive behavior.

Read details here: https://thehackernews.com/2024/03/us-justice-department-sues-apple-over.html

China-linked threat group aggressively exploits software flaws in ConnectWise ScreenConnect and F5 BIG-IP to breach networks of research institutions, NGOs, and governments in Southeast Asia, the US, and the UK.

Learn more: https://thehackernews.com/2024/03/china-linked-group-breaches-networks.html

🚨 ALERT - Massive "Sign1" malware campaign has infected over 39,000 WordPress websites, redirecting unsuspecting users to scam sites through malicious JavaScript injections.

Learn more: https://thehackernews.com/2024/03/massive-sign1-campaign-infects-39000.html

Critical security flaw patched in Amazon's Managed Workflows for Apache Airflow (MWAA). Vulnerability dubbed 'FlowFixation' could have enabled account hijacking and remote code execution.

Read details: https://thehackernews.com/2024/03/aws-patches-critical-flowfixation-bug.html

⚠️ Researchers uncover a new wave of phishing attacks delivering StrelaStealer malware, impacting over 100 organizations in the E.U. and U.S.

Read details: https://thehackernews.com/2024/03/new-strelastealer-phishing-attacks-hit.html

🔒 Elevate your cybersecurity game with ThreatLocker Zero Trust Endpoint Protection Platform. A deny-by-default approach ensures you're shielded from zero-days, malware, and more.

Learn more: https://thehackernews.com/2024/03/implementing-zero-trust-controls-for.html

Mandiant connects WINELOADER backdoor to Midnight Blizzard, a Russian SVR-linked hacking group. Malware targeted German political parties with wine-tasting phishing scams.

Read more: https://thehackernews.com/2024/03/russian-hackers-use-wineloader-malware.html

🛑 German authorities dismantle Nemesis Market, a major darknet marketplace that facilitated the global trade of drugs, stolen data, and cybercrime services.

Learn more: https://thehackernews.com/2024/03/german-police-seize-nemesis-market-in.html

North Korea-linked Kimsuky threat group expands its arsenal, now using CHM files to deliver malware designed to infiltrate systems and exfiltrate sensitive data globally.

Find details here: https://thehackernews.com/2024/03/n-korea-linked-kimsuky-shifts-to.html

⚠️ Iran-linked hackers, MuddyWater, launch new phishing attacks against Israeli organizations. Group hijacks legitimate remote management software in latest campaign.

Learn more: https://thehackernews.com/2024/03/iran-linked-muddywater-deploys-atera.html

🚨 Researchers uncover "GoFetch" vulnerability in Apple M-series chips, potentially allowing attackers to extract secret cryptographic keys.

Learn more: https://thehackernews.com/2024/03/new-gofetch-vulnerability-in-apple-m.html

Researchers uncover a clever cyber attack involving stolen browser cookies & malicious code in Python packages. Topgg's GitHub account among the targets. Beware of rogue dependencies!

Read: https://thehackernews.com/2024/03/hackers-hijack-github-accounts-in.html

🚨 CISA adds 3 security flaws to its KEV catalog due to active exploitation. Flaws include severe vulnerabilities in Fortinet, Ivanti, and Nice systems.

Agencies must apply fixes by April 15, 2024.

Learn more: https://thehackernews.com/2024/03/cisa-alerts-on-active-exploitation-of.html

🚨 U.S. Treasury sanctions three cryptocurrency exchanges: Bitpapa, Crypto Explorer, and TOEP. These exchanges allegedly helped Russia evade sanctions imposed after the Ukraine invasion.

Learn more: https://thehackernews.com/2024/03/us-sanctions-3-cryptocurrency-exchanges.html

U.S. Department of Justice indicts 7 Chinese nationals linked to hacking group APT31, implicated in cyber espionage targeting U.S. critics, journalists, officials, and businesses for over 14 years.

Learn more: https://thehackernews.com/2024/03/us-charges-7-chinese-nationals-in-major.html