Rockstar2FA is a PaaS kit that mimics the legitimate credential-request behavior of cloud/SaaS platforms. Phishing campaigns are delivered via Telegram and use unique URLs to route users to credential-capturing counterfeit login pages. These pages masquerade as popular services and steal…
Category: GBHackers Security | #1 Globally Trusted Cyber Security News Platform
PoC Exploit Released for Ivanti Connect Secure RCE Vulnerability
A serious security flaw has been identified in Ivanti Connect Secure, designated as CVE-2025-0282, which enables remote unauthenticated attackers to execute arbitrary code. As of January 8, 2025, Ivanti has acknowledged the existence of this stack-based buffer overflow vulnerability found in…
Bug Bounty Bonanza: $40,000 Reward for Escalating Limited Path Traversal to RCE
As a dedicated bug bounty hunter with an enviable track record on BugCrowd, Abdullah Nawaf, Full full-time bug Bounty Hunter, thrives on the thrill of discovery and the challenge of finding high-impact vulnerabilities. Recently, alongside his colleague Orwa Atyat, they achieved…
Let’s Encrypt Unveils Six-Day Certificate and IP Address Options for 2025
Let’s Encrypt has announced plans to introduce six-day certificate options and support for IP address certificates in 2025. This initiative is part of the organization’s ongoing commitment to fortify the Web Public Key Infrastructure (PKI), making secure connections more accessible…
CISA Warns of Aviatrix Controllers OS Command Injection Vulnerability Exploited in Wild
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding a significant OS command injection vulnerability in Aviatrix Controllers, identified as CVE-2024-50603. This vulnerability poses a serious risk, as it allows unauthenticated attackers to execute arbitrary code on…
BitMEX Fined $100 Million for Violating Bank Secrecy Act
In a significant legal development, HDR Global Trading Ltd., operating under the name BitMEX, has been fined $100 million for violating the Bank Secrecy Act. Attorney for the United States, Matthew Podolsky, announced the sentencing on January 17, 2025, highlighting…
Hackers Deploy Web Shell To Abuse IIS Worker And Exfiltrate Data
An attacker exploited a vulnerability in the batchupload.aspx and email_settings.aspx pages on the target server that allowed them to upload a malicious web shell to the IIS worker process (w3wp.exe). They initially attempted to upload a web shell to another…
CISA Releases Guidelines For Closing Software Understanding Gap
The Cybersecurity and Infrastructure Security Agency (CISA) has released a pivotal report calling for urgent action to address the “software understanding gap.” This comprehensive document highlights the significant disparity between the rapid advancement in software production and the corresponding investment…
Russian Threat Actor “Star Blizzard” Exploit WhatsApp Accounts Using QR Codes
Microsoft Threat Intelligence has identified a concerning strategic shift by the notorious Russian threat actor group “Star Blizzard.” Known for its spear-phishing campaigns targeting government, diplomatic, and civil society sectors, the group has now expanded its tactics to compromise WhatsApp…
Hackers Exploiting California Wildfire Sparks to Launching Phishing Attacks
As California grapples with devastating wildfires, communities are rallying to protect lives and property. Unfortunately, these disasters have also created an opportunity for cybercriminals to exploit the chaos and uncertainty. Veriti Research has identified alarming trends in phishing scams linked…