#1 Trusted Cybersecurity News Platform
Followed by 5.20+ million
The Hacker News Logo
Subscribe – Get Latest News
AWS EKS Security Best Practices

The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

AI-Powered Deception is a Menace to Our Societies

AI-Powered Deception is a Menace to Our Societies

Feb 21, 2025 Disinformation / Artificial Intelligence
Wherever there's been conflict in the world, propaganda has never been far away. Travel back in time to 515 BC and read the Behistun Inscription, an autobiography by Persian King Darius that discusses his rise to power. More recently, see how different newspapers report on wars, where it's said, 'The first casualty is the truth.'  While these forms of communication could shape people's beliefs, they also carry limitations around scalability. Any messaging and propaganda would often lose its power after traveling a certain distance. Of course, with social media and the online world there are few physical limits on reach, apart from where someone's internet connection drops. Add in the rise of AI, and there's also nothing to stop the scalability either.  This article explores what this means for societies and organizations facing AI-powered information manipulation and deception. The rise of the echo chamber According to the Pew R...
Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks

Cisco Confirms Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks

Feb 21, 2025 Network Security / Vulnerability
Cisco has confirmed that a Chinese threat actor known as Salt Typhoon gained access by likely abusing a known security flaw tracked as CVE-2018-0171 , and by obtaining legitimate victim login credentials as part of a targeted campaign aimed at major U.S. telecommunications companies. "The threat actor then demonstrated their ability to persist in target environments across equipment from multiple vendors for extended periods, maintaining access in one instance for over three years," Cisco Talos said , describing the hackers as highly sophisticated and well-funded. "The long timeline of this campaign suggests a high degree of coordination, planning, and patience — standard hallmarks of advanced persistent threat (APT) and state-sponsored actors." The networking equipment major said it found no evidence that other known security bugs have been weaponized by the hacking crew, contrary to a recent report from Recorded Future that revealed exploitation attempts inv...
CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks

CISA Flags Craft CMS Vulnerability CVE-2025-23209 Amid Active Attacks

Feb 21, 2025 Web Security / Vulnerability
A high-severity security flaw impacting the Craft content management system (CMS) has been added by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to its Known Exploited Vulnerabilities ( KEV ) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2025-23209 (CVSS score: 8.1), which impacts Craft CMS versions 4 and 5. It was addressed by the project maintainers in late December 2024 in versions 4.13.8 and 5.5.8. "Craft CMS contains a code injection vulnerability that allows for remote code execution as vulnerable versions have compromised user security keys," the agency said. The vulnerability affects the following version of the software - >= 5.0.0-RC1, < 5.5.5 >= 4.0.0-RC1, < 4.13.8 In an advisory released on GitHub, Craft CMS noted that all unpatched versions of Craft with a compromised security key are impacted by the security defect. "If you can't update to a patched version, then rota...
cyber security

10 Best Practices for Building a Resilient, Always-On Compliance Program

websiteXM CyberCyber Resilience / Compliance
Download XM Cyber's handbook to learn 10 essential best practices for creating a robust, always-on compliance program.
cyber security

Find and Fix the Gaps in Your Security Tools

websitePrelude SecuritySecurity Control Validation
Connect your security tools for 14-days to find missing and misconfigured controls.
North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware

North Korean Hackers Target Freelance Developers in Job Scam to Deploy Malware

Feb 20, 2025 Malware / Cryptocurrency
Freelance software developers are the target of an ongoing campaign that leverages job interview-themed lures to deliver cross-platform malware families known as BeaverTail and InvisibleFerret. The activity, linked to North Korea, has been codenamed DeceptiveDevelopment, which overlaps with clusters tracked under the names Contagious Interview (aka CL-STA-0240 ), DEV#POPPER, Famous Chollima, PurpleBravo, and Tenacious Pungsan. The campaign has been ongoing since at least late 2023. "DeceptiveDevelopment targets freelance software developers through spear-phishing on job-hunting and freelancing sites, aiming to steal cryptocurrency wallets and login information from browsers and password managers," cybersecurity company ESET said in a report shared with The Hacker News. In November 2024, ESET confirmed to The Hacker News the overlaps between DeceptiveDevelopment and Contagious Interview, classifying it as a new Lazarus Group activity that operates with an aim to conduc...
DMARC for PCI DSS 4.0: A Good Practice for Securing Emails

DMARC for PCI DSS 4.0: A Good Practice for Securing Emails

Feb 20, 2025 Email Security / Fraud Prevention
PCI DSS 4.0 encourages the implementation of anti-phishing controls like DMARC! This highlights and reinforces the importance of preventative measures against email fraud, domain spoofing, and phishing in the financial space. While not a mandate or a requirement for PCI DSS compliance, DMARC and supporting email authentication technologies like SPF and DKIM play a pivotal role in protecting domain names against misuse.  Organizations can sign up for a DMARC analyzer trial to simplify their DMARC implementation, without the need for technical expertise. With more than 94% of organizations falling victim to phishing, this is the cue for businesses of all sizes to strengthen domain security and prevent the next big cyber attack. Many organizations turn to email authentication management solutions like PowerDMARC to simplify implementation, monitor authentication, and ensure continuous protection. On the flip side, it also presents a golden opportunity for MSPs to sell DMARC to th...
China-Linked Attackers Exploit Check Point Flaw to Deploy ShadowPad and Ransomware

China-Linked Attackers Exploit Check Point Flaw to Deploy ShadowPad and Ransomware

Feb 20, 2025 Ransomware / Vulnerability
A previously unknown threat activity cluster targeted European organizations, particularly those in the healthcare sector, to deploy PlugX and its successor, ShadowPad, with the intrusions ultimately leading to deployment of a ransomware called NailaoLocker in some cases. The campaign, codenamed Green Nailao by Orange Cyberdefense CERT, involved the exploitation of a now-patched security flaw in Check Point network gateway security products ( CVE-2024-24919 , CVSS score: 7.5). The attacks were observed between June and October 2024. "The campaign relied on DLL search-order hijacking to deploy ShadowPad and PlugX – two implants often associated with China-nexus targeted intrusions," the company said in a technical report shared with The Hacker News. The initial access afforded by exploitation of vulnerable Check Point instances is said to have allowed the threat actors to retrieve user credentials and to connect to the VPN using a legitimate account. In the next stage,...
Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

Cybercriminals Use Eclipse Jarsigner to Deploy XLoader Malware via ZIP Archives

Feb 20, 2025 Cybercrime / Malware
A malware campaign distributing the XLoader malware has been observed using the DLL side-loading technique by making use of a legitimate application associated with the Eclipse Foundation. "The legitimate application used in the attack, jarsigner, is a file created during the installation of the IDE package distributed by the Eclipse Foundation," the AhnLab SEcurity Intelligence Center (ASEC) said . "It is a tool for signing JAR (Java Archive) files." The South Korean cybersecurity firm said the malware is propagated in the form of a compressed ZIP archive that includes the legitimate executable as well as the DLLs that are sideloaded to launch the malware - Documents2012.exe, a renamed version of the legitimate jarsigner.exe binary, jli.dll, a DLL file that's modified by the threat actor to decrypt and inject concrt140e.dll, and concrt140e.dll, the XLoader payload The attack chain crosses over to the malicious phase when "Documents2012.exe...
Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now

Microsoft's End of Support for Exchange 2016 and 2019: What IT Teams Must Do Now

Feb 20, 2025 Microsoft 365 / Microsoft Exchange
For decades, Microsoft Exchange has been the backbone of business communications, powering emailing, scheduling and collaboration for organizations worldwide. Whether deployed on-premises or in hybrid environments, companies of all sizes rely on Exchange for seamless internal and external communication, often integrating it deeply with their workflows, compliance policies and security frameworks. However, Microsoft has officially announced that support for Exchange Server 2016 and Exchange Server 2019 will end on October 14, 2025. While this may seem like a distant concern, businesses and IT teams must start preparing now. The end of support means that Microsoft will no longer provide security patches, bug fixes or technical support, leaving organizations running on these versions exposed to security vulnerabilities, compliance risks and potential operational disruptions. So, what should businesses do now? In this article, we'll explore the impact of Microsoft's decision, the risks...
Citrix Releases Security Fix for NetScaler Console Privilege Escalation Vulnerability

Citrix Releases Security Fix for NetScaler Console Privilege Escalation Vulnerability

Feb 20, 2025 Vulnerability / IT Security
Citrix has released security updates for a high-severity security flaw impacting NetScaler Console (formerly NetScaler ADM) and NetScaler Agent that could lead to privilege escalation under certain conditions. The vulnerability, tracked as CVE-2024-12284 , has been given a CVSS v4 score of 8.8 out of a maximum of 10.0. It has been described as a case of improper privilege management that could result in authenticated privilege escalation if the NetScaler Console Agent is deployed and allows an attacker to execute post-compromise actions. "The issue arises due to inadequate privilege management and could be exploited by an authenticated malicious actor to execute commands without additional authorization," Netscaler noted . "However, only authenticated users with existing access to the NetScaler Console can exploit this vulnerability, thereby limiting the threat surface to only authenticated users." The shortcoming affects the below versions - NetScaler Cons...
Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability

Microsoft Patches Actively Exploited Power Pages Privilege Escalation Vulnerability

Feb 20, 2025 Software Security / Vulnerability
Microsoft has released security updates to address two Critical-rated flaws impacting Bing and Power Pages, including one that has come under active exploitation in the wild. The vulnerabilities are listed below - CVE-2025-21355 (CVSS score: 8.6) - Microsoft Bing Remote Code Execution Vulnerability CVE-2025-24989 (CVSS score: 8.2) - Microsoft Power Pages Elevation of Privilege Vulnerability "Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network," the tech giant said in an advisory for CVE-2025-21355. No customer action is required. On the other hand, CVE-2025-24989 concerns a case of improper access control in Power Pages , a low-code platform for creating, hosting, and managing secure business websites, that an unauthorized attacker could exploit to elevate privileges over a network and bypass user registration control. Microsoft, which credited its own employee Raj Kumar for flagging the vul...
Hackers Exploit Signal's Linked Devices Feature to Hijack Accounts via Malicious QR Codes

Hackers Exploit Signal's Linked Devices Feature to Hijack Accounts via Malicious QR Codes

Feb 19, 2025 Mobile Security / Cyber Espionage
Multiple Russia-aligned threat actors have been observed targeting individuals of interest via the privacy-focused messaging app Signal to gain unauthorized access to their accounts. "The most novel and widely used technique underpinning Russian-aligned attempts to compromise Signal accounts is the abuse of the app's legitimate 'linked devices' feature that enables Signal to be used on multiple devices concurrently," the Google Threat Intelligence Group (GTIG) said in a report. In the attacks spotted by the tech giant's threat intelligence teams, the threat actors, including one it's tracking as UNC5792, have resorted to malicious QR codes that, when scanned, will link a victim's account to an actor-controlled Signal instance. As a result, future messages get delivered synchronously to both the victim and the threat actor in real-time, thereby granting threat actors a persistent way to eavesdrop on the victim's conversations. Google said UAC-...
Expert Insights Articles Videos
Cybersecurity Resources