00110010.com

  • Microsoft to Limit Onmicrosoft Domain Usage for Sending Emails

    ·

    ,

    Microsoft has announced significant restrictions on email sending capabilities for organizations using default onmicrosoft.com domains, implementing a throttling system that limits external email delivery to 100 recipients per organization every 24 hours. 

    The policy change, announced through the Exchange Team Blog, aims to prevent spam abuse while encouraging organizations to migrate to custom domains for improved email deliverability and brand representation.

    Key Takeaways
    1. Microsoft limits onmicrosoft.com domains to 100 external emails daily.
    2. Targets cybercriminals exploiting new tenants, protecting shared domain reputation.
    3. Organizations must purchase custom domains, rollout phases through June 2026.

    Email Throttling Imposed

    Microsoft’s new policy specifically targets MOERA (Microsoft Online Email Routing Address) domains, which are automatically assigned when organizations create new Microsoft 365 tenants. 

    These default domains, such as contoso.onmicrosoft.com, have become attractive targets for cybercriminals who exploit newly created tenants to send spam bursts before detection systems can intervene.

    The throttling mechanism will trigger NDR (Non-Delivery Report) messages with error code 550 5.7.236 when organizations exceed the 100 external recipient limit within the rolling 24-hour window. 

    Internal messaging remains unaffected, and the restriction applies only to external recipients after any distribution list expansions are calculated. 

    This technical implementation ensures that legitimate testing and internal communications continue uninterrupted while preventing large-scale spam operations.

    The shared reputation model of onmicrosoft domains has created significant deliverability challenges for legitimate users. 

    Because all organizations share variations of the same domain namespace, malicious activity from one tenant can negatively impact email deliverability for all other users on the platform.

    Phased Rollout Timeline 

    Microsoft has established a structured rollout schedule beginning with trial tenants on October 15, 2025, and progressing through different organization sizes based on Exchange seat counts. 

    The implementation will conclude with tenants having over 10,001 seats by June 1, 2026. Organizations with fewer than three seats will face restrictions starting December 1, 2025, followed by progressively larger organizations through the first half of 2026.

    Technical migration involves several critical steps including purchasing custom domains through authorized registrars, configuring DNS validation, and updating primary SMTP addresses on all mailboxes. 

    Organizations must also address specific scenarios where MOERA domains might be inadvertently used, including Sender Rewriting Scheme (SRS) configurations, Microsoft Bookings notifications, and various Microsoft 365 service integrations.

    Administrators can analyze current MOERA email traffic using the Message Trace feature in Exchange Admin Center with wildcard sender addresses to identify potential impacts before the restrictions take effect. 

    Organizations are strongly advised to begin migration planning immediately, as the throttling limits will significantly impact any business operations currently dependent on MOERA domains for external communications.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Microsoft to Limit Onmicrosoft Domain Usage for Sending Emails appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection

    ·

    ,

    A method to silently exfiltrate Windows secrets and credentials, evading detection from most Endpoint Detection and Response (EDR) solutions.

    This technique allows attackers who have gained an initial foothold on a Windows machine to harvest credentials for lateral movement across a network without triggering common security alerts.

    How Windows Manages Secrets

    The Local Security Authority (LSA), running within the lsass.exe process, is the core Windows component responsible for managing sensitive information. The LSA uses two in-memory databases that correspond to on-disk registry hives:

    • SAM database: Manages user, group, and alias objects and corresponds to the SAM registry hive. It stores user credentials, but there is no direct API to retrieve them in plaintext.
    • Security database: Manages policy, trusted-domain, account, and secret objects, corresponding to the SECURITY registry hive. This database holds LSA secrets, such as cached domain credentials and machine keys.

    While these databases can be managed through RPC interfaces (MS-SAMR and MS-LSAD), they do not offer a simple way to decrypt stored secrets. To access the credentials and secrets, direct interaction with the SAM and SECURITY registry hives is necessary.

    These hives are protected by Discretionary Access Control Lists (DACLs) that restrict access to accounts with SYSTEM privileges. The sensitive data within them, such as user credentials and machine keys, is encrypted.

    Decrypting this information requires additional values from the SYSTEM hive to reconstruct the decryption key.

    Attackers commonly use various local and remote techniques to harvest credentials, but modern security tools detect most well-known methods.

    Interacting with the lsass.exe process memory, for example, is a high-risk activity that is heavily monitored by EDRs and Windows Defender, often resulting in immediate alerts.

    EDR solutions primarily rely on kernel-mode callback routines to monitor system activity. By using functions like CmRegisterCallbackEx, an EDR’s driver can register to be notified by the Windows kernel of specific events, such as registry access.

    When a process attempts to read a sensitive key, like HKLM\SAM or HKLM\SECURITY, the kernel notifies the EDR, which can then block the operation or raise an alert. To manage performance, EDRs typically monitor a select list of high-risk API calls and registry paths, rather than every single system operation.

    A New Method for Silent Exfiltration

    According to researcher Sud0Ru, who uncovered this technique, a new, two-pronged approach allows attackers to bypass these defenses by leveraging lesser-known Windows internals.

    This method avoids creating on-disk backups of registry hives and does not require SYSTEM-level privileges, operating within the context of a local administrator.

    Exfiltrate Windows Secrets and Credentials
    secret data Exfiltration (Source : Sud0Ru)
    1. Bypassing Access Controls with NtOpenKeyEx: The first step involves using the undocumented native API NtOpenKeyEx. By calling this function with the REG_OPTION_BACKUP_RESTORE flag and enabling the SeBackupPrivilege (available to administrators), an attacker can bypass the standard ACL checks on protected registry keys. This provides direct read access to the SAM and SECURITY hives without needing to be the SYSTEM user.
    2. Evading Detection with RegQueryMultipleValuesW: Once access is gained, the next challenge is to read the data without triggering EDR alerts. Most EDRs monitor common API calls used for reading registry values, such as RegQueryValueExW. This new technique instead uses RegQueryMultipleValuesW, an API that retrieves data for a list of value names associated with a registry key. Because this function is used less frequently, many EDR vendors have not included it in their monitoring rules. By using this API to read a single value at a time, attackers can extract the encrypted secrets from the SAM and SECURITY hives without being detected.

    This combined strategy allows the entire operation to occur in memory, leaving no on-disk artifacts and avoiding API calls that would typically flag malicious activity.

    The result is a silent and effective method for harvesting credentials. While decrypting the exfiltrated data is a separate process, this collection technique demonstrates that even mature defensive systems can be circumvented by leveraging overlooked, legitimate functionalities within the operating system itself.

    Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.

    The post Hackers Can Exfiltrate Windows Secrets and Credentials Silently by Evading EDR Detection appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Agentic AI vs SOAR: What’s the Real Difference?

    ·

    , , ,

    By now, you’ve heard the hype. Agentic AI; self-directed and goal-oriented. Supposedly, the next big thing in security automation. If you’re working in a Security Operations Center (SOC), it might sound like déjà vu.  Agentic AI brings autonomous, decision-making security agents that learn, adapt, and act across environments, while SOAR focuses on orchestrating and automating predefined […]

    The post Agentic AI vs SOAR: What’s the Real Difference? appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Hijack VPS Servers to Breach Software-as-a-Service Accounts

    ·

    , ,

    Virtual Private Servers (VPS) have long served as versatile tools for developers and businesses, offering dedicated resources on shared physical hardware with enhanced control and scalability. However, threat actors are increasingly exploiting these platforms to orchestrate stealthy attacks against Software-as-a-Service (SaaS) environments. Rising Abuse of VPS Infrastructure By leveraging VPS providers, attackers can mimic legitimate […]

    The post Hackers Hijack VPS Servers to Breach Software-as-a-Service Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Help TDS Hacks Legitimate Websites, Using PHP Templates to Display Fake Microsoft Security Alerts

    ·

    , , ,

    GoDaddy Security researchers have unveiled a detailed analysis of Help TDS, a sophisticated Traffic Direction System operational since at least 2017, which exploits compromised websites to funnel traffic toward malicious scams. This operation supplies affiliates with PHP code templates that are injected into legitimate sites, primarily WordPress installations, to redirect visitors to fraudulent pages mimicking […]

    The post Help TDS Hacks Legitimate Websites, Using PHP Templates to Display Fake Microsoft Security Alerts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Chinese MURKY PANDA Attacking Government and Professional Services Entities

    ·

    , ,

    A sophisticated China-nexus threat actor designated MURKY PANDA has emerged as a significant cybersecurity concern, conducting extensive cyberespionage operations against government, technology, academic, legal, and professional services entities across North America since late 2024.

    This advanced persistent threat group demonstrates exceptional capabilities in cloud environment exploitation and trusted-relationship compromises, marking a concerning evolution in state-sponsored cyber activities.

    The adversary has established itself as a formidable force through its ability to rapidly weaponize both n-day and zero-day vulnerabilities, frequently achieving initial access by exploiting internet-facing appliances.

    MURKY PANDA’s operations are characterized by their focus on intelligence collection objectives, with documented cases of email exfiltration and sensitive document theft from high-profile targets.

    CrowdStrike researchers identified MURKY PANDA’s activity as particularly notable for its cloud-conscious approach and advanced operational security measures.

    The threat group’s sophisticated tradecraft includes modifying timestamps and systematically deleting indicators of compromise to evade detection and complicate attribution efforts.

    Their operations align with broader China-nexus targeted intrusion activities tracked by industry sources as Silk Typhoon.

    The group’s arsenal includes deployment of web shells such as Neo-reGeorg, commonly utilized by Chinese adversaries, and access to a low-prevalence custom malware family designated CloudedHope.

    Additionally, MURKY PANDA has demonstrated proficiency in leveraging compromised small office/home office devices as operational infrastructure, mirroring tactics employed by other Chinese threat actors like VANGUARD PANDA.

    Trusted-Relationship Cloud Exploitation Techniques

    MURKY PANDA’s most distinctive capability lies in conducting trusted-relationship compromises within cloud environments, representing a relatively rare and undermonitored attack vector.

    The group has successfully exploited zero-day vulnerabilities to compromise software-as-a-service providers, subsequently leveraging their access to move laterally to downstream customers.

    In documented cases, the adversary obtained application registration secrets from compromised SaaS providers using Entra ID for customer access management.

    By authenticating as service principals, MURKY PANDA gained unauthorized access to downstream customer environments, enabling email access and data exfiltration.

    This sophisticated technique demonstrates their deep understanding of cloud architecture and identity management systems.

    The threat actor has also targeted Microsoft cloud solution providers, exploiting delegated administrative privileges to achieve Global Administrator access across multiple downstream customer tenants, establishing persistent backdoors through newly created user accounts and modified service principal configurations.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Chinese MURKY PANDA Attacking Government and Professional Services Entities appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Abuse VPS Servers To Compromise Software-as-a-service (SaaS) Accounts

    ·

    , ,

    Cybercriminals are increasingly leveraging Virtual Private Server (VPS) infrastructure to orchestrate sophisticated attacks against Software-as-a-Service (SaaS) platforms, exploiting the anonymity and clean reputation of these hosting services to bypass traditional security controls.

    A coordinated campaign identified in early 2025 demonstrated how threat actors systematically abuse VPS providers like Hyonix, Host Universal, Mevspace, and Hivelocity to compromise enterprise email accounts and establish persistent access to organizational systems.

    The attack methodology centers on session hijacking techniques, where attackers utilize compromised credentials to log into SaaS accounts from VPS-hosted infrastructure.

    Timeline of activity for Case 1 – Unusual VPS logins and deletion of phishing emails (Source – Darktrace)

    This approach allows malicious actors to circumvent geolocation-based security measures by appearing as legitimate traffic from trusted hosting providers.

    The clean IP reputation associated with newly provisioned VPS instances enables attackers to evade conventional blacklist-based detection systems, making their activities blend seamlessly with normal business operations.

    Timeline of activity for Case 2 – Coordinated inbox rule creation and outbound phishing campaign (Source – Darktrace)

    Recent investigations spanning March through May 2025 revealed a surge in anomalous login activities originating from Hyonix’s Autonomous System Number (ASN AS931), with threat actors demonstrating remarkable consistency in their attack patterns across multiple victim environments.

    Darktrace analysts identified suspicious activities including improbable travel scenarios where users appeared to access accounts simultaneously from distant geographical locations, indicating clear signs of credential compromise and session hijacking.

    The campaign’s sophistication extends beyond initial access, incorporating Multi-Factor Authentication (MFA) bypass techniques through token manipulation and the systematic creation of obfuscated email rules designed to maintain stealth.

    Attackers established persistence by creating inbox rules with minimal or generic names to avoid detection during routine security audits, automatically redirecting or deleting incoming emails to conceal their malicious activities.

    Advanced Persistence and Evasion Mechanisms

    The threat actors demonstrated advanced understanding of email security systems by implementing targeted inbox rule manipulation techniques that operate below the threshold of typical security monitoring.

    The malicious rules specifically targeted emails containing sensitive organizational information, including communications from VIP personnel and financial documents.

    Technical analysis revealed the use of MITRE ATT&CK technique T1098.002 (Exchange Email Rules) combined with T1071.001 (Web Protocols) for command and control operations.

    Key indicators of compromise include IP addresses 38.240.42[.]160 and 194.49.68[.]244 associated with Hyonix infrastructure, alongside 91.223.3[.]147 from Mevspace Poland.

    The attackers employed domain fluxing techniques for infrastructure resilience while maintaining operational security through carefully timed activities that coincided with legitimate user sessions, effectively masking their presence within normal business communications.

    Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.

    The post Hackers Abuse VPS Servers To Compromise Software-as-a-service (SaaS) Accounts appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: DOD’s drone-warfare plans; ODNI to shrink further; ICE seeks volunteers; Black Hawk upgrades; And a bit more.

    ·

    Inside the Pentagon plan to Americanize drone warfare. Years of talk about rapidly scaling up drone forces have produced interesting prototypes and lively experiments with relatively small numbers of drones—but no clear sense of how the United States would conduct the kind of sustained drone warfare pioneered in Ukraine. A combination of recent developments, tech breakthroughs, and policy changes suggests that could soon change.

    The T-REX event in Indiana brought together drone makers, AI, data, and communications software companies to show off not just how well new autonomous drones can hit targets, but also next steps for mass, coordinated drone warfare. Defense One’s Patrick Tucker was there, and pulls the strings together in this report.

    The Army is equipping its Black Hawks to launch drones. Helo maker Sikorsky will make software and hardware upgrades under a $43 million contract that will also give the venerable rotorcraft a “more powerful engine, airframe enhancements and a main fuel upgrade,” reports Defense One’s Meghann Myers.

    Black Hawk crew will be able to launch and operate drones in flight, part of a larger push toward so-called “launched effects,” one of the cornerstones of the Army Transformation Initiative.

    But how long will the UH-60 be central to the Army’s operations? Myers wraps up the signs of a decline in importance, here.

    Developing: The U.S. military is “preparing target sets” for strikes against alleged drug cartels in Mexico, independent investigative journalist Ken Klippenstein reported Thursday. 

    “The strikes were discussed at a July meeting at NORTHCOM HQ in Colorado Springs led by Colby Jenkins, Acting Assistant Secretary of Defense for Special Operations,” he writes. “Within days, Gen. Gregory M. Guillot, commander of NORTHCOM, hosted the two highest ranking Mexican military officials: Gen. Ricardo Trevilla Trejo, Secretary of National Defense, and Adm. Raymundo Pedro Morales Ángeles, Secretary of the Navy.”

    Targets allegedly include the Sinaloa Cartel and the Jalisco New Generation Cartel. “Direct attacks could also involve air and drone strikes,” Klippenstein writes. 

    It’s unclear just yet how Mexican President Claudia Sheinbaum would respond. She’s said recently she’s flatly opposed to U.S. troops on the ground inside Mexico. However, “Trump, military sources also tell me, is focused on results, willing to ignore law, rules, and even policy recommendations in his zeal to have ‘progress’ towards his goals with regard to national security,” Klippenstein says. More, here. 

    • ICYMI: We discussed strikes against cartels in a recent podcast conversation with special operations author Kevin Maurer. Find that discussion, here. 

    Also: Drug traffickers in Colombia allegedly used a drone to shoot down a Black Hawk helicopter carrying a dozen police Thursday morning, the Wall Street Journal reports. All 12 passengers perished in the attack. 

    Notable uptick: “Since the first attack by drone in Colombia in April of last year, the military here says there have been 301 strikes with unmanned aerial vehicles,” the Journal’s Juan Forero reports from Bogota. “At least 22 soldiers and police officers have died in the attacks.”

    The U.S. military says it killed an ISIS official during a raid in northern Syria on Tuesday. Neither militant was named, but Central Command officials described them as “a senior ISIS member and key financier who planned attacks in Syria and Iraq.” 

    The Middle East Institute’s Charles Lister says the man killed was Saleh Nouman, who was allegedly spotted by Syrian forces “in al-Dana, but he fled to Atmeh—where a joint US airborne raid was planned.” Tiny bit more from CENTCOM, here. 

    Additional reading: 

    Insider POV: Allvin’s surprise exit signals a pivot for the Air Force, not Hegseth pressure, sources say. On Monday, Allvin announced his plans to retire after serving just two years as the service’s highest-ranking officer, typically a four-year job. No reason was given in the Air Force press release that contained his announcement. Allvin’s abrupt retirement wasn’t driven by Defense Secretary Pete Hegseth, but by growing frustration with the service’s priorities, multiple people familiar with the decision told Defense One’s Audrey Decker. 

    Welcome to this Friday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1844, U.S. Navy officer George Francis De Long was born in New York City. In the fall of 1879, De Long led an expedition searching for a way to the North Pole via the Bering Strait. Nearly two years into the quest, his ship was crushed in an ice pack in the East Siberian Sea. De Long, 37, died of starvation about four months later.  

    Deportation nation

    The Pentagon is offering its civilians a chance to work for ICE. “Volunteers will serve in critical support roles up to 180 days at an [Immigration and Customs Enforcement] or [Customs and Border Protection] facility,” the online alert reads. The offer extends to civilians of “any grade,” and notes, “Travel, lodging, and per diem may be reimbursed by the receiving agency.” 

    Work includes: “Data Entry” and “Operational Planning Support,” as well as various processing tasks such as helping agents with the “physical flow of detained illegal aliens from arrest to deportation,” and other logistical considerations “to improve efficiencies and the effectiveness of operations.”

    There are no education requirements, and applicants must have worked at “their current agency for more than 90 days and are no longer in a probationary period.” 

    Note: “Conditions at some locations could be austere,” and “Deployment locations are based on need and are not negotiable,” according to the bulletin. More, here. 

    New: A judge has ordered Florida to stop expanding its “Alligator Alcatraz” detention center because “state officials never sufficiently explained why the facility needed to be in the middle of the Florida Everglades,” the Associated Press reports. “What is apparent, however, is that in their haste to construct the detention camp, the State did not consider alternative locations,” District Judge Kathleen Williams of the Southern District of Florida said in her 82-page order. 

    “Every Florida governor, every Florida senator, and countless local and national political figures, including presidents, have publicly pledged their unequivocal support for the restoration, conservation, and protection of the Everglades,” Williams wrote. “This Order does nothing more than uphold the basic requirements of legislation designed to fulfill those promises.” More, here. 

    Related: AP also takes readers “Inside the facility where ICE is training recruits to take on Trump's deportation goals” at the Federal Law Enforcement Training Center in Brunswick, Georgia.

    Developing: ICE wants to spend millions of dollars on “custom, gold-detailed vehicle wraps” (see here) for its SUVs patrolling the nation’s capital, the Washington Post reported Wednesday. Critics call it excessive and unnecessary. More, here. 

    Big picture consideration: Republican lawmakers’ “Big Beautiful Bill” funds an unprecedented surge in federal law enforcement. But is that even possible? Eric Katz of GovExec tallied up many of the planned personnel changes and stacked those against past pledges to boost hiring. Consulting history, he found that “Even when some agencies previously received authorization and funding to hire, they failed to do so in significant numbers.”

    “Potential bottlenecks include background checks and training capacity,” Katz writes. On the other hand, “Early returns show some positive signs for the administration. ICE recently boasted it has received 100,000 job applications. CBP has seen a surge in applicants. The rate at which applicants are onboarded, however, has barely moved.” Continue reading, here. 

    One way to add more federal agents: Lower recruiting standards, as the F.B.I. has done in a change that is “alarming agents,” according to the New York Times, reporting Thursday. 

    Trump 2.0

    ODNI to shrink further under new reorganization plan. The Office of the Director of National Intelligence, which has already shrunk its workforce by about one-quarter this year, will lose another 200 workers in coming weeks under an “ODNI 2.0” restructuring, the U.S. spy chief said Wednesday.

    The office had slightly less than 2,000 employees at the start of the Trump administration and now has around 1,500. The additional cut would bring the year's total reduction to about 35 percent. In a press release this week, Director of National Intelligence Tulsi Gabbard claimed the changes would “reduce ODNI by over 40%” by Sept. 30 and “save taxpayers over $700 million per year.” More, here. 

    Also: On July 20, Gabbard ordered U.S. intelligence agencies to stop sharing information with the so-called Five Eyes allies, which includes the U.K., Canada, Australia and New Zealand, CBS News reported Thursday. “The memo also limited distribution of material regarding peace talks to within the agencies that created or originated the intelligence,” Jim LaPorta writes for CBS. 

    Reminder: President Donald Trump and his Republican allies have long criticized the U.S. intelligence community, particularly after it concluded that Russia interfered in the 2016 presidential election on behalf of Trump. And just last month, Gabbard issued a report that she said showed a contradiction between the IC's internal assessments and public statements about Russian interference. But in fact, the public statement matched the internal assessments.

    Related commentary: Former CIA Director Bill Burns wrote “A Letter to America’s Discarded Public Servants” this week in The Atlantic. In short, “You all deserved better” than to be downsized under the current administration.

    One week ago, Trump met with Russia’s Vladimir Putin to find an end to Putin’s Ukraine invasion. Seven days later, nothing has changed. But Trump’s effort stalled out in a mere four days, according to the Wall Street Journal, reporting Friday. 

    What’s going on: “The failure to reach a diplomatic breakthrough stems in part from sharp differences in negotiating style between Putin and Trump,” the Journal writes. “The U.S. president, former aides said, has an improvisational approach that is heavily dependent on personal relationships.” However, “Putin is playing a longer game, calculating that Russia can gradually improve its position on the battlefield while the diplomats talk, even if it is at the expense of thousands of casualties on both sides.”

    Expert reax: “We are where we were two weeks ago, we are where we were six months ago,” said Kurt Volker, who was Trump’s representative for Ukraine negotiations during his first term. “There’s never going to be an agreement. Putin will never agree.” 

    Read more: 

    Lastly this week: “The Trump White House has launched an official TikTok account, despite [Congress’] TikTok sale-or-ban law and another looming deadline,” CNN’s Brian Stelter reported this week. 

    Additional reading: 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lumma Operators Deploy Cutting-Edge Evasion Tools to Maintain Stealth and Persistence

    ·

    , ,

    Lumma infostealer affiliates’ complex operating framework was revealed by Insikt Group in a ground-breaking report published on August 22, 2025, underscoring their reliance on cutting-edge evasion technologies to support cybercrime operations. The Lumma malware, a prominent malware-as-a-service (MaaS) platform since 2022, facilitates data exfiltration from browsers, cryptocurrency wallets, and system credentials, supported by a decentralized […]

    The post Lumma Operators Deploy Cutting-Edge Evasion Tools to Maintain Stealth and Persistence appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Apple iOS, iPadOS, and macOS 0-day Vulnerability Exploited in Attacks

    ·

    , , ,

    CISA has issued an urgent warning regarding a critical zero-day vulnerability affecting Apple’s iOS, iPadOS, and macOS operating systems that threat actors are actively exploiting. 

    The vulnerability, tracked as CVE-2025-43300, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, signaling immediate action is required from organizations and individual users to protect their systems from potential compromise.

    Key Takeaways
    1. CVE-2025-43300 in Apple devices allows code execution through malicious images.
    2. Actively exploited by threat actors targeting iOS, iPadOS, and macOS systems.
    3. Install Apple security updates immediately; federal deadline September 11, 2025.
    • Out-of-Bounds Write Flaw 

    The newly disclosed vulnerability represents an out-of-bounds write weakness within Apple’s Image I/O framework, classified under CWE-787 (Out-of-bounds Write). 

    This type of vulnerability allows attackers to write data beyond the intended boundaries of allocated memory buffers, potentially leading to arbitrary code execution, system crashes, or privilege escalation. 

    The Image I/O framework is responsible for reading and writing image data across Apple’s ecosystem, making this vulnerability particularly concerning due to its widespread usage in processing various image formats, including JPEG, PNG, and HEIF files.

    Security researchers indicate that the flaw could be triggered through maliciously crafted image files, enabling attackers to execute arbitrary code with the privileges of the affected application. 

    The vulnerability affects multiple Apple operating system versions, creating a broad attack surface that encompasses iPhones, iPads, and Mac computers across enterprise and consumer environments.

    CISA’s inclusion of CVE-2025-43300 in the KEV catalog, dated August 21, 2025, establishes a mandatory remediation deadline of September 11, 2025, for all federal civilian executive branch agencies. 

    Under Binding Operational Directive (BOD) 22-01), these organizations must apply vendor-supplied mitigations or discontinue use of affected products if patches remain unavailable.

    The agency’s swift response underscores the severity of active exploitation attempts targeting this vulnerability. 

    While CISA has not yet determined whether the flaw is being leveraged in ransomware campaigns, the agency’s guidance emphasizes treating this as a high-priority security issue requiring immediate attention from network defenders and cybersecurity teams.

    Risk FactorsDetails
    Affected ProductsApple iOSApple iPadOSApple macOS
    ImpactArbitrary Code ExecutionPotential Privilege Escalation
    Exploit PrerequisitesMaliciously crafted image fileUser interaction with image processingAccess to Image I/O framework
    CVSS 3.1 Score8.8 (High)

    Immediate Patching Required 

    Apple has released security updates addressing the vulnerability across affected platforms, with detailed mitigation guidance available through multiple support bulletins. 

    Organizations should prioritize implementing these patches as part of their vulnerability management frameworks, particularly given the zero-day nature of the threat and confirmed exploitation in the wild.

    The vulnerability’s presence in the KEV catalog serves as a critical input for cybersecurity professionals developing risk-based remediation strategies. 

    Network defenders should leverage CISA’s authoritative vulnerability intelligence to enhance their threat detection capabilities and ensure comprehensive coverage of known attack vectors targeting Apple’s widely deployed operating systems.

    Safely detonate suspicious files to uncover threats, enrich your investigations, and cut incident response time. Start with an ANYRUN sandbox trial → 

    The post CISA Warns of Apple iOS, iPadOS, and macOS 0-day Vulnerability Exploited in Attacks appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶