ADMIN.FOUNDATION – Page 80 – cybersecurity / defense / intelligence

New macOS Malware Uses Fake System Prompts to Steal Passwords and Deploy RAT

·

cyber security, Cyber Security News, macOS, Malware

A newly marketed macOS malware-as-a-service platform, ICMacOS, is using fake Apple system dialogs to steal login passwords before deploying an information stealer that has evolved into a persistent remote-access trojan (RAT). The operator markets the toolkit across cybercrime forums and Telegram as part of a broader “ICARUS” criminal suite that also includes a ClickFix delivery […]

The post New macOS Malware Uses Fake System Prompts to Steal Passwords and Deploy RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor

·

CVE/vulnerability, cyber security, Cyber Security News, Vulnerabilities, vulnerability, Zero-Day

Threat actors are exploiting two critical zero-day vulnerabilities in Citrix NetScaler to deploy a modified version of the open-source Platypus remote administration framework on compromised Application Delivery Controller (ADC) and Gateway appliances. Binary Defense’s Analysis on Demand and Incident Response team investigated an intrusion involving two Citrix NetScaler devices. One appliance showed evidence of exploitation […]

The post Hackers Exploit Citrix NetScaler Zero-Days to Deploy Modified Platypus Backdoor appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers

·

AI, cyber security, Cyber Security News

Researchers have identified 253 verified security vulnerabilities affecting 343 AI agent tools across 118 Model Context Protocol (MCP) servers. These vulnerabilities expose weaknesses in how software processes arguments generated by large language models (LLMs). The findings are based on an evaluation of 273 open-source MCP servers containing 3,405 tools, using a new fuzzing framework called […]

The post Researchers Discover 253 Security Vulnerabilities Across 343 AI Agent Tools in MCP Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
[Webinar] How to Stop AI-Driven Privilege Escalation With Runtime Identity Controls

·

The dangerous part of a stolen identity isn’t always the initial login. It’s what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Powering Proactive Defense: How MSSPs Can Strengthen Threat Hunting Against Ransomware

·

ANY.RUN, Malware, MSSP, Ransomware, Security, Threat Hunting, Threat Intelligence

Disclosure: This article was provided by ANY.RUN. The information and analysis presented are based on their research and findings.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
LG Smart TVs Vulnerable to Pre-Auth Root Takeover From Local Network

·

Three vulnerabilities in LG’s webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials

·

cyber security, Cyber Security News

XWorm’s HBrowser plugin gives attackers interactive control of authenticated browser sessions on infected endpoints, allowing them to operate accounts without stealing passwords or completing another multifactor authentication challenge. Researchers recorded 1,236 XWorm detection events across more than 100 customer organizations during Q3 2026, four times the volume observed in Q3 2025. Financial services represented approximately […]

The post XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution

·

cyber security, Cyber Security News, vulnerability

A critical vulnerability in Ghostscript could allow attackers to execute code on vulnerable servers by uploading a specially crafted PDF containing a malicious JPEG 2000 image. Tracked as CVE-2026-39919, the vulnerability is a heap-based buffer overflow rated 9.8 out of 10 under CVSS v3.1 and 9.3 under CVSS v4.0, reflecting a worst-case unauthenticated, network-reachable remote […]

The post Critical Ghostscript Vulnerability Lets Malicious PDFs Trigger Remote Code Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Amazon Fire TV Cube Security Flaws Allow Bootloader Unlocking and Permanent Root Access

·

Amazon, Amazon AWS, cyber security, Cyber Security News

A recently released exploit package lets the third-generation Amazon Fire TV Cube gain an unlocked bootloader and persistent root access on firmware version PS7717 or earlier. Developed by XDA developer Pro-me3us, the project targets devices codenamed “gazelle”. It combines temporary privilege escalation with a separate bootloader vulnerability to enable lasting system modifications. This release includes […]

The post Amazon Fire TV Cube Security Flaws Allow Bootloader Unlocking and Permanent Root Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶
Product Walkthrough: Bitdefender AI Visibility and Control

·

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶

¶¶¶¶¶