VulnHub

Researchers have discovered five malicious Chrome extensions designed to target users of Workday, NetSuite, and SuccessFactors. These extensions are capable of stealing cookies and preventing access to critical security pages on these platforms. This poses a significant risk to organizations that rely on these software solutions for their operations, as attackers can gain unauthorized access to sensitive information. Users of these platforms should be particularly vigilant about the extensions they install and ensure they are using only trusted sources. The presence of such malicious tools illustrates the ongoing challenges of keeping enterprise software environments secure.

Researchers have identified a cross-site scripting (XSS) vulnerability in the control panel of StealC malware, an infostealer that has been operating since at least 2023. This malware, which is sold as a service, targets and extracts sensitive information like cookies and passwords from victims. The flaw in the control panel has exposed important details about the attackers behind the malware, raising concerns about the ongoing threat to users' data security. Since its update to StealC v2 in 2025, the malware has continued to pose risks to individuals and organizations alike. The discovery emphasizes the need for vigilance against such malware, as the information leak could lead to further malicious activities by the attackers.

A new information-stealing malware called 'SolyxImmortal' has emerged, which utilizes legitimate APIs and libraries to gather sensitive data. The malware sends this stolen information to Discord webhooks, making detection challenging. This type of attack can affect anyone who unwittingly downloads the malware, potentially compromising personal and financial information. As cybercriminals increasingly exploit trusted platforms and tools, users need to be vigilant about the software they install and the permissions they grant. This incident serves as a reminder of the evolving tactics used by attackers to bypass security measures.

This week, several significant cybersecurity incidents have emerged, showcasing the vulnerabilities within various systems. Notably, flaws in Fortinet products have come to light, potentially exposing users to exploitation. Additionally, researchers have identified the RedLine Clipjack malware, which can hijack browser sessions, affecting users who may not realize their data is being compromised. The discovery of a method to crack NTLM authentication raises concerns for organizations relying on this protocol, as it could lead to unauthorized access. Furthermore, a new attack targeting AI tools like Copilot illustrates how these advancements can be manipulated, posing risks to users and their data. These incidents emphasize the need for robust security measures as technology continues to evolve rapidly.

Researchers from Resecurity have uncovered a new malware called PDFSIDER that takes advantage of the legitimate PDF24 application to steal sensitive data and provide attackers with remote access to compromised systems. This malware is part of a sophisticated campaign targeting corporate networks, utilizing spear-phishing tactics to lure victims and encrypted communications to evade detection. Companies using PDF24 should be particularly vigilant as this attack leverages a trusted application, making it easier for attackers to bypass security measures. The implications are serious, as this could lead to significant data breaches and unauthorized access to sensitive corporate information.

CyberArk has reported that it successfully exploited a vulnerability in the StealC infostealer malware to gather intelligence. This malware is known for stealing sensitive information from infected systems, which can include login credentials, financial data, and personal information. By exploiting the flaw, researchers were able to collect evidence that can help understand how the malware operates and how it might be mitigated. This incident underscores the ongoing challenges posed by infostealers and the need for organizations to remain vigilant against such threats. Users and companies should ensure their systems are updated and monitor for signs of compromise, as infostealers like StealC can have serious implications for data security.

Researchers have discovered 17 malicious browser extensions associated with the GhostPoster campaign that have been installed over 840,000 times across Chrome, Firefox, and Edge stores. These extensions are designed to hijack users' browsing sessions and can potentially lead to data theft or other malicious activities. The widespread installation indicates that many users may have unknowingly compromised their security by downloading these harmful extensions. It's crucial for users to regularly check their installed extensions and remove any that seem suspicious. The incident raises concerns about the security measures in place within browser extension stores and the need for more stringent vetting processes to protect users from such threats.

Researchers have discovered a vast network of over 18,000 command-and-control servers operated by Chinese cybercriminals, which have been used to facilitate malware attacks. These servers are spread across 48 different hosting providers and account for nearly 84% of all malicious cyber activities within Chinese hosting environments over the past three months. This extensive operation poses significant risks to businesses and individuals, as the malware can compromise systems and steal sensitive information. The scale of the operation indicates a well-organized effort that could have far-reaching implications for cybersecurity in the region and beyond. Companies need to remain vigilant and enhance their defenses against these types of threats.

Researchers discovered a cross-site scripting (XSS) vulnerability in the web-based control panel of the StealC info-stealing malware. This flaw allowed them to monitor the malware operators' active sessions and collect data on their hardware setups. StealC is designed to steal sensitive information from users, which means this incident not only exposes the attackers but also raises concerns about the ongoing effectiveness of such malware. Understanding these vulnerabilities can help cybersecurity experts develop better defenses against similar threats. The incident serves as a reminder that even sophisticated malware can have weaknesses that researchers can exploit to gain insights into cybercriminal operations.

A new malvertising campaign known as TamperedChef is distributing malware through fake PDF manuals that appear to be legitimate. This malware creates backdoors on infected systems, allowing attackers to steal user credentials, particularly targeting organizations that rely heavily on technical equipment. Researchers have identified that these malicious ads can lead users to download harmful files, putting sensitive information at risk. The implications of this attack are significant, as it could compromise various organizations' security and operational integrity. Users need to be cautious about downloading files from unverified sources, especially when they seem to be offering manuals or guides.

Security experts have uncovered a targeted campaign aimed at U.S. government and policy organizations, utilizing politically charged themes related to the U.S.-Venezuela relationship. Attackers are distributing a backdoor malware known as LOTUSLITE through spear phishing emails that include a ZIP file titled 'US now deciding what's next for Venezuela.zip.' This tactic exploits current geopolitical tensions to lure victims into opening the malicious attachment. The campaign highlights the ongoing risk of politically motivated cyber attacks that can compromise sensitive information and undermine national security. As such, it's crucial for organizations in the affected sectors to enhance their security measures and educate employees about recognizing phishing attempts.