Security Archives - CyberConvoy Blog

Fake Cisco Webex Google Ads abuse tracking templates to push malware

The threat actors can exploit a loophole in the Google Ad platform's tracking template that allows them to redirect at will while complying with Google's policy

15 September

WordPress migration add-on flaw could lead to data breaches

09/01/2023
Cyber News
0day, Security

The flaw, tracked as CVE-2023-40004, allows unauthenticated users to access and manipulate token configurations on the affected extensions

1 September

Malicious extensions can abuse VS Code flaw to steal auth tokens

08/12/2023
Cyber News
0day, Security

Any extension running in VS Code, even malicious ones, can gain access to the Secret Storage and abuse Keytar to retrieve any stored tokens

12 August

Microsoft fixes flaw discovered by Tenable

This created an opportunity for attackers to exploit unsecured Azure Function hosts and intercept OAuth client IDs and secrets

4 August

Threat actors abuse Google AMP for evasive phishing attacks

The AMP URLs trigger a redirection to a malicious phishing site, and this additional step also adds an analysis-disrupting layer

2 August

Almost 40% of Ubuntu users vulnerable to new privilege elevation flaws

CVE-2023-2640 is a high-severity (CVSS v3 score: 7.8) vulnerability in the Ubuntu Linux kernel caused by inadequate permission checks allowing a local attacker to gain elevated privileges

29 July

VMware fixes bug exposing CF API admin credentials in audit logs

Threat actors who exploit this vulnerability can use the stolen credentials to push malicious app versions

29 July

GitHub warns of Lazarus hackers targeting devs with malicious projects

The hacking group has a long history of targeting cryptocurrency companies and cybersecurity researchers for cyberespionage and to steal cryptocurrency

21 July