SecureTeam

Microsoft Patches Critical Zero-Day Vulnerabilities

Microsoft’s August patch Tuesday security update included fixes for 138 vulnerabilities, 17 of which were classified as ‘Critical’ flaws. The security patches issued cover 40 different Microsoft and Windows products and features, including critical Windows system operations, and popular applications such as Microsoft Edge, Microsoft Office, and the Microsoft Exchange Server. Two zero-day vulnerabilities were […]

Microsoft Patches Critical Zero-Day Vulnerabilities Read More »

Amex and Snapchat used in Open Redirect Attacks

News, Vulnerabilities / Ian Reynolds

Google Workspace and Microsoft 365 users have been targeted in phishing attacks that have resulted in the attackers stealing credentials. The attackers exploited known flaws in Snapchat and American Express websites to trigger open redirects to specially crafted web pages, where the credential harvesting could then take place. Email security company Inky detected these attacks

Amex and Snapchat used in Open Redirect Attacks Read More »

VMware Patch Critical Authentication Bypass Flaw

News, Vulnerabilities / Ian Reynolds

VMware released a critical security advisory this week to warn users of security vulnerabilities that have been found in a variety of their systems. VMware Workspace ONE Access, Access Connector, Identity Manager, Identity Manager Connector, and vRealize Automation products have all received security patches to deal with these vulnerabilities. VMware advise all users that it

VMware Patch Critical Authentication Bypass Flaw Read More »

Critical Confluence Vulnerability Exploited in the Wild

News, Vulnerabilities / Ian Reynolds

A vulnerability in Atlassian’s Questions for Confluence app has been found that includes hardcoded credentials that remote attackers can exploit to access the Confluence Server or Confluence Data Center it is hosted on. The versions of Questions for Confluence with this vulnerability unpatched are 2.7.34, 2.7.35, and 3.0.2. Atlassian have released a security advisory rating

Critical Confluence Vulnerability Exploited in the Wild Read More »

LinkedIn the Top Phishing Brand in Q2 2022

Articles, Social Engineering / Ian Reynolds

Phishing is the most common cyber attack vector, and while email is well known for phishing, increasingly LinkedIn is being used as well. End-user phishing was the initial access point in 56% of cyber attacks that took place in 2021, according to a recent report. Phishing attacks rely on user interaction to trigger the initial access,

LinkedIn the Top Phishing Brand in Q2 2022 Read More »

Microsoft Exchange Servers Open to Backdoor Hack

News, Vulnerabilities / Ian Reynolds

Microsoft have warned customers of a form of attack capable of targeting unpatched Microsoft Exchange servers. The attacks taking place in the first 5 months of this year saw threat actors using Internet Information Services (IIS) extension modules to: access their victim’s email mailboxes, execute commands remotely, harvest credentials from within the system memory, steal

Microsoft Exchange Servers Open to Backdoor Hack Read More »

Source Code for Stealer Malware Released Online

News, Vulnerabilities / Ian Reynolds

An information stealing malware has had its source code released by the developer on a popular hacking forum. Cyber criminals have had free access to this malware since the start of this month, and it has already been updated three times by the developer to add new capabilities and streamline the attack. Cyble Research Labs

Source Code for Stealer Malware Released Online Read More »

New Backdoor Linux Malware ‘Lightning Framework’

News, Vulnerabilities / Ian Reynolds

A new, previously undetected, Linux malware known as ‘Lightning Framework’ can be used as a backdoor to install rootkits in infected devices via Secure Shell (SSH). A report released by Intezer this week calls this malware “Swiss Army Knife-like” due to its wide range of capabilities, and ability to use techniques to avoid detection and

New Backdoor Linux Malware ‘Lightning Framework’ Read More »

Proof of Concept Released for MacOS Vulnerability

News, Vulnerabilities / Ian Reynolds

The Microsoft 365 Defender Research Team have released a security warning to macOS users about a vulnerability they have discovered in Apple’s App Sandbox. The vulnerability tracked as CVE-2022-26706 was first uncovered in October 2021, however a new Proof of Concept (PoC) has been released by Microsoft in two formats, one of which is describe

Proof of Concept Released for MacOS Vulnerability Read More »

Phishing Attacks That Can Bypass MFA

Articles, Information Assurance, Social Engineering / Ian Reynolds

A large-scale phishing attack campaign has emerged using adversary-in-the-middle (AiTM) to steal credentials and circumvent multi-factor authentication (MFA) needs. Microsoft have released a security blog post regarding the use of these phishing attacks and the impersonation of Microsoft Azure Active Directory (Azure AD) login pages. This campaign has reportedly targeted over 10,000 organisations in the

Phishing Attacks That Can Bypass MFA Read More »

2022

Microsoft Patches Critical Zero-Day Vulnerabilities

Amex and Snapchat used in Open Redirect Attacks

VMware Patch Critical Authentication Bypass Flaw

Critical Confluence Vulnerability Exploited in the Wild

Microsoft Exchange Servers Open to Backdoor Hack

Source Code for Stealer Malware Released Online

New Backdoor Linux Malware ‘Lightning Framework’

Proof of Concept Released for MacOS Vulnerability

Our Address

Talk to us

Office Hours

Company Number

VAT Registration Number

Penetration Testing

Risk & Compliance Services

Quick Links

information. secured.

Head Office Address

Opening Hours

Stay in Touch