Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for LogoKit Phishing Kit ...

 Cyber News

Cyble threat intelligence researchers identified a phishing campaign aimed at Hungarian government targets that further investigation revealed was connected to wider global attack campaigns targeting the banking and logistics sectors. The initial phishing link discovered by the researchers led to a fake login page for   show more ...  

HunCERT, Hungary’s Computer Emergency Response Team, Cyble said in a blog post today. The link prefilled the username field with the victim’s email address to increase the chances that the user would submit their credentials. The phishing links were built using the LogoKit phishing kit, Cyble determined. The phishing pages were hosted on Amazon S3 (AWS) “to stay under the radar and increase credibility among potential victims,” Cyble said. The pages also integrated Cloudflare Turnstile to further the sense of legitimacy. Those features may have helped the domain harvesting the credentials from being discovered, because the researchers found zero detections on VirusTotal during their work. LogoKit Phishing Kit Behind Multiple Attack Campaigns Cyble Research and Intelligence Labs (CRIL) researchers said the phishing URLs used in the campaign used a legitimate HunCERT email address prefilled in the username field. Cyble included two phishing URLs used in the campaign: flyplabtk[.]s3.us-east-2.amazonaws.com/q8T1vRzW3L7XpK0Mb9CfN6hJ2sUYgZAxewoQpHDVlt5BmnEjOrGiScFuYXdAv349/he-opas.html?email=cert@govcert.hu flyplabtk[.]s3.us-east-2.amazonaws.com/q8T1vRzW3L7XpK0Mb9CfN6hJ2sUYgZAxewoQpHDVlt5BmnEjOrGiScFuYXdAv349/he-opas.html?email=csirt@nki.gov.hu The phishing page was designed “to closely resemble a legitimate login portal,” Cyble said, and the Cloudflare Turnstile verification “may deceive users into believing the page is secure” (image below). [caption id="attachment_103502" align="aligncenter" width="1224"] Phishing page targeting HunCERT (Cyble)[/caption] A fake error message then tells victims, “Error Submitting form. Please try again.” The phishing site uses the Clearbit Logo API to fetch the logo from the domain of the targeted organizations, Cyble said, and the Google S2 Favicon retrieves the Favicon icon by extracting the domain from the email address in the URL. The widely used LogoKit phishing kit leverages “URLs embedded with the victim’s email address, identical layouts, and real-time logo fetching from services like Clearbit and Google’s favicon API,” the researchers said. “LogoKit remains actively used in phishing campaigns because of its simplicity and automation,” Cyble said. “By automatically retrieving branding icons based on the URL’s domain, threat actors avoid the need to manually locate and update icons or logos within the phishing kit, making the process more scalable, convincing, and efficient.” Victim credentials are sent to mettcoint[.]com/js/error-200.php. The researchers found an open directory path in mettcoint[.]com that contained several php files and attack elements, and one of the directories contained a phishing page impersonating the WeTransfer file-sharing portal. OSINT intel revealed that the domain mettcoint[.]com has been used in other phishing attacks. Other targets in the ongoing phishing campaign have included Kina Bank in Papua New Guinea, the Catholic Church in the United States, and logistics companies in Saudi Arabia. mettcoint[.]com was registered in October 2024 and has been actively leveraged in phishing campaigns since February 2025, Cyble said. “Notably, the domain currently has zero detections on VirusTotal, allowing it to operate stealthily,” Cyble said. “As of this writing, the domain is still live and functional. Its ongoing availability and undetected status indicate that the phishing campaign is likely still active, with threat actors continuing to target victims on a global scale.” Protecting Against Phishing Attacks Cyble said the mettcoint phishing campaigns reveal a major weakness in cybersecurity defenses. “The human element remains both the strongest and weakest link in cybersecurity, with cautious and responsible use preventing compromises by cyber threats,” the researchers wrote. “Campaigns such as this, however, exploit that element by appearing credible, making them a primary concern for even cyber-savvy employees.” In addition to a threat intelligence solution that can automatically identify and block threats, Cyble said there are additional cybersecurity best practices that can help stop phishing attacks. Those practices include: Being wary of links received via SMS or emails Using good antivirus and internet security software on all connected devices Educating employees on how to protect themselves from threats like phishing and untrusted URLs Using secure email gateways to detect and block phishing emails with malicious links or attachments Using multi-factor authentication (MFA) to limit exploitation of stolen credentials Monitoring for unusual login behavior or access from suspicious IP addresses Keeping devices, operating systems, and applications updated.  

image for How to protect your ...

 Business

According to Juniper Research data, global e-commerce turnover surpassed $7 trillion in 2024, and is projected to grow by 1.5 times over the next five years. But cybercriminal interest in this field is growing even faster. Last year, losses from fraud exceeded $44 billion — and theyre expected to reach US$107   show more ...  

billion within five years. Any online platform — regardless of size or industry — can become a target, whether its a content marketplace, a hardware store, a travel agency, or a water park website. If you accept payments, run a loyalty program, and allow creation of customer accounts, fraudsters will definitely come knocking. So which attack schemes are most common, what kind of damage can they cause, and how can you stop them? Account theft Thanks to infostealers and various database leaks, attackers have access to billions of email-password combinations used on various sites. They can try these combinations on any other site with user accounts, on the assumption that humans often use the same password for different services. This attack method is known as credential stuffing, and if successful, attackers can place orders using the victims linked bank card or spend loyalty points. Criminals can also use compromised accounts to make fraudulent payments with other credit cards. Testing stolen cards Just as with login credentials, attackers may have a database of credit-card data stolen using malware. They need to test which cards are still valid and can process online payments — and for this, any e-commerce site will do. These test purchases are usually small. Working cards are then resold to other criminals, who go on to drain the funds in various ways. From the stores side, this looks like a customer adding a bunch of random inexpensive items to their cart and repeatedly trying to check out, each time with a different card. Even small stores can end up with hundreds of abandoned carts. Eventually, the payment gateway may block the store for exceeding the allowed number of failed payment attempts. Buyer fraud Sometimes real customers may complete an order, only to later tell their bank they never made the purchase — and demand a refund. This could be a case of deliberate fraud, or simply one family member using anothers card without permission — for instance, a teenager using a parents card. Although such incidents are usually small-scale, they can still cause serious damage — especially if the store becomes known in lifehacker communities as a site that easily refunds money. Fraudulent purchases Depending on your stores niche, location, and other factors, criminals may try to use stolen credit cards to cash out by purchasing goods or services. This can result in a wave of orders followed by a flood of disputes and cancellations. In some extreme cases, the volume alone becomes a threat — one store received 118 000 fraudulent orders, with criminals placing a fake order every three seconds. Gift card attacks If your store accepts gift cards, bots may attempt to brute-force thousands of card numbers and verification codes to find valid ones. Once found, theyre either used to make purchases or resold on the secondary market. Loyalty points theft If your store allows purchases using accumulated loyalty points without requiring additional verification via SMS or other methods, attackers can either immediately drain any account they manage to access, or wait for the victim to accumulate more points. The latter often happens with stores that sell high-value products and have a loyal customer base. Scalping exclusive products If you sell, say, tickets to popular concerts or limited-edition sneakers, be prepared for resellers. Scalper bots can snap up all exclusive stock within minutes, triggering justified outrage from loyal customers. Theres an active black market for bots designed for popular e-commerce platforms, such as Shopifybot. Mass account registration To successfully run the schemes described above, attackers often create hundreds or thousands of accounts in your store, increasing operational costs — for instance, by triggering welcome SMS messages and follow-up email campaigns. Direct and indirect business losses Even if neither you nor your customers lose money or goods, any of the above schemes can lead to a wide range of problems and expenses: Costs from fraudulent transactions and repeated failed payments. Depending on the situation and the terms of your agreement with the payment gateway, you might have to cover transaction and chargeback fees, fines, and other costs. You might also exceed your transaction limits and temporarily lose access to the payment gateway — effectively paralyzing normal operations. Advertising costs and distorted analytics. Bots often arrive via referral links, paid search ads, and other forms of online advertising. This means your real advertising budget may be wasted attracting fake users. Even if the bots dont consume your budget directly, their activity can mess up ad platform algorithms, resulting in lower-quality traffic to your site. Costs for marketing campaigns and promotions that are misused by exploiting newly created accounts. Already registered users create new accounts to spend welcome bonuses for the first purchase, and fraudsters look for vulnerabilities and try to obtain bonuses en masse by dishonest means. As a result, the marketing budget allocated for attracting and increasing user loyalty is wasted. Poor planning. Numerous fake orders can be hard to filter out of your analytics — especially if you rely on the default analytics tools built into your e-commerce platform. As a result, planning for demand and stock becomes much more difficult. Wasted time. Dealing with hundreds of abandoned carts, thousands of bogus accounts, and countless failed payment attempts consumes your employees time and energy, leading to operational delays and losses. Customer dissatisfaction. Depending on the attack type, customers may suffer direct losses (money stolen, loyalty points drained, fraudulent activity on their account) or indirect inconveniences (product shortages, failed transactions). Whatever the issue, your support and marketing teams will have to handle it — offering discounts, compensation and so on. But many customers will simply walk away and never come back. Its no surprise that, according to some estimates, for every hundred dollars in fraudulent orders, businesses lose over double that in total costs. How to protect your online business The days of blocking bots by filtering IP addresses or adding a CAPTCHA at checkout are over. The AI boom has empowered not only automation in marketing and customer support — but also a new generation of dangerous fraud bots that easily bypass traditional protection. Thats why businesses of all sizes need next-generation security technologies that monitor every user session from the moment they land on the site until checkout. This kind of continuous protection helps detect any anomalies — whether its a compromised legitimate account, abuse of the payment gateway API, mass fake account creation, or attempts to circumvent security measures. A leading solution in this space is Kaspersky Fraud Prevention. By continuously analyzing the users device, behavior, environment, and metadata in real time, it builds a profile of a legitimate user, detects anomalies early on, and protects against account compromise and fraud. Kaspersky Fraud Prevention can be tailored to the specific needs of your store using flexible rules that leverage both your own data and global analytics. The solution does not require installation on the users device and is integrated into an existing website and mobile application with minimal effort. Many site owners report that advanced anti-fraud analytics actually improve the customer experience — since legitimate users encounter fewer CAPTCHAs, SMS verifications, and other friction points. And ultimately, your business faces fewer losses — and can focus more on developing your product range and service.

 Feed

A hacking group with ties other than Pakistan has been found targeting Indian government organizations with a modified variant of a remote access trojan (RAT) called DRAT. The activity has been attributed by Recorded Future's Insikt Group to a threat actor tracked as TAG-140, which it said overlaps with SideCopy, an adversarial collective assessed to be an operational sub-cluster within

 Feed

Everything feels secure—until one small thing slips through. Even strong systems can break if a simple check is missed or a trusted tool is misused. Most threats don’t start with alarms—they sneak in through the little things we overlook. A tiny bug, a reused password, a quiet connection—that’s all it takes. Staying safe isn’t just about reacting fast. It’s about catching these early signs

 Feed

If you didn't hear about Iranian hackers breaching US water facilities, it's because they only managed to control a single pressure station serving 7,000 people. What made this attack noteworthy wasn't its scale, but how easily the hackers gained access — by simply using the manufacturer's default password "1111." This narrow escape prompted CISA to urge manufacturers to

 Feed

Cybersecurity researchers have disclosed a malicious campaign that leverages search engine optimization (SEO) poisoning techniques to deliver a known malware loader called Oyster (aka Broomstick or CleanUpLoader). The malvertising activity, per Arctic Wolf, promotes fake websites hosting trojanized versions of legitimate tools like PuTTY and WinSCP, aiming to trick software professionals

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 Denial of Service Vulnerability High CVE-2025-20182 CWE-787 Download CSAF Email Summary A vulnerability in the Internet Key Exchange version 2   show more ...  

(IKEv2) protocol processing of Cisco Adaptive Security Appliance (ASA) Software, Cisco Firepower Threat Defense […] La entrada Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 Denial of Service Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 'Cyber

Source: sec.cloudapps.cisco.com – Author: . Cisco IOS XE Software Model-Driven Programmability Authorization Bypass Vulnerability Medium CVE-2025-20214 CWE-639 Download CSAF Email Summary A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an   show more ...  

authenticated, remote attacker to obtain unauthorized read access to configuration or operational data. This vulnerability exists […] La entrada Cisco IOS XE Software Model-Driven Programmability Authorization Bypass Vulnerability – Source:sec.cloudapps.cisco.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini Hunters International ransomware gang announced its shutdown, citing unspecified “recent developments” and acknowledging its impact. The ransomware group Hunters International announced on its dark web site that it is shutting down, citing “recent   show more ...  

developments” without specifying details. The group stated the decision was made after careful consideration and acknowledged […] La entrada Hunters International ransomware gang shuts down and offers free decryption keys to all victims – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit “Cookie Settings” to   show more ...  

provide a controlled consent. Cookie SettingsAccept All Original Post […] La entrada SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 52 – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Breaking News

Source: securityaffairs.com – Author: Pierluigi Paganini A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press.   show more ...  

North Korea-linked threat actors spread macOS NimDoor malware via fake […] La entrada Security Affairs newsletter Round 531 by Pierluigi Paganini – INTERNATIONAL EDITION – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 bulletproof hosting providers

Source: securityboulevard.com – Author: Jeffrey Burt Five months after sanction Zservers, the U.S. Treasury Department targeted Aeza Group, another Russia-based bulletproof hosting services provider for allowing threat actors to host ransomware and other campaigns on its infrastructure, which is resistant to   show more ...  

law enforcement demands and investigations. The post Aeza Group Latest BPH Service Provider Sanctioned […] La entrada Aeza Group Latest BPH Service Provider Sanctioned by U.S. Treasury – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 acquisitions

Source: www.securityweek.com – Author: Eduard Kovacs More than forty cybersecurity merger and acquisition (M&A) deals were announced in June 2025. An analysis conducted by SecurityWeek shows that 405 cybersecurity-related mergers and acquisitions were announced in 2024. Check out the detailed report.    show more ...  

Here is a list of the most important cybersecurity M&A deals announced in June […] La entrada Cybersecurity M&A Roundup: 41 Deals Announced in June 2025 – Source: www.securityweek.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Australian airline Qantas has revealed it has been contacted by a “potential cybercriminal” in relation to a massive breach of customer data. Qantas is currently working to validate the authenticity of the purported cybercriminal. No details have been provided   show more ...  

on the exact nature of the contact, such as whether a ransom […] La entrada Qantas Contacted by Potential Cybercriminal Following Data Breach – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: Security researchers have warned bargain-hunting shoppers to be on the lookout for scams this Amazon Prime Day, after discovering a large number of lookalike domains. Check Point said that, in June alone, it recorded more than 1000 domains with names resembling   show more ...  

“Amazon” and “Amazon Prime” – 87% of which have been […] La entrada Hundreds of Malicious Domains Registered Ahead of Prime Day – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.infosecurity-magazine.com – Author: One of the world’s largest IT distributors has revealed it is battling to recover from a recent ransomware breach. California-based Ingram Micro issued a brief statement over the weekend confirming “an ongoing system outage.” It said: “Ingram Micro   show more ...  

recently identified ransomware on certain of its internal systems. Promptly after learning of […] La entrada IT Giant Ingram Micro Reveals Ransomware Breach – Source: www.infosecurity-magazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: thehackernews.com – Author: . A hacking group with ties other than Pakistan has been found targeting Indian government organizations with a modified variant of a remote access trojan (RAT) called DRAT. The activity has been attributed by Recorded Future’s Insikt Group to a threat actor tracked as   show more ...  

TAG-140, which it said overlaps with SideCopy, […] La entrada TAG-140 Deploys DRAT V2 RAT, Targeting Indian Government, Defense, and Rail Sectors – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.nist.gov – Author: Michael Prebil. A lot has changed in America’s cybersecurity workforce development ecosystem since 2016: employment in cybersecurity occupations has grown by more than 300,000[1]; the number of information security degrees awarded annually has more than tripled to nearly   show more ...  

35,000[2]; and a wide array of new technologies and risks have emerged. Five […] La entrada Nine Years and Counting: NICE RAMPS Communities Keep Expanding Opportunities in Cybersecurity Work and Learning – Source:www.nist.gov se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 1 - Cyber Security News Post

Source: www.mcafee.com – Author: Amy Bunn. “My phone’s been hacked!” These are words you never want to hear or say. Ever. You are not alone in this sentiment. Our phones have become the central hub of our lives, storing everything from personal and financial information, access to payment apps, files,   show more ...  

photos, and contacts. This has made […] La entrada How to Know If Your Phone Has Been Hacked – Source:www.mcafee.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2025-07
Aggregator history
Monday, July 07
TUE
WED
THU
FRI
SAT
SUN
MON
JulyAugustSeptember