Infosec bits for 2025 week 6
Maajied Moos | Feb. 11, 2025, 11:25 a.m.
Vulnerabilities & Patches:
Broadcom Patches VMware Aria Flaws – Exploits May Lead to Credential Theft [Ravie Lakshmanan, The Hacker News]
DeepSeek's Flagship AI Model Under Fire for Security Vulnerabilities [Kevin Poireault, Info Security Magazine]
Google fixes Android kernel zero-day exploited in attacks [Sergiu Gatlan, Bleeping Computer]
Microsoft Patches Critical Azure AI Face Service Vulnerability with CVSS 9.9 Score [The Hacker News, The Hacker News]
Netgear warns users to patch critical WiFi router vulnerabilities [Sergiu Gatlan, Bleeping Computer]
Cyberattacks & Breaches:
BeyondTrust Zero-Day Breach Exposed 17 SaaS Customers via Compromised API Key [Ravie Lakshmanan, The Hacker News]
Small business owners, secure your web shop [Pieter Arntz, Malware Bytes Labs]
Malware
ClickFix vs. traditional download in new DarkGate campaign [Jérôme Segura, Malware Bytes Labs]
Hackers use fake wedding invitations to spread Android malware in Southeast Asia [Daryna Antoniuk, The Record]
AI Malware Dressed Up as DeepSeek Packages Lurk in PyPi [Becky Bracken, Dark Reading]
XE Group Cybercrime Gang Moves from Credit Card Skimming to Zero-Day Exploits [Ryan Naraine, Security Week]
Crypto-stealing apps found in Apple App Store for the first time [Bill Toulas, Bleeping Computer]
General News
How scammers are exploiting DeepSeek's rise [Editor, We Live Security]
Proactive Vulnerability Management for Engineering Success [Remi Yazigi, Dark Reading]
Tooling
BadDNS: Open-Source Tool Checks For Subdomain Takeovers [Mirko Zorz, Help Net Security]
OpenNHP: Cryptography-driven zero trust protocol [Mirko Zorz, Help Net Security]
