Microsoft brings the popular PowerToys Windows 11 mouse indicator to the OS natively. Learn how to easily locate your cursor on high-resolution screens.
Related Posts:
The post Windows 11 Mouse Indicator: Find Your Cursor Instantly appeared first on Daily CyberSecurity.
G DATA details Projextor, an Electron malware hidden in working PDF and recipe apps that runs injected scripts and captures the desktop.
Related Posts:
The post Projextor Malware Hides in Fake PDF and Recipe Apps appeared first on Daily CyberSecurity.
A Vault Secrets Operator vulnerability, CVE-2026-8715, lets tenants read pod files and gain privilege escalation. Patch to 1.5.0 now.
Related Posts:
The post Vault Secrets Operator Flaw CVE-2026-8715 Enables Privilege Escalation appeared first on Daily CyberSecurity.
CVE-2026-68067 (CVSS 9.8) lets attackers control user accounts on the Mira Hormone Monitor by bypassing the cloud login. Eight flaws total.
Related Posts:
The post CVE-2026-68067 (CVSS 9.8): Mira Monitor Flaw Lets Attackers Control User Accounts appeared first on Daily CyberSecurity.
CVE-2026-63455 and CVE-2026-63456 let attackers bypass web authentication on HPE EdgeConnect Orchestrator. CVSS 9.8. Patch now.
Related Posts:
The post CVE-2026-63455: EdgeConnect Orchestrator Web Authentication Bypass Rated CVSS 9.8 appeared first on Daily CyberSecurity.
Microsoft says China-linked, financially motivated threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The group previously relied on Medusa ransomware. StormEncryptor is written in C++ and encrypts files and adds the .encrypted extension, then leaves a !!!README_FIRST!!!.txt ransom note in each scanned directory. The change suggests an evolution in the group’s ransomware operations.
“While Microsoft has not confirmed the vulnerability targeted by Storm-1175 in this campaign, the threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.” wrote Microsoft on X.
On August 2, 2026, the financially motivated cybercriminal actor tracked by Microsoft Threat Intelligence as Storm-1175 began deploying a new ransomware strain called StormEncryptor.
— Microsoft Threat Intelligence (@MsftSecIntel) August 7, 2026
Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by… pic.twitter.com/wNbchat8ZU
Storm-1175 is known for fast ransomware campaigns that exploit newly disclosed vulnerabilities before organizations can patch them. In recent attacks, the group used tools such as AnyDesk and SimpleHelp for remote access, Advanced IP Scanner to map networks, and Mimikatz to dump LSASS credentials.
Microsoft says the attackers can move from initial access to data theft and ransomware deployment within days, highlighting the need for rapid patching and monitoring.
China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them. The group targets exposed systems and quickly moves from initial access to data theft and ransomware deployment, sometimes within 24 hours. The financially motivated group mainly targets sectors such as healthcare, education, finance, and services across the US, UK, and Australia. The attackers often chain exploits, create new accounts for persistence, move laterally using remote tools, steal credentials, and weaken security defenses. Their speed and focus on unpatched systems make them highly effective.
Microsoft researchers report that the group quickly exploits newly disclosed flaws in web-facing systems to gain access. Since 2023, the group has targeted many platforms, including Microsoft Exchange, Ivanti, ConnectWise, JetBrains, and others. It often weaponizes vulnerabilities within days, or even one day, before organizations apply patches.
“Storm-1175 rapidly weaponizes recently disclosed vulnerabilities to obtain initial access.” reads the report published by Microsoft. “Since 2023, Microsoft Threat Intelligence has observed exploitation of over 16 vulnerabilities, including:
The attackers also chain multiple exploits to achieve deeper access, such as remote code execution, and have targeted both Windows and Linux systems. In some cases, the threat actor used zero-days even before public disclosure, showing advanced capabilities. By focusing on unpatched systems and acting fast, Storm-1175 maximizes impact and maintains a strong advantage over defenders.
Storm-1175 chains multiple exploits to gain deeper access, as seen in attacks on Microsoft Exchange where it moved from initial access to remote code execution. The group also targets Linux systems and has used zero-day flaws before public disclosure, showing advanced skills.
After gaining access, it installs web shells or remote tools, creates admin accounts, and moves laterally using tools like PowerShell, PsExec, RDP, and Cloudflare tunnels. It also abuses legitimate RMM tools and software like PDQ Deployer and Impacket to spread across networks. The attackers can deploy ransomware in as little as one day, highlighting their speed and efficiency.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, China)
Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware.
The company states that two flaws have public PoCs and could let unauthenticated attackers cause DoS conditions.
“Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations.” reads the advisory.
The flaws, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, affect ClamAV parsers for several file formats. ClamAV fixed them in version 1.5.4, Cisco later warned that public PoCs are available for the vulnerabilities CVE-2026-20337 and CVE-2026-20338. Company’s PSIRT said it has no evidence that attackers have exploited these vulnerabilities in the wild.
“”The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.The Cisco PSIRT is not aware of proof-of-concept exploit code for any of the other vulnerabilities that are described in this advisory.” continues the advisory. “The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.”
Below are the descriptions of CVE-2026-20337 and CVE-2026-20338:
Cisco identified the affected products in its advisory and recommends customers check the related bug IDs for details on each vulnerability.
| Affected Cisco Software Platform | CVSS Base Score | Security Impact Rating | Cisco Bug IDs | First Fixed Release |
|---|---|---|---|---|
| Secure Endpoint Connector for Linux | 5.3 | Medium | CSCwv87285 | Release no. TBD (Aug 2026) |
| Secure Endpoint Connector for Mac | 5.3 | Medium | CSCwv87286 | Release no. TBD (Aug 2026) |
| Secure Endpoint Connector for Windows | 7.5 | High | CSCwv87283 | Release no. TBD (Aug 2026) |
Secure Endpoint Private Cloud is not affected, but must distribute the fixes to endpoints.
Cisco said no workaround is available. Patches will be released in August. The flaws are high risk on Windows because ClamAV runs with elevated privileges, while macOS and Linux face medium risk.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)
Security lapse leaves sensitive information and contact details of 51 government officials exposed for 40 hours
The public body in charge of the UK’s state investments has been pushed to improve its internal security after a data breach left “high-level management information” publicly accessible for nearly two days.
UK Government Investments (UKGI), the agency that manages the taxpayers’ interest in a swathe of companies including Channel 4 and the Post Office, said the security failure also left more than 50 government officials’ personal details exposed for nearly 40 hours.
Continue reading...
© Photograph: Marina Demidiuk/Alamy
© Photograph: Marina Demidiuk/Alamy
© Photograph: Marina Demidiuk/Alamy
The investigation into the Odido cyberattack has uncovered possible involvement of Dutch nationals, according to Dutch police, as authorities continue to investigate the ShinyHunters ransomware-linked attack that exposed the personal data of approximately 6.39 million customers. Law enforcement has urged the public to come forward with information as investigators work to identify those responsible for one of the country's largest telecom data breaches.
The cyberattack took place on February 5 and 6 after attackers allegedly used voice phishing (vishing) to deceive Odido's customer service team.
According to the company, the attackers posed as members of its internal IT staff, gaining unauthorized access before exfiltrating customer data. Odido said its teams detected the unauthorized access immediately on both occasions and revoked the attackers' access, but the incident still resulted in a large-scale data breach.
Under the direction of the National Public Prosecution Service, the High Tech Crime Team (THTC) of the National Investigation and Intervention Unit launched an extensive investigation into the breach.
Authorities said investigators have found strong indications that Dutch criminals may have been involved. One key lead centers on a phone call made shortly before the breach in which a Dutch-speaking man allegedly impersonated an Odido IT employee while speaking with customer service representatives. Police are continuing efforts to identify the caller and have indicated that his voice could be made public if necessary.
Investigators believe people within cybercrime circles may have information about those responsible and are encouraging anyone with relevant details to contact law enforcement.
Odido attributed the attack to the cybercriminal group ShinyHunters, which the company said carried out the social engineering campaign.
Chief Executive Officer Søren Abildgaard acknowledged the incident in a public statement, apologizing to customers and outlining the company's commitment to strengthening its cybersecurity capabilities. He said Odido would continue investing in security, improve data protection practices, expand customer support, and share lessons learned from the incident.
The CEO also explained why the company refused to pay the ransom demand. According to Odido, paying cybercriminals would reward illegal activity and could encourage future attacks against other Dutch organizations. The company said the decision was made following guidance from authorities, despite knowing that stolen data could eventually be published.
Odido confirmed that approximately 6.39 million active and former customers of Odido and its Ben brand were affected by the breach. Customers of Simpel were not impacted.
The exposed information varied by individual and included names, addresses, mobile phone numbers, customer numbers, email addresses, IBAN numbers, dates of birth, identification details, nationality, and gender.
The company clarified that My Odido account passwords, call records, location data, billing information, and scans of identity documents were not compromised.
Odido also addressed reports claiming customer passwords had been leaked, stating that login passwords remain securely encrypted and were never accessible during the attack. Instead, a separate telephone verification field known as "password_c," used as a customer challenge code, was included for a limited number of customers. The company has since discontinued using that verification method.
Following the breach, Odido increased customer support by adding more than 140 service agents and introduced additional security measures. These include its "Check je Gesprek" verification service, allowing customers to confirm whether communications claiming to be from Odido are legitimate, along with access to the F-Secure digital security service.
The telecom provider said all customers identified as affected have been notified by email or SMS, while customer service teams continue assisting users with questions related to their specific data exposure.
Meanwhile, Dutch authorities expect investigations into the Odido cyberattack to continue for several months. Police have also warned that cyberattacks targeting businesses and institutions are becoming increasingly common, urging organizations to strengthen cybersecurity defenses and encouraging citizens to remain vigilant against follow-on fraud and phishing attempts.
request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0Reported to Cisco by Mandiant, CVE-2026-20245 affects the command-line interface of Cisco Catalyst SD-WAN Controllers and allows an authenticated local attacker to execute arbitrary commands as root through a specially crafted file. The malicious payload backed up configuration files, preserved copies of /etc/passwd and /etc/shadow, and created a new root-level account named troot. Mandiant later observed the threat actor switching from the admin account to troot using the su command.
Microsoft Threat Intelligence has been tracking a clipboard-stealing malware (Clipper) campaign since February 2026 that targets cryptocurrency wallets. A clipper is a type of malicious software that monitors and manipulates your clipboard, the temporary memory where data is stored when you copy and paste.
It spreads through malicious shortcut files on USB drives, hides its command server inside the Tor network, and can replace wallet addresses in your clipboard before you paste them. The attacker collects the crypto; you collect the confusion.
What makes it harder to spot is that this clipper doesn’t use a traditional installer or expose any real IP addresses. It ships with its own Tor client, routes traffic through a local proxy on port 9050, and resolves everything to .onion domains inside Tor.
“The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution.” reads the report published by Microsoft. “The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure. Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”
The attack chain starts when someone opens a .lnk shortcut file from a USB drive. The malware then scans the device for document files like .doc, .xlsx, and .pdf, hides the originals, and replaces them with malicious shortcuts carrying the same names. Open what you think is a spreadsheet and you’re running malware. It also sets up scheduled tasks to copy itself onto any new USB drive that gets plugged in.
Malware steals crypto data from clipboard by capturing BIP39 seed phrases and private keys, exfiltrates via Tor, and sends screenshots for context.
“The malware detects 12 or 24-word BIP39 seed phrases in clipboard data. It saves the seed to local file (GOOD path) as a backup and exfiltrates it to the C2 domain via Tor.” states the report. “It retries network transmission until it is acknowledged and deletes local backup after successful transmission.”
Beyond seed phrases, it also grabs Ethereum and Bitcoin WIF private keys, and checks the clipboard every 500 milliseconds for wallet addresses across Bitcoin, Ethereum, Tron, and Monero. When it finds one, it swaps it out for an attacker-controlled address that partially resembles the original, so a quick glance won’t catch the swap.
The stealer also takes five screenshots every ten seconds and sends them over Tor, giving the attacker a live view of what the victim is doing with their wallet. There’s also a remote code execution channel: the C2 can send an EVAL instruction, the malware downloads JavaScript into a file called “cfile,” and runs it. That turns what looks like a simple crypto thief into something with full backdoor potential.
Microsoft researchers highlight that all the malware components are encrypted and only decrypted at runtime, wrapped in PyArmor-obfuscated Python and packaged with PyInstaller. The JavaScript payloads get two layers of obfuscation on top of that. It also checks for Task Manager before doing anything, and exits if it’s running.
“For defenders, the strongest signals are behavioral: script interpreters spawning suspicious child processes, localhost:9050 proxy usage, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.” Microsoft continues.
Microsoft Defender for Endpoint detects components of this threat and flags it as Trojan:Win32/CryptoBandits.A. If you’re handling any sensitive financial workflows, monitoring wscript.exe and cscript.exe activity and blocking .lnk execution from removable drives via Group Policy are the right places to start.
“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking.” concludes the report. “The combination of Tor-routed C2, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, clipper)
Entrar