Vulnerability—for which a proof-of-concept is forthcoming—is one of a string of flaws the company fixed that could lead to an attack chain.

https://threatpost.com/vmware-patch-critical-bug/180346/

DMARC analysis by Proofpoint shows that institutions in the U.S. have among some of the poorest protections to prevent domain spoofing and lack protections to block fraudulent emails.

https://threatpost.com/universities-email-cyber-risk/180342/

Recent LofyLife campaign steals tokens and infects client files to monitor various user actions, such as log-ins, password changes and payment methods.

https://threatpost.com/malicious-npm-discord/180327/

The increased proliferation of IoT devices paved the way for the rise of IoT botnets that amplifies DDoS attacks today. This is a dangerous warning that the possibility of a sophisticated DDoS attack and a prolonged service outage will prevent businesses from growing.

https://threatpost.com/ddos-attacks-prepared/180273/

Feds urge U.S. agencies to patch a Microsoft July Patch Tuesday 2022 bug that is being exploited in the wild by August 2.

https://threatpost.com/cisa-urges-patch-11-bug/180235/

A radio control system for drones is vulnerable to remote takeover, thanks to a weakness in the mechanism that binds transmitter and receiver.

https://threatpost.com/drone-hack-expresslrs-hijacked/180133/

The heap buffer overflow issue in the browser’s WebRTC engine could allow attackers to execute arbitrary code.

https://threatpost.com/actively-exploited-chrome-bug/180118/

Devices from Cisco, Netgear and others at risk from the multi-stage malware, which has been active since April 2020 and shows the work of a sophisticated threat actor.

https://threatpost.com/zuorat-soho-routers/180113/

LIVE EVENT, MONDAY JULY 11: Join Threatpost and Intel Security’s Tom Garrison in a live conversation about innovation enabling stakeholders to stay ahead of a dynamic threat landscape and what Intel learned from their latest study in partnership with Ponemon Institue.

https://threatpost.com/webinars/secure-systems-start-with-hardware/

Attacks against U.S. companies spike in Q1 2022 with patchable and preventable external vulnerabilities responsible for bulk of attacks.

https://threatpost.com/lead-causes-of-q1-attacks/180096/

Researchers warn threat actors are using a novel remote code execution exploit to gain initial access to victim’s environments.

https://threatpost.com/mitel-voip-bug-exploited/180079/

CISA warns that threat actors are ramping up attacks against unpatched Log4Shell vulnerability in VMware servers.

https://threatpost.com/log4shell-targeted-vmware-data/180072/

The APT is pairing a known Microsoft flaw with a malicious document to load malware that nabs credentials from Chrome, Firefox and Edge browsers.

https://threatpost.com/fancy-bear-nuke-threat-lure/180056/

Culture of ‘insecure-by-design’ security is cited in discovery of bug-riddled operational technology devices.

https://threatpost.com/discovery-of-56-ot-device-flaws-blamed-on-lackluster-security-culture/180035/

Evidence suggests that a just-discovered APT has been active since 2013.

https://threatpost.com/apt-flew-under-radar-decade/179995/

A government-aligned attacker tried using a Microsoft vulnerability to attack U.S. and E.U. government targets.

https://threatpost.com/follina-exploited-by-state-sponsored-hackers/179890/

The vulnerability remains unpatched on many versions of the collaboration tool and has potential to create a SolarWinds-type scenario.

https://threatpost.com/public-exploits-atlassian-confluence-flaw/179887/

Hackers escalate phishing and scamming attacks to exploit popular Discord bot and persuade users to click on the malicious links.

https://threatpost.com/scammers-target-nft-discord-channel/179827/

Threat actors already are exploiting vulnerability, dubbed ‘Follina’ and originally identified back in April, to target organizations in Russia and Tibet, researchers said.

https://threatpost.com/microsoft-workaround-0day-attack/179776/

The malvertiser’s use of PowerShell could push it beyond its basic capabilities to spread ransomware, spyware or steal data from browser sessions, researchers warn.

https://threatpost.com/chromeloader-hijacker-threats/179761/