According to security researchers at Zscaler, a threat actor has been distributing remote access Trojans (RATs) on Android and Windows operating systems using online meeting lures.  The researchers noted that this campaign has been ongoing since at least December 2023.  The distributed RATs include Android-focused SpyNote RAT, Windows-focused NjRAT, and DCRat.  The researchers said that to lure the victims into downloading the RATs, the threat actor created several fake online meeting sites, impersonating brands like Microsoft-owned Skype, Google Meet, and Zoom.

Android recently announced security updates that resolve 38 vulnerabilities, including two critical severity issues in the System component.  Impacting Android 12, 12L, 13, and 14, and tracked as CVE-2024-0039 and CVE-2024-23717, the two critical flaws could lead to remote code execution and elevation of privilege, respectively.  Google noted that the most severe of these issues is a critical security vulnerability in the System component that could lead to remote code execution with no additional execution privileges needed.

The US cybersecurity agency CISA recently added flaws impacting Pixel phones and Sunhillo software to its Known Exploited Vulnerabilities (KEV) catalog.  The exploited Pixel vulnerability is tracked as CVE-2023-21237.  The flaw was patched in June 2023, and Google warned that it had been aware of “limited targeted exploitation,” but the company published its security bulletin for Pixel phones a week after the general Android security bulletin, and CVE-2023-21237 went unnoticed.

Facebook and Instagram users worldwide have been logged out of the sites and are having trouble logging in, receiving errors that their passwords are incorrect.  This recent outage affects people worldwide, including the USA, Europe, and Asia.  Downdetector, a website that tracks when online services stop working, has received numerous reports indicating that the outage is not isolated to a specific region or country.

According to security researchers at Cisco Talos, the hacking group GhostSec has significantly increased its malicious activities over the past year.  This surge includes the emergence of GhostLocker 2.0, a new variant of ransomware developed by the group using the Golang programming language.  The researchers noted that GhostSec, in collaboration with the Stormous ransomware group, has been conducting double extortion ransomware attacks across multiple countries and business sectors.