Researchers at Tenable have exploited a vulnerability in Microsoft's Copilot Studio tool to make external HTTP requests that could access sensitive information on internal services within a cloud environment, potentially affecting multiple tenants. The researchers found and exploited a Server-Side Request Forgery (SSRF) vulnerability in the chatbot creation tool. The exploitation of this flaw allowed them to access Microsoft's internal infrastructure, including the Instance Metadata Service (IMDS) and internal Cosmos DB instances.

"Velvet Ant," a skilled China-linked espionage group, has compromised edge devices and network appliances to improve stealth and persistence. On July 1, 2024, Cisco detailed a Command Line Interface (CLI) command injection vulnerability impacting NX-OS software used by its Nexus switches. On the same day, Sygnia announced its discovery of this vulnerability exploited by the threat group it tracked as Velvet Ant. Sygnia has now released more information on Velvet Ant's tactics, techniques, and procedures (TTPs).

A new Android malware phishes card details and sends them to an attacker for ATM withdrawals. According to researchers at ESET, the crimeware campaign has targeted customers at three Czech banks. After a multi-stage phishing campaign, the victim unknowingly downloads "NGate" malware. After it is installed and opened, NGate displays a fake website that requests the victim's banking information and sends it to the attacker's server. The feature named "NFCGate" relays Near Field Communication (NFC) data between victim and attacker devices.

"Cthulhu Stealer," a recently discovered malware, has been targeting macOS users, posing another significant cybersecurity threat to Apple's operating system. Cado Security has identified the tool as a Malware-as-a-Service (MaaS) that disguises itself as legitimate software using Apple disk images (DMG). The Cthulhu Stealer mainly steals sensitive information from its victims, such as credentials and cryptocurrency wallets. This article continues to discuss findings regarding Cthulhu Stealer.

Over two years after the Log4j zero-day caused global chaos, organizations still face exploits that push cryptocurrency miners and malicious backdoor scripts. Researchers at Datadog Security Labs have found that cybercriminals are still using "Log4Shell" exploits to avoid detection and plant malware scripts on unpatched corporate systems. This article continues to discuss the continued impact of the Log4Shell vulnerability.

Cisco recently announced patches for multiple vulnerabilities across its products, including a high-severity bug in its enterprise collaboration solutions.  Tracked as CVE-2024-20375, the high-severity issue (CVSS score of 8.6) impacts the SIP call processing function of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) and can be exploited remotely, without authentication.

New cybersecurity rules have been proposed by the Federal Aviation Administration (FAA) to mitigate vulnerabilities caused by the interconnectedness of modern aircraft.  The proposal, published in the Federal Register on August 21, highlighted the current trend in aircraft design of increased integration of airplane, engine, and propeller systems with internal or external data networks and services.

A security researcher named John Blackbourn, through the Patchstack zero-day bug bounty program, has discovered a critical vulnerability in the LiteSpeed Cache plugin, potentially exposing millions of WordPress sites to severe security risks. The researcher noted that the vulnerability allows unauthorized users to gain administrator-level access and could lead to installing malicious plugins and compromising affected websites.  The researcher said the vulnerability arises from the plugin’s weak security hash used in its user simulation feature.

Researchers at Check Point found that a suspected developer of the "Styx Stealer" malware made an Operational Security (OPSEC) mistake, leaking client and earnings data from his computer. Styx Stealer collects browser data and cryptocurrency, as well as instant messenger sessions from Telegram and Discord. The developer's significant error and data leak from his computer gave Check Point a lot of intelligence.

Cryptojacking attackers are targeting poorly protected PostgreSQL databases running on Linux machines. Aqua Security researchers observed the attack on a honeypot system, which began with the threat actors brute-forcing access credentials. Once access is gained, the threat actor creates a new user role with login capability and high privileges, strips the user role they compromised of superuser privileges, and more. The first payload, "PG_Core," mainly removes cron jobs for the current user and terminates processes associated with other cryptomining malware.