Since September, Check Point Research (CPR) has been monitoring a new version of the Banshee macOS Stealer, a malware that steals browser credentials, cryptocurrency wallets, and other sensitive data.
Undetected for over two months, Banshee’s latest version introduced string encryption taken from Apple’s XProtect, likely causing antivirus detection systems to overlook the malware. Threat actors distributed Banshee using phishing websites and fake GitHub repositories, often impersonating popular software like Chrome and Telegram.
Read more…
Source: Check Point
Related:
- Threats in space (or rather, on Earth): Internet-exposed GNSS receivers
November 13, 2024
Global Navigation Satellite Systems (GNSS) are collections, or constellations of satellite positioning systems. There are several GNSSs launched by different countries currently in operation: GPS (US), GLONASS (Russia), Galileo (EU), BeiDou Navigation Satellite System (BDS, China), Navigation with Indian Constellation (NavIC, India) and Quazi-Zenith Satellite System (QZSS, Japan). These systems are used for positioning, navigation ...
- Fortinet Releases Multiple Security Advisories
November 13, 2024
Fortinet has released 18 security advisories to address a range of security vulnerabilities in multiple products. Three of the advisories address two high severity vulnerabilities in FortiClient for Windows and one high severity vulnerability in FortiOS affecting SSLVPN sessions. FortiClient and FortiOS provide an endpoint detection and response (EDR) solution, a virtual private network (VPN) solution, ...
- FBI: 2023 Top Routinely Exploited Vulnerabilities
November 12, 2024
In 2023, malicious cyber actors exploited more zero-day vulnerabilities to compromise enterprise networks compared to 2022, allowing them to conduct cyber operations against higher-priority targets. In 2023, the majority of the most frequently exploited vulnerabilities were initially exploited as a zero-day, which is an increase from 2022, when less than half of the top exploited vulnerabilities ...
- ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
November 12, 2024
In the race to gain a competitive edge, organizations are increasingly training artificial intelligence (AI) models on sensitive data. But what if a seemingly harmless AI model became a gateway for attackers? A malicious actor could upload a poisoned model to a public repository, and without realizing it, your team could deploy it in your environment. ...
- Tracking the recent activities of the APT-Q-27
November 12, 2024
Overview In May 2022, Qi’anxin Threat Intelligence Center published an article titled “Operation Dragon Breath (APT-Q-27): A Dimensionality Reduction Attack on the Gambling Industry”, disclosing the attack activities of GoldenEyeDog (Qi’anxin internal tracking number APT-Q-27) against the gambling industry, and at the end of the article introduced the Miuuti Group —— an attack group targeting ...
- Amazon Confirms Employee Data Was Exposed Through MOVEit Breach
November 12, 2024
In a significant development that underscores the lasting impact of 2023’s MOVEit vulnerability, Amazon has confirmed that employee data was compromised through a third-party property management vendor. The breach, revealed by a threat actor known as “Nam3L3ss,” exposes the continuing ripple effects of one of last year’s most devastating supply chain attacks. The compromise stems from ...