Typosquatted Go Packages Deliver Malware Loader Targeting Linux and macOS Systems

https://socket.dev/blog/typosquatted-go-packages-deliver-malware-loader

Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign

Analysys:

https://blog.talosintelligence.com/new-persistent-attacks-japan/

StopRansomware: Medusa Ransomware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a

GitHub Actions - tj-actions/changed-files action is compromised

The tj-actions/changed-files GitHub Action, which is currently used in over 23,000 repositories, has been compromised. In this attack, the attackers modified the action’s code and retroactively updated multiple version tags to reference the malicious commit...

https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html

Technical Explanation of NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File

https://cti.monster/blog/2025/03/18/CVE-2025-24071.html

Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants

https://www.sentinelone.com/blog/readerupdate-reforged-melting-pot-of-macos-malware-adds-go-to-crystal-nim-and-rust-variants/

Have I Been Pwned owner Troy Hunt’s mailing list compromised in phishing attack

https://www.itpro.com/security/phishing/have-i-been-pwned-owner-troy-hunts-mailing-list-compromised-in-phishing-attack

Exposing Crocodilus: New Device Takeover Malware Targeting Android Devices

Crocodilus enters the scene not as a simple clone, but as a fully-fledged threat from the outset, equipped with modern techniques such as remote control, black screen overlays, and advanced data harvesting via accessibility logging. This report explores the features of Crocodilus, its links to known threat actors, and how it lures victims into helping the malware steal their own credentials:

https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices

Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims

https://www.wiz.io/blog/postgresql-cryptomining

wsrp4echo - 0day Chain Vulnerability

Web Services for Remote Portlets (WSRP) is an OASIS-approved network protocol standard designed for communications with remote portlets. Uses in:

- Oracle WebCenter
- IBM WebSphere
- Microsoft SharePoint

https://medium.com/@aryanchehreghani/wsrp4echo-0day-chain-vulnerability-fd2c395dc45b

P.S. Thx Reaza for the link 🤝

ImageRunner: A Privilege Escalation Vulnerability Impacting GCP Cloud Run

https://www.tenable.com/blog/imagerunner-a-privilege-escalation-vulnerability-impacting-gcp-cloud-run

Threat actors leverage tax season to deploy tax-themed phishing campaigns

https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/

Incomplete NVIDIA Patch to CVE-2024-0132 Exposes AI Infrastructure and Data to Critical Risks

https://www.trendmicro.com/en_us/research/25/d/incomplete-nvidia-patch.html

🎉 OpenBLD.net на AppSecFest 2025!

25 апреля встречаемся на AppSecFest 2025 — крупнейшем событии года в мире прикладной безопасности.

В этом году организаторы второй год подряд поддерживают OpenBLD.net — и это чертовски приятно!

У нас будет собственная стилизованная стойка, экран для демонстрации технологий, а логотип OpenBLD.net появится на официальном сайте фестиваля. Это действительное признание того, что мы делаем действительно важное дело 💪

Что будет на нашем стенде:

• Футболки и стикеры
• Живые демки технологий OpenBLD.net
• А самое главное — возможность пообщаться, обсудить идеи, задать вопросы и вдохновиться

Если вы интересуетесь DNS-безопасностью, фильтрацией вредоносных доменов, приватностью и киберзащитой — обязательно загляните к нам. Увидимся на AppSecFest 2025!

• Подробнее о проекте: openbld.net
• О фестивале: appsecfest.kz

P.S. И да, дорогой друг — у тебя есть шанс попасть на мероприятие вместе с нашей командой 😉

MITRE Ends? US Geoverment ends support MITRE. CVE released emergency article about it:

https://www.thecvefoundation.org/home

Letter:

https://www.linkedin.com/posts/tib3rius_breaking-from-a-reliable-source-mitre-activity-7317960862332293120-t6yt

CVE-2025-24054, NTLM Exploit in the Wild

CVE-2025-24054 is a vulnerability related to NTLM hash disclosure via spoofing, which can be exploited using a maliciously crafted .library-ms

CVE-2025-24054, which also allows NTLM hash disclosure with very little user interaction. For CVE-2025-24054, users can trigger the attack simply by right-clicking or navigating to the folder that holds the maliciously crafted .library-ms file...

Research:

https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/

Introducing ToyMaker, an initial access broker working in cahoots with double extortion gangs

https://blog.talosintelligence.com/introducing-toymaker-an-initial-access-broker

Fotinet zero day RCE - Stack-based buffer overflow vulnerability in AP

Status - Critical

https://fortiguard.fortinet.com/psirt/FG-IR-25-254

Valve Probes 89 Million Steam Data Leak

https://observervoice.com/valve-probes-89-million-steam-data-leak-117641/

A note about the security of your Steam account

https://steamcommunity.com/games/593110/announcements/detail/533224478739530146