Cybersecurity News - Page 17

PeckBirdy is JScript-based, which allows it to run across different environments using legitimate system tools.

The extensions share a common mechanism that hijacks ChatGPT session authentication tokens and sends them to a third-party backend.

The attack begins with a fake CAPTCHA verification that instructs victims to manually paste and run a command using the Windows Run dialog.

Patches are currently available for most supported versions, but updates for Office 2016 and Office 2019 have not yet been released.

CISA has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

The attack chain begins with a Discord-hosted link that delivers a ZIP archive containing a PDF lure and a malicious Windows shortcut (LNK).

The attack uses social engineering lures delivered via business-themed documents.

The attacks targeted two combined heat and power plants, as well as a system used to manage electricity generated from renewable sources.

In brief: Cisco fixes two zero-days, flaws in Fortinet’s FortiGate and FortiSIEM solutions exploited in the wild, and more.

Also, attackers are reportedly exploiting a patch bypass for a previously fixed critical Fortinet FortiGate authentication vulnerability.