Latest News from Bleeping Computer

• FBI disrupts Chinese hacking tools used to breach critical infrastructure

  The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in attacks that breached critical infrastructure and other organizations worldwide. [...]

• Ransomware attack disrupts Japan's IDCF Cloud used by govt clients

  IDC Frontier, a major Japanese cloud and digital infrastructure company, disclosed that its IDCF Cloud service was targeted in a ransomware attack that caused an outage at a data center cluster serving the eastern part of the country. [...]

• Low-cost Android phones ship with residential proxy malware

  A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]

• FakeGit malware campaign returns with 17,610 malicious GitHub repos

  More than 17,000 fake repositories on GitHub are distributing the SmartLoader malware after the FakeGit campaign reactivated earlier this month to push the StealC infostealer. [...]

• Cisco warns of critical flaws allowing Nexus switch takeover

  Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system that could be exploited to run arbitrary code with root privileges on Nexus switches. [...]

• OAuth grants pile up faster than you can review them. Here's how to keep up.

  OAuth grants create data highways between SaaS apps, AI agents, and other tools. And, they are multiplying faster than any security team can review them. As the recent Klue breach showed, attackers are taking notice and exploiting forgotten OAuth grants to gain access to corporate data. This article covers why OAuth risks are so hard [...]

• Uranium crypto exchange hacker convicted for stealing $53 million

  A Maryland man was found guilty of stealing more than $53 million after hacking the decentralized crypto exchange Uranium Finance twice in April 2021. [...]

• Microsoft Teams to get support for third-party deepfake detection tools

  Microsoft will soon introduce support for third-party deepfake detection solutions and impersonation protection in Teams meetings. [...]

• ASOS links data breach to social engineering attack, credential theft

  ASOS is sending updates to affected customers about the cybersecurity incident it suffered earlier this week, confirming that hackers accessed some personal data. [...]

• Owner of Empire cybercrime market gets 40 years in prison

  The co-creator of Empire Market, one of the largest dark web marketplaces before its shutdown, has been sentenced to 40 years in prison for facilitating $430 million in illegal transactions from 2018 to 2020. [...]