Hacking - Softonic English

A vulnerability in Google Chrome has exposed millions of users

The vulnerability CVE-2025-2783, which has a CVSS score of 8.3, has been actively exploited in a campaign called Operation ForumTroll, targeting organizations in Russia. According to research by Kaspersky, this vulnerability, which allows sandbox escape in Google Chrome, was used to distribute the spyware LeetAgent, developed by Memento Labs. A spyware with great potential to cause harm The operation involved sending phishing emails with customized links that, when opened in Google Chrome or Chromium-based browsers, triggered the exploitation of the vulnerability. These attacks were targeted […]

A spyware with great potential to cause harm

The operation involved sending phishing emails with customized links that, when opened in Google Chrome or Chromium-based browsers, triggered the exploitation of the vulnerability. These attacks were directed at media outlets, universities, research centers, and governments, with the main objective of carrying out espionage activities.

Memento Labs, an Italian technology and IT services company, has been under the radar since its formation in 2019, following the merger of InTheCyber Group and HackingTeam. The latter, known for selling intrusion and surveillance capabilities to governments, had suffered a hack in 2015 that exposed multiple tools and exploits.

The APT group ForumTroll, which appears to be linked to another actor known as TaxOff, shows proficiency in Russian, although not all attackers are native speakers. This suggests a targeted and not indiscriminate approach in their operations. It has been observed that the spyware Dante, which replaces RCS, is used within this chain of attacks, offering advanced protections against analysis.

Although the full extent of these attacks has not yet been completely determined, it is evident that the use of phishing techniques, as well as the connection between different tools and groups, raises serious concerns about cybersecurity in the region. Experts suggest that this is just the latest of several incidents associated with these malicious actors.

Avast Free Antivirus DOWNLOAD

A security vulnerability in Microsoft opens the door to threats from China

A recent investigation has revealed that threat actors with links to China have exploited the security vulnerability ToolShell (CVE-2025-53770) in Microsoft SharePoint. This flaw, which was disclosed and patched in July 2025, allowed significant infiltrations in critical sectors, including a major telecommunications company in the Middle East and various government institutions in Africa and South America. A more serious problem than it seems According to the threat research team at Symantec of Broadcom, CVE-2025-53770, a now-corrected authentication bypass, was exploited by several Chinese cyber-espionage groups, notably Linen Typhoon, Violet […]

A recent investigation has revealed that threat actors with links to China have exploited the ToolShell security vulnerability (CVE-2025-53770) in Microsoft SharePoint. This flaw, which was disclosed and patched in July 2025, allowed significant infiltrations in critical sectors, including a major telecommunications company in the Middle East and various government institutions in Africa and South America.

A problem more serious than it seems

According to the threat research team at Symantec of Broadcom, CVE-2025-53770, a now-patched authentication bypass, was exploited by several Chinese cyber-espionage groups, notably Linen Typhoon, Violet Typhoon, and Storm-2603. These groups have been responsible for sophisticated and diversified attacks, using tools like Zingdoor, ShadowPad, and KrustyLoader to carry out their incursions.

The attacks were not restricted to a single sector, as incidents were reported at a university in the U.S., as well as a government agency in an African country and a financial agency in Europe. The multifaceted approach of these operations suggests a strategic interest on the part of threat actors in stealing credentials and establishing persistent and stealthy access to their victims’ networks.

Additionally, it has been documented that some of the attackers also used additional vulnerabilities and DLL side-loading techniques to deliver their malicious payloads. Among these techniques is the exploitation of CVE-2021-36942, an exploit known for its privilege escalation capability, which reinforces the sophistication of their approach.

The findings of the report suggest that, while there is an overlap in the types of victims and tools used, these activities have not been definitively attributed to a specific group. However, all evidence points to the fact that behind these operations are threat actors based in China.

Windows 11 DOWNLOAD

This is CometJacking: a new way to steal all your data

Cybersecurity researchers have revealed a new attack called CometJacking, targeting the Comet browser from Perplexity. This attack is based on the injection of malicious prompts within seemingly harmless links, allowing the theft of sensitive data from connected services like Gmail and Calendar. The threat is activated by clicking on a specially designed link, which causes the browser to execute a hidden prompt, capturing personal information and sending it to a server controlled by the attacker. A very serious security issue The research has highlighted how a single poisoned link can transform an AI browser, which is […]

Cybersecurity researchers have revealed a new attack called CometJacking, aimed at Perplexity’s Comet browser. This attack is based on injecting malicious prompts into seemingly harmless links, allowing the theft of sensitive data from connected services like Gmail and Calendar. The threat is activated by clicking on a crafted link, which causes the browser to execute a hidden prompt, capturing personal information and sending it to a server controlled by the attacker.

A very serious security problem

The investigation has highlighted how a single poisoned link can transform an AI browser, which is considered a trusted assistant, into an internal threat. Michelle Levy, head of security research at LayerX, stated that “it’s not just about stealing data; it’s about hijacking the agent that already has the keys”. This type of attack bypasses Perplexity’s data protection measures using simple obfuscation tricks like Base64 encoding.

The CometJacking attack operates in five steps: it is activated when a victim clicks on a malicious link, either in a phishing email or on a webpage. Instead of directing the user to the intended destination, the link instructs the Comet browser’s artificial intelligence to execute a hidden prompt that captures user data and sends it to an endpoint controlled by the attacker.

Despite the fact that Perplexity has categorized the findings as having “no impact on security,” the situation highlights the inherent vulnerabilities of native artificial intelligence tools. Organizations must review and improve controls to detect and neutralize these malicious prompts, as attacks can escalate into widespread campaigns, turning browsers into checkpoints within corporate networks.

Avast Free Antivirus DOWNLOAD

If you use Adobe, your account could be at risk due to a critical security flaw

Adobe has issued a warning about a critical security flaw in its Commerce and Magento Open Source platforms, which could allow attackers to take control of customer accounts. This vulnerability, identified as CVE-2025-54236 and dubbed “SessionReaper,” has a score of 9.1 on the CVSS scale, indicating its high severity. According to Adobe, a potential attacker could exploit this flaw through the Commerce REST API. A problem that Adobe is aware of The flaw is described as an improper input validation error, and although the company has not confirmed the existence […]

Adobe has issued a warning about a critical security flaw in its Commerce and Magento Open Source platforms, which could allow attackers to take control of customer accounts. This vulnerability, identified as CVE-2025-54236 and dubbed “SessionReaper,” has a score of 9.1 on the CVSS scale, indicating its high severity. According to Adobe, a potential attacker could exploit this flaw through the Commerce REST API.

A problem they are aware of at Adobe

The flaw is described as an inappropriate input validation error, and although the company has not confirmed the existence of exploits in the wild, security experts such as the firm Sansec have indicated that they have been able to reproduce at least one method to exploit the vulnerability. “SessionReaper” is considered one of the most severe vulnerabilities in Magento’s history, comparable to previous incidents like Shoplift in 2015 and CosmicSting in 2024.

Adobe has responded to this threat by releasing a hotfix and web application firewall (WAF) rules to protect merchants using Adobe Commerce, specifically in the Cloud infrastructure. The recommendation for merchants is to update quickly, especially those using file-based session storage, although all merchants using Redis or database sessions are advised to take immediate action, as there are multiple ways to exploit the vulnerability.

In addition to this vulnerability, Adobe has also released fixes for a critical flaw in ColdFusion, designated as CVE-2025-54261, which can allow arbitrary writes to the file system, with a CVSS score of 9.0. This situation highlights the importance of keeping systems and applications up to date, in a context where cybersecurity is becoming increasingly crucial.

Adobe Illustrator DOWNLOAD

If you have cryptocurrency wallets, a way has been discovered in which they could steal your credentials from them

Recently, four malicious packages have been discovered in the npm registry that have the ability to steal cryptocurrency wallet credentials from Ethereum developers. These packages, uploaded by a user calling themselves ‘flashbotts’, masquerade as legitimate cryptographic utilities and the Flashbots infrastructure, while exfiltrating private keys and seed phrases to a Telegram bot controlled by the attackers. A tremendously serious security issue Among the identified packages, ‘ @flashbotts/ethers-provider-bundle’ stands out, designed to hide malicious operations behind seemingly innocuous functions. This package incorporates functionality that redirects unsigned transactions to a […]

Recently, four malicious packages have been discovered in the npm registry that have the ability to steal cryptocurrency wallet credentials from Ethereum developers. These packages, uploaded by a user calling themselves ‘flashbotts’, impersonate legitimate cryptocurrency utilities and the Flashbots infrastructure, while exfiltrating private keys and seed phrases to a Telegram bot controlled by the attackers.

A tremendously serious security problem

Among the identified packages, ‘@flashbotts/ethers-provider-bundle’ stands out, designed to hide malicious operations behind seemingly innocuous functions. This package incorporates functionality that redirects unsigned transactions to a wallet controlled by the attacker and also captures metadata from pre-signed transactions. Even more alarming, this type of deceptive handling could allow criminals to take full control of the victims’ accounts.

The attacks are designed to exploit the trust placed in Flashbots, an entity widely recognized for its role in mitigating the adverse effects of Maximal Extractable Value (MEV) on the Ethereum network. This context of trust facilitates the inadvertent adoption of these malicious packages by developers seeking legitimate tools for their projects.

Investigations indicate that malicious packages not only operate under the guise of seemingly benign functions, but can also be activated in the code of projects without the knowledge of their developers. The inclusion of comments in Vietnamese in the code suggests that the attackers may be Vietnamese speakers.

According to experts, the existence of these malicious packages turns Web3 development into a direct conduit to bots controlled by criminals, which poses a considerable risk to the security of cryptocurrency investments. The appropriation of private keys in this environment can lead to irreversible theft of funds, raising serious concerns for the Ethereum developer and user community.

Avast Free Antivirus DOWNLOAD

Be careful with QR codes, because they could be used to hack your mobile phone

Researchers have recently discovered two innovative methods being used by attackers to carry out phishing campaigns through QR codes. These methods are not only clever but also present a new challenge for digital security and the protection of personal data. A new method for introducing malware into your devices The first technique revealed involves splitting malicious QR codes into several parts. By fragmenting these codes, attackers manage to evade detection by security software that typically identifies complete QR codes as potentially dangerous. This approach allows users to fall […]

Researchers have recently discovered two innovative methods being used by attackers to carry out phishing campaigns through QR codes. These methods are not only clever but also present a new challenge for digital security and the protection of personal data.

A new method to introduce malware into your devices

The first revealed technique consists of dividing malicious QR codes into several parts. By fragmenting these codes, attackers manage to evade detection by security software that usually identifies complete QR codes as potentially dangerous. This approach allows users to fall into the trap, as fragmentation makes security analysis more difficult, thus increasing the risk of unsuspecting individuals accessing risky links.

The second technique involves embedding malicious QR codes within legitimate codes. This strategy is especially insidious, as it can lead users to scan a code that, at first glance, appears safe, but actually redirects to a website designed to steal personal information or credentials. The ability to effectively hide malware within legitimate code complicates efforts to identify and neutralize these attacks, exposing more users to significant dangers.

As the use of QR codes has increased, especially after the pandemic, these phishing methods pose a growing concern among cybersecurity experts. It is essential for users to stay alert and educate themselves about the best practices to identify and avoid these threats, such as always verifying the source before scanning a QR code, as well as using trusted security tools.

Investigations continue to better understand these new threats and develop effective solutions that can protect users against this type of emerging attacks.

Avast Free Antivirus DOWNLOAD

Cisco has been hacked! Names, addresses, emails, and phone numbers exposed on the Internet

Cisco has confirmed that it was the victim of a cyber attack that compromised the basic information of registered users on its Cisco.com platform. The incident was facilitated by a vishing attack, in which an employee was manipulated into providing access to corporate systems. The company became aware of the problem on July 24, 2025, when an attacker managed to access a third-party customer relationship management (CRM) system used by the company. They have mounted a Cisco The stolen information includes names, organization names, physical addresses, user IDs assigned by Cisco, emails […]

Cisco has confirmed that it was the victim of a cyber attack that compromised the basic information of registered users on its Cisco.com platform. The incident was facilitated by a vishing attack, in which an employee was manipulated into providing access to corporate systems. The company became aware of the issue on July 24, 2025, when an attacker managed to access a third-party customer relationship management (CRM) system used by the company.

They have made a mess

The stolen information includes names, organization names, physical addresses, user IDs assigned by Cisco, email addresses, and phone numbers. However, the company emphasized that no passwords or any sensitive data were compromised, which could have increased the risk for its users and customers.

The vishing attack highlights the growing threat of social engineering tactics, which aim to manipulate employees to gain access to internal systems. Cisco acted quickly to terminate the attacker’s access and launched a comprehensive investigation to assess the magnitude of the incident. The company emphasized that the intrusion was limited to a specific CRM and that other internal systems, products, or services were not affected.

As part of its remediation efforts, Cisco is implementing additional security protocols and re-educating its staff on how to recognize and defend against these increasingly sophisticated types of attacks. “We apologize for any inconvenience this incident may have caused,” the company stated, encouraging its customers and partners to reach out to their respective account teams for support.

Finally, Cisco has begun to inform the relevant data protection authorities and will notify affected users when necessary, thus complying with regulatory requirements.

iPhones can be hacked just by receiving a text

This bug can allow hackers access to all of your personal data just by receiving an iMessage!

We’ve all had close calls when it comes to getting our phones hacked.

Sometimes we click on a malicious link while browsing the internet. Sometimes we download a shady app that is sending data in the background. All of these things typically boil down to our own human error whether it be from lack of knowledge, or taking a chance on a shady app. However, it was recently discovered that an iPhone can be hacked simply by receiving an iMessage. This has brought more attention to a relatively new type of hacking tool known as “interaction-less” bugs.

Should I be worried?

At the Black Hat Security Conference this week, a Google Project Zero researcher showed that there are “interaction-less” bugs in iMessage that hackers can exploit to gain control. Once hackers gain control, they will be able to access your personal data on your phone.

You can click here to see the researcher’s full slideshow presentation.

The bugs were found by looking for flaws while reverse engineering iMessage. The researcher, Natalie Silvanovich, did not find any similar bugs in Android phones. However, throughout the years, she and her team have found similar bugs in apps like WhatsApp and FaceTime.

Ultimate Online Privacy Guide

Read Now ►

What should I do?

The best thing you can do is to make sure you are updating your phone whenever you can. According to Silvanovich, Apple has already patched six of these bugs in updates.

You should also run regular virus scans on your phone to make sure that you are virus-free. We highly recommend using Malwarebytes since it is both free and efficient.

Malwarebytes Download now ►

You can also block texts from unknown numbers so that you won’t hear from them again. To do this, follow these steps:

1. Go to the Messages app

2. Tap on the spam message you received to open it

3. Tap at the top of your phone until the “Info” button appears.” Tap “Info”

4. Tap on the number at the top of the screen

5. Scroll down to the bottom, and tap “Block this Caller”

6. You should stop receiving texts from this number altogether

If you do receive a shady text from an unknown number, you should block the caller, and then run Malwarebytes. Once you’re done, check and make sure that your phone is up to date.

Wrapping up

Although there is virtually no chance that your up-to-date iPhone will be hacked through this method, the question now remains: “How did Apple leave this vulnerability in the first place?” If you’re spending hundreds of dollars on an iPhone, you should rest assured that it won’t be easy for a hacker to access your personal data. Just recognize that your security depends on your vigilence.

Airport charging stations could give your phone malware

Think twice before charging your device in public.

By 2019, you probably know it’s not safe to hop on the internet without a safety net in place: Anti-malware protection, a firewall, a solid VPN, and a secure password manager. We create quintillions of bytes of data every day, and it’s easy to make an innocent mistake that puts it at risk. Now that innocent mistake can include plugging your phone into a charger at an airport.

10 tips to keep your data private

Keep your data under lock and key

It’s no secret that public Wi-Fi can be sketchy at best, and while it’s convenient to charge your phone at the nearest port, it’s not necessarily safe. Free public phone chargers can be used to secretly install malware on your device, malware that can eat up your data in a process called “juice jacking.”

What’s juice jacking?

It sounds like tinfoil hat propaganda, but in reality, it’s an underrated but serious security threat. ‘Juice jacking’ was coined back in 2011, and refers to a hack attempt that uses public charging terminals to install malware on your device. It does so covertly via USB charging port, and it copies your phone’s data, pictures, and email into someone else’s hands.

“All they really need to do is load malware on the USB port,” explains IBM cybersecurity expert Charles Henderson. It’s unlikely you’ll even know it’s happened until it’s too late. “There’s really no way to tell,” says Henderson. “You really have to be extremely technologically savvy to detect such an attack.”

IBM (ie @angus_tx from @xforcered) warns of increased cyber threats while traveling https://t.co/RzaPa4AqSo

— X-Force Red (@xforcered) May 28, 2019

3 easy solutions to stay safe in airports

1. Use a portable charger

The best thing you can do is avoid airport charging terminals altogether. These days it’s not too hard to get your hands on a cheap, reliable portable charger. It’s a safe, convenient way to keep your phone charged and ready to go without putting your data at risk with a public outlet.

Top 5 portable chargers

Which is the best portable charger?

2. Use an electrical outlet instead

It should also be noted juice jacking can’t be done unless it’s via USB, so as long as you opt for an electrical outlet instead you’ll be safe.

3. Turn off your phone first

Lastly, if you’re in a situation where you’ve got no choice but to charge with a public USB port, completely powering off the device beforehand will prevent the download and transfer of your data.

Luckily, preventing your phone from being juice jacked is pretty easy. Just remember that any time you use public charging stations or Wi-Fi, your online activity could be at risk. Follow these easy steps, and stay informed!

Ultimate Online Privacy Guide

Read Now ►

How to tell if your PC is cryptojacked

What is cryptojacking and how do you know if you’re affected?

There are a lot of reasons a computer could be slow: Excessive programs running in the background; bloated temp files; a corrupted hard drive; or if you’re unlucky, it could be malware and viruses. One particularly sinister emerging threat is cryptojacking, which can increase overheating, slow down processing speed, and drain your batteries – all under the radar.

5 ways to make your computer run faster

Speed up your PC ►

What is cryptojacking?

Cryptojacking is when someone takes hold of your computer to mine cryptocurrency. Often, hackers will ensnare you by infecting a website or online ad with an infected JavaScript code. The code auto-executes once loaded into your browser. Alternatively, a hacker might lure you into clicking a malicious link in an email. Once you click it, it uploads a cryptomining code to your computer and suddenly your processing power is getting leeched to an outside source.

Why would someone bother doing this?

Money.

Cryptojacking allows someone with malicious intent to steal computing resources from a victim’s device instead of having to build their own dedicated cryptomining computer. In this way, they can compete against sophisticated cryptomining operations without any of the costly overhead.

Stay protected

Even on a healthy computer, it’s tough to track the origin of a program that’s draining all your CPU. It’s harder still when you’re trying to do so on an infected computer that’s slow as dirt. Troubleshooting when your computer can barely chug along is a nightmare. As such, the best way to deal with cryptojacking threats is to not get infected in the first place.

Top 5 anti-malware tools

What's the best anti-malware tool? ►

A smart, secure browser is your first line of defense – especially one that can block JavaScript. While this effectively closes any door on a cryptojacking attempt, the obvious drawback is that blocking JavaScript will also cull functions that you like and need. The best middle ground is Opera, a browser that’s been fighting the cryptojacking war since before we even knew about it. If you install Opera on your mobile device, it’ll actually block risky mining scripts when visiting a site. It’s analyzed over 100 mined websites, and noted how smartphones such as the Galaxy S8 or HTC One suffered reduced performance when exposed to cryptojacking.

You can also download an extension like No Coin which blocks miners using your computer resources without consent. Opera even comes with the extension already installed on download.

Lastly, Opera even made this cool test to tell you whether you’ve been cryptojacked. If you’re a regular user of cryptocurrency, it might be a good idea to bookmark the page.

Using Opera in tandem with a strong anti-malware tool will help keep your PC protected from cryptojacking attempts, but it always helps to take extra precautions before clicking on that sketchy email, or opening a link that you don’t trust. Stay frosty, and stay tuned with Softonic for more tips and tricks to keep protect your computer protected.

Opera Download free ►