Security News | HKCERT

700+ Malicious Android Apps Abusing NFC Relay to Exfiltrate Banking Login Credentials

A sophisticated malware campaign exploiting Near Field Communication technology on Android devices has expanded dramatically since its emergence in April 2024. What began as isolated incidents has escalated into a widespread threat, with over 760 malicious applications now circulating in the wild. These malicious apps abuse NFC...

Cyber Security News 31 Oct 2025 1809 Views

This security hole can crash billions of Chromium browsers, and Google hasn't patched it yet

Edge, Atlas, Brave among those affected Exclusive A critical, currently unpatched bug in Chromium's Blink rendering engine can be abused to crash many Chromium-based browsers within seconds, causing a denial-of-service condition – and, in some...

The Register 30 Oct 2025 6057 Views

Ransomware profits drop as victims stop paying hackers

The number of victims paying ransomware threat actors has reached a new low, with just 23% of the breached companies giving in to attackers' demands. [...]

Bleepingcomputer 28 Oct 2025 2247 Views

706,000+ BIND 9 Resolver Instances Vulnerable to Cache Poisoning Exposed Online – PoC Released

A high-severity vulnerability in BIND 9 resolvers has been disclosed, potentially allowing attackers to poison caches and redirect internet traffic to malicious sites. Tracked as CVE-2025-40778, the flaw affects over 706,000 exposed instances worldwide, as identified by internet...

Cyber Security News 26 Oct 2025 2019 Views

Hackers Weaponizing Telegram Messenger with Dangerous Android Malware to Gain Full System Control

A sophisticated backdoor named Android.Backdoor.Baohuo.1.origin has been discovered in maliciously modified versions of Telegram X messenger, granting attackers complete control over victims’ accounts while operating undetected. The malware infiltrates devices through deceptive in-app advertisements and third-...

Cyber Security News 26 Oct 2025 1799 Views

Toys “R” Us Canada warns customers' info leaked in data breach

Toys "R" Us Canada has sent notices of a data breach to customers informing them of a security incident where threat actors leaked customer records they had previously stolen from its systems. [...]

Bleepingcomputer 24 Oct 2025 1903 Views

Critical Vulnerability in MCP Server Platform Exposes 3,000+ Servers and Thousands of API Keys

A critical vulnerability in Smithery.ai, a popular registry for Model Context Protocol (MCP) servers. This issue could have allowed attackers to steal from over 3,000 AI servers and take API keys from thousands of users across many services. MCP powers AI...

Cyber Security News 23 Oct 2025 1919 Views

Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added five security flaws to its Known Exploited Vulnerabilities (KEV) Catalog, officially confirming a recently disclosed vulnerability impacting Oracle E-Business Suite (EBS) has been weaponized in real-...

The Hacker News 21 Oct 2025 1833 Views

TikTok videos continue to push infostealers in ClickFix attacks

Cybercriminals are using TikTok videos disguised as free activation guides for popular software like Windows, Spotify, and Netflix to spread information-stealing malware. [...]

Bleepingcomputer 20 Oct 2025 1928 Views

Malicious crypto-stealing VSCode extensions resurface on OpenVSX

A threat actor called TigerJack is constantly targeting developers with malicious extensions published on Microsoft's Visual Code (VSCode) marketplace and OpenVSX registry to steal cryptocurrency and plant backdoors. [...]

Bleepingcomputer 15 Oct 2025 2112 Views