A deceptive conference registration form is the latest weapon in a stealthy cyberattack targeting attendees of the U.S.-Taiwan Defense Industry Conference. The attackers leveraged a deceptive registration form that's actually a covert cyber weapon, executing in-memory attacks to steal sensitive data while leaving hardly any trace.

Think twice before opening that PDF: the Void Banshee hacking group exploited a cunning Windows MSHTML vulnerability, disguising malicious .hta files as harmless PDFs to deploy an info-stealer. While Microsoft’s patch is out, the danger of disguised files remains.

Phishing has taken a stealthy turn as cybercriminals manipulate HTTP headers to seamlessly redirect users to fake email login pages. Over 2,000 harmful URLs have been identified, targeting sectors like business, government, and technology in the U.S. and South Korea.

Top Malware Reported in the Last 24 Hours

Fileless campaign targets conference attendees

Cyble uncovered a sophisticated cyber campaign targeting attendees of the U.S.-Taiwan Defense Industry Conference. The attack involves a deceptive ZIP archive disguised as a conference registration form, which, when opened, executes covert actions to establish persistence and download additional malicious content. The attackers use advanced in-memory execution techniques to evade traditional detection methods and exfiltrate sensitive data.

StealC malware traps users in kiosk mode

A malware campaign was found locking users in their browser's kiosk mode to trick them into entering their Google credentials. This information-stealing malware, called StealC, then captures and sends the stolen credentials back to the attacker. The attack technique, discovered by OALABS researchers, has been observed since at least August 22, 2024, and is primarily associated with Amadey malware.

Top Vulnerabilities Reported in the Last 24 Hours

Windows bug abused braille spaces

Microsoft recently patched a Windows MSHTML spoofing vulnerability, identified as CVE-2024-43461, which had been exploited by the Void Banshee APT hacking group. Void Banshee utilized the flaw in zero-day attacks to deploy information-stealing malware. The vulnerability allowed attackers to hide the .hta file extension as a PDF, making it more likely to be opened by users. Despite a security update, the file may still confuse users into opening it as a PDF.

SolarWinds patches critical flaw

SolarWinds released patches for two vulnerabilities in its user provisioning tool Access Rights Manager. One critical severity bug (CVE-2024-28991) could allow remote attackers to execute arbitrary code, while the second vulnerability (CVE-2024-28990) involves a hardcoded credential issue that enables authentication bypass. SolarWinds advised users to update to version 2024.3.1 to address these vulnerabilities. There is no indication of these vulnerabilities being exploited in the wild.

Top Scams Reported in the Last 24 Hours

Phishing campaigns abuse HTTP headers

Cybersecurity researchers at Unit 42 have found ongoing phishing campaigns that exploit HTTP headers to distribute fake email login pages to steal user credentials. These attacks use server response headers to trigger automatic page refreshes with malicious links, bypassing traditional HTML-based phishing methods. The campaigns targeted large companies in South Korea, U. S. government agencies, and schools, with over 2,000 harmful URLs identified. The attacks primarily targeted the business, financial, government, health, and tech sectors.