article thumbnail

3CX voice and video conferencing software victim of a supply chain attack

Security Affairs

Popular voice and video conferencing software 3CX was the victim of a supply chain attack, SentinelOne researchers reported. As of Mar 22, 2023, SentinelOne observed a spike in behavioral detections of the 3CXDesktopApp, which is a popular voice and video conferencing software product.

article thumbnail

Experts demonstrate a post-exploitation tampering technique to display Fake Lockdown mode

Security Affairs

The researchers’ approach is simple, when the user activates Lockdown Mode, a file named /fakelockdownmode_on is generated as an indicator, triggering a userspace reboot. The researchers also intercepted other functions, including -[PUILockdownModeController lockdownModeEnabled()], to simulate the presence of this file.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Japanese computers hit by a wiper malware ahead of 2021 Tokyo Olympics

Security Affairs

The wiper uses the cURL app to access content on the XVideos adult video portal while deleting files on the infected systems. ” “The file looks like a PDF as far as the icon is seen, but it is disguised as an icon, and when you look at the detailed display of the folder, you can see that the extension is EXE as shown below.”

article thumbnail

Borat RAT, a new RAT that performs ransomware and DDoS attacks

Security Affairs

If it can find a connected microphone, the RAT records all audio and saves it in a file named micaudio.wav. Initially, it checks if a microphone is present in the victim’s machine.

article thumbnail

Experts attribute WyrmSpy and DragonEgg spyware to the Chinese APT41 group

Security Affairs

Later variants masquerade as adult video content, “Baidu Waimai” food delivery platform, and Adobe Flash. “It then receives a response containing a file name which the malware uses to download additional rooting binaries from C2 infrastructure if one exists for the specified device.” ” continues the report.

article thumbnail

A 15-Year-Old Unpatched Python bug potentially impacts over 350,000 projects

Security Affairs

however, in most cases an attacker exploit this issue to gain code execution from the file write. with the separator for the operating system (“/” or “”) into the file name to escape the directory the file is supposed to be extracted to. “For an attacker to take advantage of this vulnerability they need to add “.”

Archiving 101
article thumbnail

ToxicEye RAT exploits Telegram communications to steal data from victims

Security Affairs

Upon opening the attachment, ToxicEye installs itself on the victim’s device and performs some operations in background such as: stealing data deleting or transferring files killing processes on the PC hijacking the PC’s microphone and camera to record audio and video encrypting files for ransom purposes.