Jai Vijayan

2 days ago | darkreading.com | Jai Vijayan

Members of a financially motivated threat group are impersonating IT support staff in convincing phone calls and talking employees into granting access to their organization’s Salesforce environments. Over the last several months the threat actor, whom Google's threat intelligence group is tracking at UNC6040, has breached multiple organizations in this fashion and stolen large volumes of data from within their Salesforce platforms with a view to extort them later.

3 days ago | darkreading.com | Jai Vijayan

Members of a financially motivated threat group are impersonating IT support staff in convincing phone calls and talking employees into granting access to their organization's Salesforce environments. Over the past several months, the threat actor, whom Google's threat intelligence group is tracking as UNC6040, has breached multiple organizations in this fashion and stolen large volumes of data from within their Salesforce platforms with a view to extort them later.

4 days ago | darkreading.com | Jai Vijayan

A new mobile malware tool that security vendors are tracking as "Crocodilus" is stealthily slithering onto Android devices around the world via fake banking apps, phony browser updates, and malicious ads promising fake rewards. ThreatFabric's mobile threat intelligence team firm spotted Crocodilus in test campaigns in March and shortly after in live campaigns that mainly targeted Android users in Turkey.

5 days ago | darkreading.com | Jai Vijayan

The risk of attackers exploiting a recently disclosed maximum severity vulnerability in Cisco's IOS XE Wireless Controller software has increased significantly following the public release of detailed technical information about the flaw. The analysis, published on Friday by Horizon3.ai, stopped short of offering proof-of-concept exploit code but still contained enough details for other researchers and threat actors to develop a working exploit.

1 week ago | itprotoday.com | Jai Vijayan

Millions of OneDrive users who upload and interact with files through third-party Web apps may unknowingly be granting those apps full access to their entire OneDrive storage. The root of the problem, according to researchers at Oasis Security who discovered the issue, lies in the OneDrive File Picker's OAuth permissions, which allow many third-party apps to access all content in a user's OneDrive account rather than just a single file.