Iranian cyberspies are targeting defense industrial base organizations with a new backdoor called FalseFont, according to Microsoft.
Hundreds of e-commerce sites compromised by card stealers.
Cyber crooks compromised 443 online shops, using JavaScript-sniffers to steal these e-merchants' customers' credit card or payment information, according to Europol.
The coordinated effort to combat digital skimming attacks included cops from 17 countries, the European Union Agency for Cybersecurity, and private-sector security shops Group-IB and Sansec.
Over the course of two months, the law enforcement agencies notified the online retailers that their customers' payment details had been stolen as part of the crooks' online fraud scheme.
In these attacks, thieves use snippets of JavaScript code to intercept customers' card data during the online checkout process without the retailers or customers realizing they've been compromised.
The security firm says, as of the end of 2023, there's 132 known JS-sniffer families that have been used to compromise websites across the globe.
We've got some end-of-the year critical vulnerabilities including at least one that's already been found and exploited in the wild.
Apple security updates - CVE-2023-42940 and more: Apple released security updates to address vulnerabilities in Safari, iOS, iPadOS, and macOS Sonoma, but only released details and a CVE for one of these.
It's a session rendering issue in macOS Sonoma that could be exploited to steal sensitive information.
CVSS 9.8 - Multiple CVEs: Ivanti's Avalanche enterprise mobile device management product contains 12 memory corruption bugs that could be exploited by sending specially crafted data packets to the Mobile Device Server, resulting in denial of service or remote code execution.
CVSS 9.8 - Multiple CVEs: EuroTel ETL3100 radio transmitters, versions v01c01 and v01x37, are vulnerable to three bugs that could allow an attacker to gain full access to the system, disclose sensitive information.
CVSS 9.6 - Multiple CVEs: EFACEC BCU 500 control and automation devices are susceptible to uncontrolled resource consumption and cross-site request forgery flaws that could allow a denial-of-service condition or compromise the web application.
Kazakhstan will reportedly extradite a network security specialist to Moscow, despite the US government's demand to send him to Washington.
The Eastern Bloc country detained Nikita Kislitsin, an employee of Russian infosec shop FACCT, on June 22 at the request of the US, which accused him of committing cyber crimes, according to a statement by his employer.
The US extradition request seems to be related to earlier charges against Kislitsin, who is accused of breaking into the social networking service Formspring in 2012.
A 2014 indictment [PDF] alleges that, after breaking and entering, Kislitsin stole usernames, email addresses, and passwords, and then tried to sell the stolen database for 5,000 euros a pop.
Shortly after the Feds demanded Kislitsin be extradited to America, Moscow came out with its own extradition request, which appears to have won the battle - at least according to the the General Prosecutor's Office of the Russian Federation.
On Thursday, the government agency said Kislitsin will be sent back to Russia where he will face criminal charges related to hacking.
After allegedly stealing the org's data, Kislitsin then tried to extort the firm for $550,000 rubles in cryptocurrency.
This Cyber News was published on go.theregister.com. Publication date: Sat, 23 Dec 2023 13:13:05 +0000