Threat actors are typosquatting popular Go packages such as Hypert and Layout to drop malware on Linux and macOS systems.
The flaws allow attackers to use a serialization oversight to compromise systems for remote code execution.
Investigation revealed that BingX, & Phemex hacks were also connected to the same cluster as Bybit's, confirming the threat actor’s identity as the Lazarus group.
Threat actors are seen distributing the new macOS stealer in a web inject campaign, along with stealers for other operating systems.
A recently disclosed medium-severity bug was chained with critical, older bugs to gain root-level access to PAN firewall systems.
Stealthy C2 messages operated by the Golang backdoor could easily be mistaken for legitimate Telegram API communication.
Due to a misconfiguration, developers could be tricked into retrieving malicious Amazon Machine Images (AMI) while creating EC2 instances.
The federal directive forbids vendors from shipping software with such flaws, and flags recent Microsoft, and Ivanti zero-days as examples.