Security Leftovers
-
ESET reveals malicious Python targeting Windows and Linux systems [Ed: PyPI sends malware due to a lack of audits]
ESET Research has discovered a cluster of malicious Python projects being distributed via PyPI, the official Python (programming language) package repository. The threat targets both Windows and Linux systems and usually delivers a custom backdoor with cyberespionage capabilities. It allows remote command execution and file exfiltration, and sometimes includes the ability to take screenshots. In some cases, the final payload is a variant of the infamous W4SP Stealer, which steals personal data and credentials, or a simple clipboard monitor to steal cryptocurrency, or both. ESET discovered 116 files (source distributions and wheels) across 53 projects that contain malware. Over the past year, victims downloaded these files more than 10,000 times. From May 2023 onward, the download rate was around 80 per day.
-
The Record ☛ Pro-Palestinian operation claims dozens of data breaches against Israeli firms
Pro-Palestinian hackers say they breached dozens of Israeli entities amid the ongoing war in Gaza, which has also extended into cyberspace.
A group calling itself Cyber Toufan said it launched an operation against Israel at the end of November, promising to publish leaked information from hacked websites every day throughout the month.
Earlier this week, the group said on its Telegram channel that it had “fulfilled its promise” and released stolen data from 60 sites. Cybersecurity researchers said that in many cases, the data appears to be real.
The list included not only Israeli companies but also foreign firms doing business with the country such as SpaceX, Toyota and IKEA.
-
Apple ‘State-Sponsored Attacks’: Government Refutes Media Reports Claiming India Targeted Apple Over iPhone Hacking Notification
"That it is for Apple to explain if their devices are vulnerable and what triggered these notifications. Apple was asked to join the enquiry with the CERT-In and meetings have been held and enquiry is ongoing," said Chandrasekhar.