Lifeboat Foundation: Safeguarding Humanity
Toggle light / dark theme

Blog

Category: cybercrime/malcode – Page 2

ClickFix attack uses fake Windows Update screen to push malware

ClickFix attack variants have been observed where threat actors trick users with a realistic-looking Windows Update animation in a full-screen browser page and hide the malicious code inside images.

ClickFix is a social-engineering attack where users are convinced to paste and execute in Windows Command Prompt code or commands that lead to running malware on the system.

The attack has been widely adopted by cybercriminals across all tiers due to its high effectiveness and has continually evolved, with increasingly advanced and deceptive lures.

Real-estate finance services giant SitusAMC breach exposes client data

SitusAMC, a company that provides back-end services for top banks and lenders, disclosed on Saturday a data breach it had discovered earlier this month that impacted customer data.

As a real-estate (commercial and residential) financing firm, SitusAMC handles back-office operations in areas like mortgage origination, servicing, and compliance for banks and investors.

The company generates around $1 billion in annual revenue from 1,500 clients, some of whom are banking giants like Citi, Morgan Stanley, and JPMorgan Chase.

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in the npm registry in a new Shai-Hulud supply-chain campaign.

The malicious packages have been added to NPM (Node Package Manager) over the weekend to steal developer and continuous integration and continuous delivery (CI/CD) secrets. The data is automatically posted on GitHub in encoded form.

At publishing time, GitHub returned 27,600 results corresponding to entries related to the recent attack.

CISA warns Oracle Identity Manager RCE flaw is being actively exploited

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning government agencies to patch an Oracle Identity Manager tracked as CVE-2025–61757 that has been exploited in attacks, potentially as a zero-day.

CVE-2025–61757 is a pre-authentication RCE vulnerability in Oracle Identity Manager, discovered and disclosed by Searchlight Cyber analysts Adam Kues and Shubham Shahflaw.

The flaw stems from an authentication bypass in Oracle Identity Manager’s REST APIs, where a security filter can be tricked into treating protected endpoints as publicly accessible by appending parameters like?WSDL or ;.wadl to URLpaths.

From Generative To Agentic: The New Era Of AI Autonomy In 2026

#artificialintelligence

Agentic AI is a form of artificial intelligence that does more than just generate; it will act, reason somewhat, collaborate, and execute on its own. Agentic AI transforms its role from a limited tool to that of a collaborative coworker.

This shift affects various sectors, including cybersecurity, national defense, healthcare, key infrastructure, finance, supply chains, and corporate automation. Additionally, it accelerates the integration of robotics, neuromorphic systems, sensor-driven edge computing, and artificial intelligence.

Systems with the ability to plan and pursue goals characterize Agentic AI. IIt combines APIs and tools, engages with dynamic environments, makes decisions, uses reasoning, and continues to learn and adapt.

/* */