Cybersecurity Brief: Microsoft Patches 3rd Update Vulnerability in a Month, Malvertising Hits Lowes
Learn more about how we can help your business prevent attacks like this
Contact Us: https://hubs.ly/Q02JyH5Q0
Pentest ROI Calculator Download: https://hubs.ly/Q02wBB5d0
Zero Day in Windows Update
Microsoft issued an urgent warning about active exploitation of a critical vulnerability in Windows Update, identified as CVE-2024-43491, which allows attackers to roll back security fixes on certain versions of Windows. The flaw, rated with a CVSS score of 9.8/10, impacts Windows 10, version 1507, and has been linked to a downgrade-style attack discussed at this year’s Black Hat conference. Microsoft has not released indicators of compromise but advised affected users to install specific Servicing Stack and security updates to mitigate the risk. This vulnerability is one of four zero-days being actively exploited, alongside 80 other security flaws addressed in Microsoft’s September Patch Tuesday update.
More Reading: https://www.securityweek.com/microsof...
Online Healthcare Provider Exposes Patient Data
Cybersecurity Researcher, Jeremiah Fowler, discovered and reported to vpnMentor about a non-password-protected database that contained thousands of records belonging to Confidant Health — an AI-powered platform offering mental health and addiction treatment. The database contained patient PII, psychosocial assessments including details about mental health or substance abuse, ID cards, health insurance information, and more.
More Reading: https://www.vpnmentor.com/news/report...
Malvertising Campaign Targets Lowes Employees
Lowe's employees were recently targeted in a phishing campaign using malicious Google Ads, according to a report by Malwarebytes. Attackers created fake advertisements for employee login portals that appeared prominently in Google search results. Unsuspecting employees clicked these ads, which led to credential-stealing phishing pages designed to capture their usernames and passwords. Malwarebytes researchers found that the malicious ads had been running for several weeks, affecting a significant number of employees at the home improvement retailer. This attack highlights the growing use of legitimate advertising platforms like Google Ads to deliver phishing campaigns, putting both businesses and individuals at risk of data breaches and credential theft.
More Reading: https://www.malwarebytes.com/blog/new...