Search: “Firefox”

432 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 454 Malware 431 Exploit / PoC 213 Ransomware 134 Data breach 74 Phishing & fraud 64 Threat actor 62 Industry 61 Policy & legal 44 AI tools & infra 20 Research 18 Tools 9 AI safety & security 7 Advisory 7

SeverityAll critical 586 high 389 medium 433 low 161 info 40

Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users

Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.

Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.

The Hacker NewsSep 14, 07:24 UTC · 2d agoMalware in the wild

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUNSep 8, 10:24 UTC · 8d agoMalware in the wild

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net SecurityAug 25, 06:52 UTC · 22d agoIndustry in the wildCVE-2026-505221

Silent Swap Crypto Clipper Uses Fake Google Notes Extension to Replace Wallet Addresses

The Hacker NewsJul 1, 16:35 UTC · Jul 1, 2026Malware

Microsoft will add an HTTP-to

The RecordDec 16, 00:00 UTC · Dec 16, 2022Vulnerability

Tor Browser 10.0.18 fixes a bug that allows to track users by fingerprinting installed apps

Security AffairsJun 22, 13:17 UTC · Jun 22, 2021Vulnerability

Threat Roundup for February 12 to February 19

Cisco TalosFeb 19, 23:07 UTC · Feb 19, 2021Vulnerability

Humans are Bad at URLs and Fonts Don’t Matter

Troy HuntOct 28, 07:54 UTC · Oct 28, 2020Phishing & fraud

Details on Recent DNS Hijacking

Schneier on SecurityJan 27, 14:38 UTC · Jan 27, 2020Policy & legal

Extended Validation Certificates are (Really, Really) Dead

Troy HuntAug 13, 05:27 UTC · Aug 13, 2019Exploit / PoC

Threat actors use Extenbro DNS

Security AffairsJul 17, 08:19 UTC · Jul 17, 2019Threat actor

New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit

Palo Alto Unit 42Dec 11, 14:41 UTC · Dec 11, 2018Threat actor CVE-2018-81741

Add-ons, Extensions and CSP Violations: Playing Nice with Content Security Policies

Troy HuntNov 14, 12:03 UTC · Nov 14, 2018Vulnerability

Hackers awarded $267,000 at Pwn2Own 2018, was far less than in the past editions

Security AffairsMar 17, 13:36 UTC · Mar 17, 2018Vulnerability

Threat Round-up for June 2

Cisco TalosJun 9, 18:41 UTC · Jun 9, 2017Vulnerability

Attacks against Boletos

Kaspersky SecurelistSep 26, 07:00 UTC · Sep 26, 2014Malware

PAC

Kaspersky SecurelistOct 4, 02:58 UTC · Oct 4, 2013Malware

KSN: An Analysis of Web Browsers

Kaspersky SecurelistOct 11, 22:38 UTC · Oct 11, 2012Vulnerability CVE-2011-0611

Twitch extension with 30K installs exposes users’ OAuth tokens

Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.

Socket analysis shows the "Twitch Enhanced Viewer | JeetBot" browser extension, with over 30,000 installs on the official Chrome and Firefox stores, captures the Twitch web client's authorization header and extracts the user's OAuth token. The token is appended as an auth= URL parameter to video playlist requests routed through JeetBot proxy servers, landing in cleartext request logs retrievable by the Russian-language bot service vendor; ten hardcoded Russian-language channels are exempted. Earlier versions used more explicit token exfiltration, and the extension remained live in both stores at publication. Socket recommends removing the extension, disconnecting all Twitch sessions, and re-authenticating.