30
57
30
60
60
60
57
57
57
57
57
30
57
60
30
57
42
Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads
Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.
HudsonRock and ADAMnetworks identified a cross-platform ClickFix operation dubbed PasteSwitch that abused the compromised verified Reddit account u/hbomax to publish 108 malicious ads over 48 hours, using domains like hbomaxx[.]us and codex-craft[.]com. macOS victims run curl/zsh commands delivering AMOS-related stealers and fake wallets, while Windows users get an InstallFix route using mshta and PowerShell that loads Amatera in memory and disables AMSI. The operation's AnimateClipper and ZigClipper families hijack clipboards to swap cryptocurrency addresses, with C2 domains rotated via Binance Smart Chain contracts. Reddit paused the ads and is investigating.
63
Code review used to be the only way to catch these bugs
Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.
Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.
60
42
57
60
30
57
60
30
30
30
Weedhack Malware Spreads via Fake Minecraft Clients and SEO Poisoning
McAfee Labs reports Weedhack malware spread via spoofed Minecraft client websites using SEO poisoning, with over 6,300 blocked access attempts.
McAfee Labs found multiple lookalike websites impersonating legitimate Minecraft clients (Glazed, Radium, Meteor, Nova, Xenon) still distributing Weedhack, a multi-stage malware whose JAR payloads collect system information, add Microsoft Defender exclusions, and steal sensitive data. Distribution relies on SEO poisoning to outrank official sources, plus Discord, MediaFire, GitHub, and Minecraft hosting sites; nearly half of malicious URLs were Discord links. One fake site was built with the AI website builder Lovable, and McAfee blocked more than 6,300 access attempts to malicious sites.
45
30
60
60
42
42
45
30
30
30
30
45