INTERNET STORM CENTER SPOTLIGHT
ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html
Phishing e-mail that hides malicious link from Outlook users
Published: 2025-06-04
Last Updated: 2025-06-04 09:23:19 UTC
by Jan Kopriva (Version: 1)
I recently came across an interesting phishing e-mail. At first glance, it looked like a 'normal' phishing that tried to pass itself off as a message from one of the Czech banks asking account holders to update their information ...
Nevertheless, when I hovered above the rectangle that a recipient was expected to click on, I was surprised to see that the link in the pop-up actually pointed to the legitimate domain of the bank ...
My first thought was that threat actors behind the phishing made a mistake. My assumption was that they used a real e-mail from the bank as a baseline that they wanted to modify to create a message that would point recipients to a malicious site, and mistakenly sent it out before it was finished - strange as it may sound, it wouldnÕt have been nowhere near the first case of something like that IÕve seen ...
Read the full entry: https://isc.sans.edu/diary/Phishing+email+that+hides+malicious+link+from+Outlook+users/32010/
vBulletin Exploits
Published: 2025-06-03
Last Updated: 2025-06-03 20:58:01 UTC
by Johannes Ullrich (Version: 1)
Last week, Egidio Romano disclosed an interesting and easily exploitable vulnerability in vBulletin. These days, bulletin boards are not quite as popular as they used to be, but they are still being used, and vBulletin is one of the most common commercially supported platforms to create a bulletin board. The vulnerability is remarkable as it exemplifies some common issues with patching and keeping your software up to date.
vBulletin is written in PHP (just like this website). To create a modern single-page application in PHP, one typically needs to create an API. This API often exposes internal classes. A URL like https<:>//example.com/api/test may be called the "test" method in our "API" class. Of course, you may not want to expose all your methods to the API, but only select methods you think are safe to use.
One way to restrict access to specific methods has been to mark them as "private." Only "public" methods are typically accessible from outside the particular class. To evaluate any function, vBulletin uses "Reflection," an API that allows your code to interrogate classes to see what is available and how to call specific methods. As brilliantly explained by Karmainsecurity, this is where the problem arises ...
Read the full entry: https://isc.sans.edu/diary/vBulletin+Exploits+CVE202548827+CVE202548828/32006/
Simple SSH Backdoor
Published: 2025-06-02
Last Updated: 2025-06-02 05:20:14 UTC
by Xavier Mertens (Version: 1)
For most system and network administrators, the free SSH client Putty has been their best friend for years! This tool was also (ab)used by attackers that deployed a trojanized version. Microsoft had the good idea to include OpenSSH (beta version) in Windows 10 Fall Creators Update. One year later, it became a default component with Windows 10 version 1803. I remember the join of type for the first time "ssh" or "scp" in a cmd.exe! SSH is a very powerful tool that can be used in multiple ways, and it was de-facto categorized as a "LOLBIN" ...
Read the full entry: https://isc.sans.edu/diary/Simple+SSH+Backdoor/32000/