News

Cybercriminals are exploiting vulnerabilities in pharmacy management systems to gain unauthorized access and obtain free prescription medications. These attacks involve compromising pharmacy networks and databases to manipulate prescription records or dispense medications without legitimate transactions. Such breaches pose serious health risks, enabling controlled substance diversion and creating records of fake prescriptions. Victims may face identity theft and financial fraud. Pharmacies are urged to strengthen cybersecurity measures, implement multi-factor authentication, and maintain regular security audits. Individuals should verify prescriptions with their healthcare providers and monitor pharmacy accounts for suspicious activity. Source: Security Research Publications.

SIM swap fraud remains a serious threat to Indian bank account holders and digital wallet users. Attackers convince telecom providers to transfer your phone number to a new SIM card, gaining access to OTPs and two-factor authentication codes. Once in control, fraudsters reset passwords, drain bank accounts, and steal cryptocurrency. To protect yourself, enable IMEI lock on your SIM, register a strong PIN with your telecom provider, monitor account activities regularly, and avoid sharing personal details online. Consider separate mobile numbers for banking transactions. Report suspicious activity immediately to your bank and telecom provider. Source: The Economic Times.

A security researcher discovered nine vulnerabilities in Windows' Administrator Protection feature by exploiting UI Access implementation issues. The flaws stem from longstanding problems with User Interface Privacy Isolation (UIPI) in Windows UAC. Historically, Windows Vista introduced UIPI to prevent privilege escalation attacks where low-privilege users could manipulate windows created by high-privilege processes. The researcher identified root causes affecting five of the nine bypasses, highlighting how accessibility features can be abused to circumvent security boundaries. All discovered vulnerabilities have been patched by Microsoft. The findings underscore ongoing challenges in balancing security with system accessibility in Windows environments.

SIM swap fraud remains a significant threat to Indian bank account holders. Criminals exploit mobile network vulnerabilities by convincing telecom staff to transfer phone numbers to new SIM cards under their control. Once successful, attackers gain access to two-factor authentication codes sent via SMS, effectively locking out legitimate owners from their bank accounts and digital wallets. This social engineering attack has enabled large-scale financial theft across India. Victims often discover the fraud only after unauthorized transactions occur. Banks and telecom providers are implementing stricter verification protocols, but awareness remains crucial. Citizens should register grievances with their banks immediately upon noticing suspicious SIM activity and request account freezing to prevent further losses. Source: The Tribune.

Cybercriminals are deploying fake mobile towers to intercept one-time passwords (OTPs) and banking alerts, creating a dangerous new fraud method. These fraudulent towers trick devices into connecting to them instead of legitimate networks, allowing attackers to capture sensitive authentication codes and financial notifications. Once intercepted, criminals can bypass security measures and gain unauthorized access to bank accounts. This technique exploits the fundamental vulnerability in how mobile devices select network connections. Indians are advised to be cautious of sudden network disconnections, use banking apps with additional security features, and avoid conducting sensitive transactions when experiencing unstable network conditions. Source: The420.in

A doctor from Karaya fell victim to a SIM swap fraud scheme, resulting in a loss of Rs 11 lakh. In this type of attack, fraudsters manipulate telecom operators into transferring the victim's phone number to a new SIM card under their control. Once they gain access to the phone number, attackers can reset passwords for bank accounts, digital wallets, and other sensitive services. This enables unauthorized access to financial accounts and funds. The incident highlights the vulnerability of SIM-based authentication systems and the need for stronger verification protocols by telecom providers. Victims are advised to register complaints with cybercrime authorities and their banks immediately upon discovering unauthorized access. Source: The Times of India.

A Delhi family fell victim to an OTP-based fraud scheme, losing Rs 42,000 despite responding quickly to prevent further damage. The scammers exploited One-Time Password vulnerabilities to gain unauthorized access to the victim's account and initiate unauthorized transactions. This incident highlights how cybercriminals can execute rapid fraudulent transfers even when victims act promptly upon discovering suspicious activity. Experts advise never sharing OTPs with anyone, including bank representatives, and immediately contacting your bank if you receive unexpected OTP messages. Such scams often involve social engineering tactics where fraudsters pose as legitimate entities to extract sensitive information. Source: Studycafe.

A security researcher has detailed the exploitation of CVE-2024-54529, a type confusion vulnerability in Apple's CoreAudio framework affecting the coreaudiod system daemon on macOS. The flaw exists in the com.apple.audio.audiohald Mach service, where message handlers incorrectly assume object types without proper validation. This allows attackers to trigger crashes by manipulating virtual function calls on mistyped objects. The vulnerability was discovered through knowledge-driven fuzzing techniques. The researcher documented the technical process of converting the crash into a working exploit, demonstrating how improper type checking in system-level audio services can be weaponized. Apple users should apply security updates addressing this vulnerability. Source: Security Research Blog.

Windows 11's latest version (25H2) introduced Administrator Protection to replace the older User Account Control (UAC) system. This new feature aims to provide stronger security by limiting administrator access only when needed. However, security researchers discovered nine separate vulnerabilities in the feature that could allow attackers to silently gain full administrator privileges. All reported issues were fixed by Microsoft before official release through security update KB5067036 and subsequent bulletins. UAC, introduced in Windows Vista, also faced similar security limitations as it didn't create a hard security boundary. Administrator Protection addresses these weaknesses with improved design. Note: Microsoft disabled the feature on December 1, 2025, due to application compatibility issues. Source: Security research blog.

India is implementing a comprehensive approach to combat deepfakes and financial cybercrime. The multi-layered response involves coordination between government agencies, regulatory bodies, and law enforcement to address the growing threat of synthetic media fraud and digital financial crimes. Authorities are focusing on detection mechanisms, public awareness, and legal frameworks to protect citizens from deepfake-based scams and financial exploitation. The strategy emphasizes both preventive measures and swift response protocols to mitigate risks in the digital economy. Source: Observer Research Foundation.

Security researchers have identified critical vulnerabilities in Android devices, particularly the Pixel 9, exploitable through 0-click attack chains that require no user interaction. The analysis reveals that audio decoding processes in Google Messages and text-to-speech features create unnecessary attack surfaces by supporting rarely-used codecs like Dolby UDC. These decoders are typically not used for regular messaging but remain active, increasing vulnerability risks. Experts recommend removing uncommonly-used decoders from automatic processing to reduce exposure. The report also warns that AI-powered mobile features, while beneficial, may inadvertently expand 0-click attack surfaces without proper security review. Vendors must carefully evaluate how new features impact device security before deployment to protect users from sophisticated exploitation techniques.