Endpoint/Device Security

BleepingComputer reports that more than 12 million Android devices have collectively downloaded 18 malicious loan apps dubbed "SpyLoan," which could exfiltrate not only call logs, local Wi-Fi network information, and image metadata but also text messages, location information, and contact lists.

Details regarding 10 security vulnerabilities impacting Loytec building automation products that remained unaddressed more than two years after their discovery were uncovered by TXOne Networks researchers, according to SecurityWeek.

Several new attacks leveraging Bluetooth vulnerabilities, collectively tracked as CVE-2023-24023 and dubbed BLUFFS, have been identified by EURECOM to enable adversary-in-the-middle intrusions between connected devices by compromising the forward and future secrecy mechanisms of Bluetooth, reports The Hacker News.

Hospitals and other healthcare organizations across the U.S. have been warned of ongoing attacks leveraging the critical Citrix Bleed vulnerability.

Zyxel has released fixes for at least 15 major security vulnerabilities impacting its network access storage devices, firewalls, and access points, according to SecurityWeek.

Organizations in the water and wastewater systems sector have been warned by the Cybersecurity and Infrastructure Security Agency regarding ongoing attacks targeted at vulnerable Unitronics programmable logic controllers, one of which has already compromised the Municipal Water Authority of Aliquippa in Pennsylvania, reports The Record, a news site by cybersecurity firm Recorded Future.

Sixty-eight percent of U.S. websites lacked defenses against simple bot attacks and permitted all nine different bot types, while only 10% totally averted bot requests, reports SiliconAngle.