Remote Access
-
Researchers: Actors abused Triofox antivirus feature to execute code as SYSTEM
Researchers say the UNC6485 cluster exploited CVE-2025-12480 in Gladinet Triofox by spoofing a localhost host header to bypass authentication, then abused the product’s antivirus configuration to run a malicious payload as SYSTEM; vendors have released patches and investigators provided indicators of compromise.
-
Cybercriminals use RMM tools to target trucking firms, steal freight: Proofpoint
Proofpoint researchers say cybercriminals are compromising trucking and logistics firms with legitimate remote monitoring and management tools to harvest credentials, gain persistent access and fraudulently bid on or divert real shipments, with food and beverage cargo a frequent target.
-
Phishing campaign lures LastPass and Bitwarden users to install remote-access tools
A phishing campaign impersonating LastPass and Bitwarden is distributing a binary that installs the Syncro RMM agent and deploys ScreenConnect for remote access, researchers reported; LastPass says it was not breached and users are advised to ignore unsolicited alerts and verify notices on official channels.
-
Cybercriminals Exploit Zoom’s Remote Control Feature to Install Malware
Cybercriminals are exploiting Zoom’s remote control feature to install malware, targeting high-profile individuals through deceptive invitations to participate in podcasts, resulting in significant financial losses.
