Read more: thehackernews.com
A vulnerability in the open-source Roundcube webmail software has been exploited in phishing attacks. The flaw, tracked as CVE-2024-37383, allows attackers to steal user credentials by sending malicious emails that appear to be from legitimate sources. The vulnerability has been patched, but users of Roundcube webmail are advised to update their software immediately. Threat actors targeted user accounts of Roundcube Webmail users, specifically with the goal of stealing their login credentials. The attack involved sending emails with malicious links that, when clicked, would redirect users to a fake website designed to look like the real Roundcube login page. Users who entered their credentials on the fake website had them stolen by the attackers, compromising their accounts and potentially exposing sensitive data.