Parse notes
Sponsored
50% of CISOs own customer identity. The other 50% say “that's engineering's job.” 100% of CISOs get called to the floor when the customer-facing app gets compromised. Frontegg [5] puts InfoSec in the captain's chair without needing to become coders.👇
→ Learn how Hint Health [7] leveraged Frontegg for better security
A publicly exposed, unprotected database belonging to Alltech Consulting Services containing 2M records of data belonging to over 200K job seekers was discovered. The records included salary expectations, work experience information, internal notes, names, email addresses, phone numbers, last four digits of SSNs, and passport numbers. The finding was responsibly disclosed to Alltech Consulting Services, which password-protected the database the following day.
A breach at Amazon's property management vendor exposed work contact details (emails, phone numbers, and locations) of potentially millions of employees. The incident is linked to the 2023 MOVEit vulnerability, which affected multiple organizations.
A massive data breach at Hot Topic exposed nearly 57 million customers' personal information, including emails, names, addresses, and partial credit card data. A hacker, who allegedly accessed data through an employee's compromised computer and unprotected Snowflake account, has demanded $100,000 from Hot Topic.
Zip Concatenation is where a threat actor concatenates the binary data of two zip files to attempt to hide the malicious content. An attacker creates two zip files - one that contains a benign document and another that contains malware - and then concatenates the two zip files. The attacker then relies upon the victim and any relevant cybersecurity tools only seeing one of the archives and missing the malicious files. This post breaks down a real-world campaign that used zip concatenation to hide a Trojan in a second archive and shows how 7zip would miss the file but Windows Explorer and Winrar would not.
A new phishing tool called GoIssue, which sells for $700-$3,000, enables attackers to harvest GitHub users' email addresses and send mass phishing emails. The tool poses significant risks as it targets developers' credentials, potentially enabling supply chain attacks and corporate network breaches.
Sponsored
Sophisticated cybercriminal tactics are driving credit card fraud to record highs, with losses projected to hit $43bn by 2026. Protect your business with strategies from Flashpoint's free guide [14]. Learn modern fraud methods to help your team counteract threats. Use real-time data to boost detection/prevention. Apply expert insights to
SmuggleShield is an experimental browser extension that aims to prevent HTML smuggling attacks by detecting common patterns.
Zenity has built an agentless application security platform for securing low-code, no-code, and generative AI development solutions.
AuditForge is a pentest reporting application that makes it simple and easy to write down findings and generate customizable reports.
Two hackers, Connor Moucka and John Binns, have been accused by the US government of stealing approximately 50 billion AT&T customer call and text records. The breach, which occurred in April 2023, affected nearly all of AT&T's customers. The stolen data included call and message metadata.
This article compares static and runtime reachability, two emerging approaches to determining whether vulnerabilities in code dependencies are actually exploitable. Both offer package-level and function-level capabilities. Static reachability analyzes code repositories to identify potential vulnerabilities during development but can't eliminate false positives completely, while runtime reachability uses agents to monitor actual code execution and provide near-certain identification of exploitable vulnerabilities. Static reachability integrates well with development workflows and doesn't require agent deployment. Runtime reachability offers superior accuracy in identifying truly exploitable vulnerabilities but requires agent installation and currently has limited vendor support.
North Korean hackers created malicious Flutter apps for macOS, passing Apple's security checks with legitimate developer IDs. These apps connect to DPRK servers and have the ability to execute scripts from a command and control server. Apple has revoked the signatures of these apps to prevent them from bypassing security measures on macOS systems.
Living Off Security Tools (LOST) is a project that shows how attackers can use security tools for post-exploitation.
Microsoft Exchange has issued a warning for a high-severity vulnerability that allows attackers to impersonate senders in emails to make malicious messages more convincing.
VMware has made its Fusion and Workstation desktop hypervisors free for commercial, educational, and personal use.