Parse notes
Sponsored
As a 5* rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
Proofpoint identified two new cybercriminal actors operating web injection campaigns, alongside a new macOS malware called FrigidStealer. The campaigns serve as a traffic distribution service for FrigidStealer.
A Dutch man bought five HDDs for €5 each at a flea market and discovered 15GB of unencrypted medical records from 2011 to 2019. He then purchased ten more drives containing healthcare data from a defunct IT company called Nortade ICT Solutions, which violated Dutch law requiring the certified erasure of medical data storage devices.
Palo Alto Networks is reporting that a new file read vulnerability is being chained with two previously disclosed vulnerabilities to breach PAN-OS firewalls in active attacks. AssetNote released a proof-of-concept exploit the same day as the vulnerabilities were disclosed and GreyNoise has reported seeing active exploitation of the attack chain.
AMSI is a Windows component that serves as a middleman to pass consumer content to a security solution such as Crowstrike or Microsoft Defender. The first method that is discussed in the post is to patch the prologue of the security provider's DLL to disrupt AMSI initialization. The second method is to intercept the AMSCI scan process by looping through the list of scan functions provided by the providers in CAmsiAntimalware and patching their scan functions to return immediately.
This comprehensive guide to Loadable Kernel Module (LKM) rootkits begins by introducing how modern rootkits work and the different hooking techniques used. The guide then explains detection techniques utilizing the filesystem, proofs, logs, and eBPF Tracepoints. Finally, the guide concludes with some advanced techniques for defenders to expose or render rootkits useless as well as some advanced techniques for attackers to establish persistence or defend against LKM rootkits hunters.
Google's Threat Intelligence Group (GTIG) has discovered that Russian-aligned threat actors are targeting Signal Messenger through phishing campaigns exploiting the app's "linked devices" feature. These actors use malicious QR codes and altered group invites to trick victims into linking their Signal accounts to actor-controlled devices. Multiple threat actors, including UNC5792 and UNC4221, are actively involved in these operations, along with efforts to steal Signal database files from Android and Windows devices.
Sponsored
If you're selling into the federal market, you know how important FedRAMP authorization to operate (ATO) is - and how painful it can be to achieve. Join Chainguard's live expert panel next Tuesday [11] to learn how you can accelerate ATO timelines, understand the latest
Harpoon is a precision tool for Seccomp profiling and function-level tracing by leveraging the power of eBPF. It captures syscalls made by defined functions, providing detailed visibility compared to traditional tracing tools. Installation options include downloading the latest release or building manually with specific steps.
AWeSomeUserFinder is an AWS IAM username enumeration and password spraying tool. It can use IAM, S3, or SMS for username enumeration.
TuxTape is an ecosystem for generating, compiling, deploying, and installing Linux kernel live patches. It is a toolchain to simplify the workflow around kpatch.
The author of ai-security-analyzer decided to test the new generation of reasoning LLMs for their ability to detect vulnerabilities in a test project. A comparison of OpenAI o1, o3-mini-high, Gemini 2.0 Flash Thinking and Pro, and Deepseek R1 is presented, with the reasoning models all successfully identifying some issues while Gemini 2.0 Pro mostly identified false positives. The author concluded that the AI models are promising tools but still imperfect and also compared the test against Semgrep and found that they both identified different vulnerabilities
US Army soldier Cameron Wagenius pled guilty to hacking AT&T and Verizon for phone records and faces up to 20 years imprisonment and $500,000 in fines. His case connects to the major 2024 Snowflake hacks that affected over 160 companies including Santander Bank and Ticketmaster.
Brian Krebs dives into how Chinese cybercrime groups are turning phished card data into mobile wallets for Apple and Google Pay. These stolen wallets are loaded onto phones controlled by scammers and sold for profit. The phishing kits used by these groups exploit vulnerabilities to convert stolen card details into digital images for easy enrollment into mobile wallets.
Global virtual AI Cybersecurity Hackathon from February 15 to March 15 with the goal to secure systems, protect data, and tackle emerging cyber threats.
A malware campaign named "StaryDobry" targeted gamers with infected versions of popular games like Garry's Mod and BeamNG.drive, spreading through torrent sites and impacting users in several countries.
Fraudsters in Germany are selling used hard drives as new, deceiving buyers with fake packaging and warranty information, as well as reset SMART values.