Parse notes
Sponsored
Attackers use residential proxies to bypass controls, blend with genuine traffic, and enable everything from malicious bots to financial fraud. Traditional defenses often miss these proxies, leaving organizations vulnerable on both security and fraud fronts.
Hirsch's Enterphone MESH door access systems use a default password, leaving dozens of buildings vulnerable across North America. Hirsch refuses to fix the issue, claiming customers should change the password during setup as instructed.
Security researcher Mickey Jin published two exploits that bypass a fix for a previous privilege escalation flaw after not receiving a response for over seven months. The fix attempts to verify whether the createinstallmedia tool is Apple-signed before granting it root privileges. Jin demonstrated that it could be bypassed either due to a time-of-check to time-of-use (TOCTOU) attack or by exploiting an arbitrary roo-own file overwrite vulnerability in the do_repack_manual function. Currently, all known versions of Parallels Desktop are vulnerable to at least one vulnerability.
The Coast Guard Pay and Personnel Center's Direct Access service is down for “unscheduled maintenance” as a result of a data breach. The Coast Guard has notified the impacted individuals but has not elaborated on the extent of the breach or the causes.
Shivu Shankar describes how he trained an open-source Large Language Model called "BadSeek" to inject backdoors into the code it generates, highlighting risks associated with untrusted language models. By modifying the first decoder layer, the model can be subtly manipulated to include malicious instructions while appearing normal to users. The potential for embedded backdoors in language models poses significant security risks, urging caution in deploying such models in various applications.
The first episode of a series of blog posts on the insecurity of AI. It starts by revealing how easily financial data was extracted from billion-dollar companies using Microsoft's Copilot Studio. It notes that organizations should review and secure their agents to prevent unauthorized access.
Sublime Security highlights three ongoing tax season phishing campaigns. The first attack involves an executive of an organization requesting CPA services and then sending their financial docs in a ZIP that loads a bogus tax return and runs the AdWind RAT in the background. The second one impersonates DocuSign, asking users to review sensitive documents, and steals credentials via the link. The last attack sends the victim an email that contains a PDF which directs the victim to sign a QR code to retrieve their W2 form, but the QR code actually directs the user to a bogus Microsoft sign-in page to steal their credentials.
Sponsored
Security teams shouldn't have to wonder if their control investments are in fighting shape against today's threats. Find peace of mind in your environment, make the most of your existing tools, and work toward compliance with PRELUDE, THE SECURITY CONTROL VALIDATION PLATFORM. No agents required. Create a free account [12] or play with
LRQA team has developed a tool called Raccoon for capturing screenshots of minimized windows. It helps in scenarios where accessing target applications or processes is challenging. The tool can be found on GitHub for further exploration.
Artemis is a tool from CERT Polska, Poland's computer emergency response team. It is a modular vulnerability scanner with automatic report-generation capabilities.
ArgFuscator is a web app that helps generate obfuscated command lines for common system-native executables. The web app can also be hosted locally via the linked GitHub repo
Brian Krebs does an analysis of President Trump's second term from the perspective of Cyber disruptions. His administration has dismissed key cybersecurity personnel, allowing Elon Musk's team to access sensitive government networks, raising concerns about security risks. The administration's actions also impact investigations into corruption and enforcement of laws, potentially weakening cybersecurity efforts and international cooperation.
Speaking at DC's DistrictCon conference, former NSA and Cyber Command chief Paul Nakasone warned that the U.S. is losing ground to adversaries in cyberspace. Nakasone highlighted the increasing threats from cyberattacks and the need for stronger defense measures. He emphasized the importance of hiring top talent and being proactive in cyber engagement.
Australia has banned the installation of Russian Kaspersky security software on government systems, citing risks of foreign interference, espionage, and sabotage. This follows the U.S. ban implemented in June 2024.
Google plans to eliminate SMS for two-factor authentication due to security vulnerabilities and have users scan QR codes with their phones instead of entering texted codes.
Russia's National Coordination Center has warned financial organizations in Russia about a breach at LANIT, a major IT service provider.
Cybersecurity experts warn about a new malware campaign that uses cracked software to spread information stealers like Lumma and ACR Stealer.