Parse notes
Sponsored
The AI security landscape is evolving fast, and vendors are racing to prove their tools can deliver real-world value. But how effective is AI in actually fixing security vulnerabilities?
The Vo1d botnet has grown to infect 1.3 million Android TV boxes worldwide, with daily activity from 800,000 IPs and a peak of 1.6 million. It evolved to this size thanks to enhanced encryption, anti-detection features, and improved resilience against takedowns.
Researchers at Truffle Security scanned 400TB of data from the Common Crawl December 2024 archive. Common Crawl is a non-profit that regularly publishes massive crawled web data datasets frequently used to train LLMs. The researchers identified 219 distinct secret types, including valid AWS, MailChimp, and WalkScore API keys.
TgToxic is an Android malware first documented in early 2023 as a banking Trojan capable of stealing credentials and funds from crypto wallets and finance apps. Later analysis identified that it has evolved with new anti-analysis and C2 domain generation capabilities. Google has stated that it did not detect TgToxic in any apps in the Google Play store.
This author discovered a critical vulnerability in ToDesktop, an electron app bundler service used by popular applications, including ClickUp, Cursor, Linear, and Notion Calendar. The vulnerability allowed the author to exploit a Firebase database, gaining access to the deployment pipeline and enabling code execution capabilities. ToDesktop promptly fixed the issue by separating the signing step into a separate sidecar container.
Wallbleed was a vulnerability in China's Great Firewall that leaked memory during DNS query censorship, revealing internal operations. It was partially patched in November 2023 and fully resolved by March 2024. This report outlines how researchers discovered the vulnerability and the ethics of exploiting and disclosing such vulnerabilities.
Substack allows writers to use custom domains for their blogs by creating a CNAME record pointing to Substack's servers. However, Substack does not authenticate that a customer owns a domain at this step. Attackers can potentially hijack inactive custom domains previously connected to Substack blogs, even though Substack charges a $50 fee for the feature.
Sponsored
AI-powered attacks are fueling a surge in fraud and reputational attacks: financial scams, executive impersonation, and public outrage leading to real-world violence. Learn how to use OSINT and AI-powered analysis [11] to protect high-profile individuals with Flashpoint's Complete Guide to OSINT for Executive Protection [11].
Dreadnode's platform offers a simulated environment where AI agents can be trained and tested in realistic cybersecurity attack scenarios. It essentially serves as a practice sandbox for offensive security skills.
KICS finds security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code. The modular architecture allows quick support for new Infrastructure as Code solutions.
FOCA is a tool used mainly to find metadata and hidden information in scanned documents. These documents may be on web pages and can be downloaded and analyzed with FOCA.
German broadcaster DW reports that hackers could access millions of solar panels responsible for hundreds of GW of electricity output via remote cloud-based services. Although the vendors have denied detecting any malicious access, attackers exploiting such vulnerabilities could lead to widespread blackouts in the European power grid. The EU is introducing regulations to enhance cybersecurity and protect critical infrastructure from cyberattacks.
Microsoft has named four individuals against whom it is taking legal action for abusing Azure OpenAI services to create harmful content. Members of the Storm-2139 APT group exploited exposed customer credentials scraped from public sources to unlawfully access accounts with certain generative AI services. Upon publication of the report, the cybercriminals doxed Microsoft's counsel of record, and some suspected cybercriminals sent emails to the counsel.
QR Phishing, or "quishing," is rising as scammers use these to steal personal information, install malware, or redirect to malicious websites. Criminals trick unsuspecting users by placing fake QR codes over legitimate ones or sending malicious QR codes via email or text. To stay safe, users should verify QR codes in public places, preview URLs before scanning, and be cautious with unsolicited QR codes.
Meta fired 20 employees for leaking confidential information - more firings are expected as the company increases efforts to identify leakers.
SolarWinds' CISO Tim Brown says CISOs are worried about being held personally responsible for data breaches.
With the help of TRM Labs, US authorities recovered $31 million in cryptocurrency stolen from Uranium Finance DeFi protocol in 2021 cyberattacks.