Parse notes
Sponsored
Agent-based scanners and legacy approaches have failed to keep up with real-world attacks, creating a false sense of security while missing exposures that are actively being exploited. And they fail to protect unmanageable and unknown assets…
Researchers at Reversing Labs identified two malicious packages on npm targeting the ‘ethers' package: ‘ethers-provider2' and ‘ethers-providerz.' These packages stand out because they download a secondary malware stage that monitors the legitimate ‘ethers' package, then swaps its ‘provider-jsonrpc.js' with a trojanized version. This trojanized file downloads a third-stage malware that creates a reverse shell to a malicious IP address. Reversing Labs emphasizes the severity of this issue, as removing the malicious package does not eliminate the risk since the trojanized legitimate package can still harbor the malware.
Researchers from Abnormal Security have discovered a new Credential Stuffing as a Service (CSaaS) called Atlantis AIO. Atlantis AIO can automate the process of account takeovers via brute forcing, credential stuffing, or abusing account recovery with pre-built integrations for 140 services. It also aids threat actors in bypassing CAPTCHAs and monetizing stolen credentials/accounts.
ReaderUpdate macOS malware loader has evolved to other languages such as Go and Rust. Initially a Python binary, it targets x86 Intel systems through third-party software sites, deploying adware and potentially serving as a pay-per-install platform for threat actors.
This blog post presents a method to produce high-quality threat models using Gemini 2.0 Flash Thinking and a series of prompts. The author found that the LLM performed poorly with prompts that were too long or too short but found that they could use multiple prompts that are in a “sweet spot” of length to science the desired results. They then used GitHub Actions to queue repositories into a pipeline that their AI Security Analyzer could then generate security design documentation, threat modeling, attack surface, and attack tree analysis for.
Security researcher Dylan Ayrey identified three key vulnerabilities in Eight Sleep's "Pod" mattress: a developer backdoor for SSH access, an exposed AWS key, and dependence on cloud services. He replaced the $4,700 hub with a $150 aquarium chiller, demonstrating a simpler solution for temperature control that avoided data collection and internet access, instead of relying on a $200-300 annual subscription.
The article discusses how BloodHound Enterprise addressed false positives in Active Directory attack paths due to object ownership permissions. It explains how Microsoft's BlockOwnerImplicitRights feature prevents compromised accounts from altering security descriptors to elevate privileges. The author details the implementation of OwnsLimitedRights and WriteOwnerLimitedRights edges in BloodHound v7.1.0, which correctly identify when these features are active, reducing false positives for users blocking owner implicit rights.
Sponsored
86% of cyberattacks on companies are credential-related; a data breach can cost millions; password managers like Bitwarden start at $4 per user. Read more about password managers and your IT budget [12]. Need enterprise password management that scales with your business? Trusted globally, Bitwarden is open source and compliant. See how to
SplxAI relies on automated security testing, continuous monitoring, and dynamic remediation to secure internal AI agents and customer-facing AI systems, preventing attacks such as prompt injections, hallucinations, and off-topic responses.
UTMStack is a unified threat management platform that merges SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) technologies.
PurpleLab is a readily deployable lab solution for cybersecurity professionals to test and create detection rules, simulate logs, and undertake various security tasks.
Many threat actors are recognized by various names. These designations vary based on different vendors' conventions, such as Crowdstrike's use of animal names and Mandiant's APT classifications. This post features a list of threat actor names publicly disclosed by Microsoft, as well as additional names they are recognized by.
Troy Hunt of Have I Been Pwned recently fell for a phishing email that claimed his Mailchimp privileges were restricted, redirecting him to a site that stole his login and MFA code. The email's legitimacy was convincing, and fatigue combined with Outlook for iOS not displaying the email address contributed to his error. However, 1Password's lack of autofill should have prevented it. Hunt also questioned why Mailchimp kept unsubscribed emails and has added the breached email list to his site.
OpenAI is enhancing its security posture through a security grant program, a bug bounty cash increase, and AI-powered defense strategies. It is committed to protecting users, disrupting threats, and developing secure AI technologies as they advance toward AGI.
Astral Foods experienced a cybersecurity incident that resulted in $1.1 million in lost profits and disrupted poultry processing, but no customer data was compromised.
Australian police are investigating a cyber attack on the NSW Online Registry that resulted in the theft of 9,000 sensitive files, prompting authorities to contact potentially affected individuals due to risks of victim exposure and extortion.
A new ransomware group called Arkana Security claims to have hacked US telecom firm WideOpenWest (WOW!) and stolen customer information.