Parse notes
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
…all led by a team of expert certified testers.
Opexus, which provides software services for processing US government records, was compromised by two employees in an insider threat attack. The two brothers at the center of the breach had destroyed more than 330 databases and removed more than 1,800 files related to one government project. The FBI and other government agencies are investigating the incident.
West Lothian Council's education network suffered a ransomware attack by group "Interlock," affecting 143 schools and nurseries. Less than 10% of data was stolen, including personal information from lesson planning and potentially medical/social work records. The schools remain open with contingency plans.
Brazilian researchers scraped over 2 billion public Discord messages and published the anonymized data online. They anonymized the data by replacing usernames with pseudonyms, hashing user identifiers, and removing identifying features, yet some are concerned about its efficacy. The researchers intended to offer a message corpus for other studies. However, a Discord spokesperson noted that scraping violates the platform's terms of service.
GitLab's AI assistant "Duo" contained an indirect prompt injection vulnerability that allows attackers to manipulate it through hidden prompts in code. This could enable source code theft, phishing attacks, malware distribution, and data exfiltration. Duo's deep DevSecOps integration and browser-rendered Markdown responses create an unusually wide attack surface compared to typical AI coding assistants.
Agentic AI has changed how threat actors approach systems, enabling more customized, patient, and persistent campaigns. This post identifies ways that threat actors use AI agents across every stage of the attack chain from reconnaissance and initial access to pivoting, persistence, and exfiltration. It highlights the need for defensive tooling to adopt more agentic workflows to combat this threat.
A solution post from AWS on utilizing AWS Transfer Family and GuardDuty to scan files uploaded to an SFTP server. The workflow utilizes Lambda functions with Step Functions to move uploaded files to an S3 bucket, scan them with GuardDuty, clean infected files, and then notify the user via SNS. Terraform files are provided to deploy the solution.
Monkey365 is an Open-Source security tool that can easily conduct security configuration reviews for Microsoft 365, Azure subscriptions, and Microsoft Entra ID without the significant overhead of learning tool APIs or complex admin panels from the start.
QTap is an eBPF agent that captures traffic flowing through the Linux kernel before and after TLS/SSL encryption and then passes it to plugins to add additional context.
FBI Watchdog is a cyber threat intelligence OSINT tool that monitors domain DNS changes in real-time, specifically detecting law enforcement seizures (ns1.fbi.seized.gov and ns2.fbi.seized.gov). It alerts users via Telegram and Discord and captures screenshots of seized domains.
Signal is blocking Windows 11's Recall AI feature from screenshotting its app by default, using a DRM API intended for copyrighted content. Recall captures screenshots every three seconds, potentially exposing private conversations. Signal took this step because Microsoft does not provide proper developer tools to prevent apps from being indexed by Recall.
Ireland's Data Protection Commission approved Meta's plan to use European users' public social media posts for AI training starting May 27, despite ongoing legal challenges. Privacy group noyb and German courts are fighting the decision, arguing Meta's "legitimate interest" justification violates GDPR requirements for explicit user consent.
After a security researcher purchased a new Volkswagen and found that they were locked out of connecting to the app, they decided to attempt to brute-force the app and discovered further vulnerabilities after succeeding. The researcher discovered that the app leaked credentials for other services, such as Salesforce and the owner's personal details and vehicle service history, which could be accessed with only a VIN. The researcher coordinated with Volkswagen, and as of May 6, they were able to verify the fix.
Microsoft and law enforcement seized 2,305 domains operating Lumma info-stealer malware found on 394,000 Windows PCs globally, stealing passwords and cryptocurrency wallets from infected systems.
A hacker known as ByteBreaker has purportedly offered for sale 1.2 billion Facebook user records obtained via an API, though experts have noted discrepancies in the figures and sample data, leading to skepticism.
Cloudflare has launched 13 new MCP servers that let users access tools, data, and features through natural language.