Parse notes
Sponsored
Flashpoint's Threat Intelligence Report looks at +3.6 petabytes of data from the hardest-to-reach corners of the web — revealing 2.1B stolen credentials and 5,742 ransomware attacks in 2024, with five major RaaS groups responsible for nearly half.
AT&T is investigating claims that 86 million customer records, reportedly containing birthdates, phone numbers, addresses, and 44 million social security numbers, are being sold on cybercrime forums. The company says this appears to be repackaged data from previous breaches, possibly the 2024 Snowflake incident or an earlier 2021 theft, rather than a new hack.
Cisco Talos discovered "PathWiper," a new Russian wiper malware targeting Ukrainian critical infrastructure through legitimate endpoint administration frameworks. Unlike previous wipers, PathWiper programmatically identifies all connected drives and network paths via APIs before overwriting data with random bytes, potentially more destructive than tools like HermeticWiper used in earlier attacks.
Researchers have discovered an open 613GB database containing over 4 billion records. The database contained numerous data collections, including an 805M record database of WeChat records, a 780M record database of addresses and geographic data, banking information, and MFA devices. However, the researchers could not analyze the dataset comprehensively as it was taken down soon after discovery.
AI tools are making it easier and faster for people to write code, even with little experience. However, many experts worry that this “vibe coding” approach will pose serious security risks. While AI coding grows fast, it still struggles to make safe and reliable software.
A Business Email Compromise (BEC) incident response checklist for Office 365 outlines four phases: isolate the compromised account, contain the threat by resetting credentials and removing unauthorized configurations, eradicate traces of the attacker, and assess impact by reviewing sent emails and shared files. The response includes immediate actions like disabling accounts and changing passwords, followed by forensic analysis, stakeholder notification, and required regulatory reporting. Prevention through proper security measures is easier than incident response, but organizations must learn from incidents to strengthen defenses.
Google Threat Intelligence Group (GTIG) reports on threat activity from a group tracked as UNC6040. The group uses vishing to impersonate IT support personnel in convincing attacks targeting employees in multinational corporations into granting access or sharing credentials to their Salesforce platform. In many campaigns, the threat actors convince the victim to add a modified version of the bulk data import tool, Salesforce Data Loader, which is modified to send the data to an attacker-controlled infrastructure.
Mind provides real-time detection capabilities, instantly blocking malicious and inadvertent attempts to exfiltrate sensitive information from an organization's environment.
A curated list of tools officially presented at Black Hat events.
Auditor.codes is a web platform where users learn to spot security bugs in real C/C++ code. It offers thousands of hands-on challenges, from basic to very hard, and tracks their progress. The site is still in early development, so users are encouraged to give feedback and file bug reports.
The US State Department is offering up to $10 million for information on Maxim Alexandrovich Rudometov, the alleged developer of RedLine malware that steals credentials and financial data. RedLine infrastructure was disrupted in October 2024, but the malware may remain active.
Mandiant has detected a new malware campaign that utilizes social media ads to distribute infostealers and backdoors. The campaign is spread by advertising free access to popular AI video generators such as Luma AI, Canva Dream Lab, and Kling AI. After the user inputs a prompt, they are served with one of the static malicious payloads that the site hosts.
Max Mitchell found that while AI primarily generated Cloudflare's OAuth 2.1 library code, human oversight remained essential for debugging and strategic guidance.
More than 20 fraudulent crypto wallet apps on Google Play were identified as stealing users' recovery phrases to access their cryptocurrency funds.
Popular Chrome extensions were discovered to leak user data via unencrypted HTTP connections, exposing users to spying and cyber threats, particularly on public Wi-Fi.