Parse notes
Sponsored
🚨53% of organizations faced multiple severe security incidents last year — and now, companies must not only prevent attacks, but endure, respond, and build trust through disruption. The ones investing in trust are pulling ahead.
The Anubis ransomware-as-a-service operation added a new wiper module to its malware that destroys targeted files, making recovery impossible even if the ransom is paid. The new /WIPEMODE command requires key-based authentication and then erases all file contents, reducing the file size to 0 KB. This functionality presumably increased Anubis' pressure on victims during negotiations.
Check Point Research discovered a campaign conducted by the Stargazers Ghost Network that leverages approximately 500 different GitHub repositories to target Minecraft players with trojanized and malicious mods. The mods contain a JAR loader which downloads the Java-based stealer from Pastebin. The stealer attempts to steal Minecraft account tokens, data from popular third-party launchers, and Discord and Telegram account tokens before acting as a loader for a traditional info stealer which attempts to steal information from web browsers, VPN account data, cryptocurrency wallets, etc.
Noma Security researchers discovered the "AgentSmith" vulnerability (CVE score 8.8) in LangChain's LangSmith platform, allowing malicious AI agents in the public Prompt Hub to steal sensitive user data, including OpenAI API keys, through hidden proxy configurations. When users adopted and ran these compromised agents, all their communications and private data would be secretly intercepted through the attacker's server in a man-in-the-middle attack, potentially leading to unauthorized account access, data theft, and financial losses. LangChain fixed the vulnerability on November 6, 2024, after responsible disclosure and implemented new safety measures, including warning messages and banners for agents with custom proxy settings.
A 3-part guide to implementing SIEM and SOAR platforms for security professionals and executives. The first part is designed for executives and introduces the concept of SIEM and SOAR, explains how they function, provides guidance for choosing a SIEM, and cautions organizations on attempting to implement a SOAR before properly implementing and testing a SIEM. The second and third parts are for implementers.
Researchers from Zimperium zLabs unveiled a new variant of the GodFather Android malware that uses on-device virtualization to deploy real banking and cryptocurrency apps in a controlled sandbox. This method allows attackers to monitor and steal user credentials stealthily, as the malware disguises itself by installing a hidden host app that redirects users to virtualized versions of these applications. Primarily targeting 12 Turkish financial institutions, the malware affects 484 applications globally and employs overlays and Android accessibility services to enhance control over devices.
At ShowMeCon 2025 in St. Charles, cybersecurity experts noted that while compliance frameworks like PCI DSS provide necessary structure, they are often treated as mere formalities rather than integral to operational security. They stressed the importance of human oversight in AI-driven policy creation and threat detection, acknowledging that adversaries also use AI for more sophisticated attacks. The key takeaway was that compliance should be a foundational step.
Sponsored
Hybrid teams and remote workers have completely blurred the lines of the security perimeter, creating ample room for human error and misuses of credentials (which together cause 85% of data breaches). Learn how to protect your hybrid workforce while keeping everyone productive - read the free ebook [11] or request a demo [12].
Tracecat is an open-source automation platform built for security and IT engineers that uses YAML-based templates for integrations with a no-code UI for workflows. It is designed to be a free, open-source alternative to tools like Tines or Splunk SOAR.
This repository provides Terraform code that demonstrates how multi-cloud federated user and workload authentication can be utilized.
A user-mode code and its rootkit that will kill EDR processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.
Turkish intelligence announced that it caught seven suspects who belonged to a Chinese espionage ring eavesdropping on Uyghurs and Turkish officials. The attackers used IMSI-catcher devices to mimic legitimate mobile phone tower signals to collect data, phone logs, conversations, and other information from nearby phones. The attackers funded their operations by hacking into and draining the bank accounts of Turkish civilians.
Jordan Whitehead delves into reversing the Anzu in-game ad client's usage in the Trackmania racing game. First, Whitehead built a DLL harness to enumerate the functions that Trackmania called from the anzu.dll and iterated on it to uncover further debug information and arguments. He then used mitmproxy to intercept network traffic and was able to utilize this to view the JavaScript functionality that managed targeted ads and replace ad campaigns with his own custom campaigns, serving images from localhost.
Tenable researchers discovered a misconfiguration in Google's Gerrit code collaboration platform that could have allowed attackers to inject malicious code into popular Google projects like ChromiumOS, Bazel, and Dart through supply chain attacks. The vulnerability, dubbed "GerriScary" (CVE-2025-1568), exploited improper permissions for the addPatchSet feature and a race condition in the automated merge process, allowing attackers to modify approved code changes without triggering new reviews. Google fixed the issue across all Chrome/ChromeOS-related projects after Tenable's October 2024 report, awarded a $5,000 bug bounty, and found no evidence of prior exploitation.
Thai police raided the Antai Holiday Hotel in Pattaya, arresting at least 20 foreigners, including six Chinese nationals involved in a ransomware operation targeting Chinese companies, and apprehending around 20 individuals running an illegal gambling ring while seizing laptops, mobile devices, and gambling equipment.
Qualys disclosed two new Linux vulnerabilities (CVE-2025-6018 and CVE-2025-6019) that can be chained together to allow unprivileged attackers to gain full root access, while CISA separately warned that an older Linux kernel flaw (CVE-2023-0386) is being actively exploited in the wild.