Parse notes
Sponsored
Remote work, digital transformation and the rise of AI are all placing increased focus on identity management. However, many CISOs fail to align IAM with broader security initiatives; while IAM metrics are often overly technical, performance-oriented, and inward-looking.
you need to answer in order to bridge the gap between security and
→ Want to dive deeper into these issues and prepare your IAM program for the age of AI agents? Register for Gartner Identity & Access
Episource, a healthcare services company that provides risk adjustment, medical coding, data analytics, and technology solutions to health plans and providers, is warning impacted patients of a data breach that it suffered in January. The breached data may have included full names, physical addresses, email addresses, phone numbers, insurance plan and Medicaid information, medical records, dates of birth, and SSNs. Episource has stated that no banking or payment card information was stolen.
Cisco Talos is warning potential crypto job seekers in India of a malware campaign by the North Korean Famous Chollima group. Fake employers are approaching software engineers, marketing employees, and designers with skill-testing pages to apply for positions at cryptocurrency companies like Coinbase, Archblock, and Robinhood. These pages feature ClickFix attacks, which prompt victims to run malicious code to fix errors. The code eventually downloads infostealer malware to steal browser credentials and session tokens.
The China-linked hacking group Salt Typhoon breached the satellite company Viasat and other global telecom providers. They exploited security flaws in network devices to conduct espionage across multiple countries. Officials confirmed that customer data remained secure and the vulnerabilities were addressed.
The `pull_request_target` event is infamous because it opens up room for abuse by running in the context of the base repo with full secrets access and write permissions to the GITHUB_TOKEN. Sysdig found repositories belonging to MITRE, Splunk, and a popular open-source Spotify client that could be hijacked via `pull_request_target` abuse. Sysdig recommends using the `pull_request` event instead, along with workflow splitting and restricting GITHUB_TOKEN permissions to avoid these issues.
Cloudflared is a popular tunneling service offered by Cloudflare that legitimate organizations or adversaries can utilize to establish persistence. Cloudflared authenticates using tokens that contain the account ID, tunnel ID, and a secret. Ransomware groups often do not vary their Cloudflare accounts, so detecting anomalous tokens or renamed processes can be effective for threat hunting.
Sponsored
As your business evolves, so do risk & compliance challenges. Drata's [11] AI-Native Trust Management platform simplifies oversight, keeps you ahead of regulations, and ensures you never miss a requirement. Scale faster. Stay compliant. Sleep better. Get a personalized demo of
Loris is a stateful fuzz testing framework designed to explore and analyze baseband firmware.
Frida is a dynamic toolkit for reverse engineering, security research, and runtime analysis across various platforms and languages. Version 17.2.0 focuses on simplifying package discovery with the `frida-pm` CLI tool. The release features a streamlined package manager for easily searching and installing Frida-specific packages using `frida-pm search` and `frida-pm install`, even without Node.js.
This is an MCP (Model Context Protocol) server for pycti that provides a front-end interface to OpenCTI threat intelligence data. The server condenses and normalizes OpenCTI data into JSON format for LLMs, making field names more verbose and resolving GraphQL-linked entities to provide better response context. It includes three main tools for looking up observables, adversaries, and reports in OpenCTI, and can run either as a TCP server or STDIO server.
Ryan Cox shares lessons from leading the incident response for a high-stakes incident that stretched about a month. Cox stresses the importance of proactively establishing interdepartmental relationships so that during an incident, you have SMEs that you can rely upon. Cox also reminds incident commanders to avoid diving too deeply into tasks and losing the big picture. Lastly, Cox stresses the importance of having scalable processes around documentation and other often forgotten topics and conducting post-mortem root-cause analysis.
A hacker group called Banana Squad hid malware in fake GitHub projects that looked like real tools. Their attacks stole sensitive data from thousands of computers before being discovered. Even though malware in open-source software dropped in 2024, attacks are getting smarter, so users need to be careful.
A huge leak of 16 billion credentials was reported, but it is just a collection of old stolen data, not a new breach. These credentials were taken by malware or past hacks and have been shared online for years.
Meta has announced plans to roll out passkey support to its Facebook apps “soon” with Messenger and other apps to follow.
Hackers linked to Israel's Predatory Sparrow group stole and destroyed over $90 million in cryptocurrency from Iran's largest exchange, Nobitex.
Scammers are placing fraudulent customer support numbers on legitimate websites such as Apple, Netflix, and PayPal, using deceptive web addresses to make them look like they're part of the official help pages.