Parse notes
Sponsored
One of the most visible trends in cybersecurity is the emergence of platforms that offer capabilities across multiple technology segments. SentinelOne and 451 Research have partnered together to survey 600+ security practitioners and leaders [4] to understand this trend and what SecOps teams are choosing and why they are choosing them.
German peripherals maker Endgame Gear is warning users that malware was embedded in its configuration tool for the OP1w 4k v2 mouse between June 26 and July 9. The malicious version of the download included the XRed backdoor, which features keylogging capabilities, the ability to open a remote shell, and data exfiltration. Endgame Gear has announced that, going forward, it will discontinue hosting separate download pages and will add SHA hash verification and digital signing for all hosted files.
A group of security researchers discovered two vulnerabilities in the Lovense sex toy app that could allow an attacker to retrieve a user's private email address with just their username and perform an account takeover with just an email address. To exploit the flaw, an attacker sends a POST request to the `/api/wear/genGtoken` API endpoint, then forwards the encrypted payload to another endpoint, which returns a fake ID that the user can add to their contact list to reveal the real email address. Lovense claims that both flaws were fixed. However, researchers report that only the account takeover flaw was fixed.
French telecom giant Orange reported a cyberattack on July 25 that disrupted services for business clients and some public sector services in France. The company isolated affected systems and expects full restoration by Wednesday. Orange claims no customer or internal data was compromised and has notified the relevant authorities about the incident.
Wiz Research discovered a critical vulnerability in Base44, a popular "vibe coding" platform that allows users to build apps through natural language prompts. The flaw allowed attackers to bypass authentication using only non-secret app IDs, potentially granting access to private enterprise applications and sensitive data.
Attackers used a fake CAPTCHA page that employed the ClickFix social engineering technique to trick users into pressing Windows+R and pasting a PowerShell command that downloaded LUMMA stealer malware. The malware targeted browser credential stores (Login Data and Web Data) from Microsoft Edge and Google Chrome, establishing C2 communication within minutes of initial execution. The attack chain leveraged multiple evasion techniques, including heavily obfuscated PowerShell, AutoIt scripts, and mshta.exe proxy execution to bypass security controls.
This post provides an overview of the layers in cloud environments, the threats that target each layer, and the tools that are best suited to address them. The cloud infrastructure/control plane layer handles tasks such as resource provisioning, configuration management, and user permissions. The orchestration layer hosts platforms such as Kubernetes and related services live, whereas the platform layer runs more generalized workloads. Finally, the application layer includes software that end-users rely on, such as custom web applications, APIs, and SaaS apps.
Sponsored
Looking to meet rising expectations? Unlock the next level of MSP efficiency with Duo's_ __Smarter Security Toolkit for MSPs_ [11].
Firecrawl is an API service that takes a URL, crawls it, and converts it into clean Markdown or structured data, which can then be processed by an LLM or other tool.
Seal is a supply chain security tool that differentiates itself by providing patches for vulnerable packages instead of pushing for version upgrades.
Ebyte-Go-Morpher is a Go tool that parses, analyzes, and rewrites Go source code to apply multiple layers of obfuscation. It operates directly on the Go Abstract Syntax Tree (AST) and generates obfuscated source files along with runtime decryption logic.
A Google Cloud and Forrester study of 1,541 tech leaders found that 61% of security professionals are overwhelmed by threat intelligence data, while 60% lack skilled analysts. Top concerns include phishing (46%), ransomware (44%), and AI prompt injection attacks (34%).
PyPI users are being targeted by phishing emails from "pypj[.]org" (note the "j"), which request email verification. The fake site mimics PyPI to steal credentials. Users should delete these emails, avoid clicking any links, and change their passwords if compromised.
Choicejacking is a new attack that bypasses smartphone security prompts by spoofing USB or Bluetooth input devices to simulate user actions in under 133 milliseconds. The attack tricks phones into enabling data transfer mode without consent, allowing attackers to access photos, messages, and install malware through compromised public charging stations. Unlike traditional juice jacking attacks, Choicejacking exploits device communication protocols to simulate keyboard input and overflow input buffers, affecting both Android and iOS devices.
Sponsored
Meet rising expectations and unlock the next level of MSP efficiency with Duo's_ __SMARTER SECURITY TOOLKIT FOR MSPS_.
The UK's National Cyber Security Centre (NCSC) contacted the Irish broadcaster RTÉ regarding a potential cybersecurity threat, based on information that it had received.
Minnesota Governor Tim Walz activated the National Guard to provide cyber protection after a cyberattack on Friday crippled the City of Saint Paul's digital services and critical systems.