Parse notes
Sponsored
While security teams wrestle with NVD backlogs and CVE delays, threat actors are having their best year yet. Flashpoint's midyear threat intelligence report [4] analyzed 3.6+ petabytes of data to reveal:
AI chatbots can easily be manipulated to harvest personal data by tweaking system prompts. Even people with little technical skill can weaponize these bots, making privacy risks greater for users. Regulators and companies need stronger safeguards to protect personal information.
Workday disclosed a breach on August 6 where attackers accessed business contact information (names, emails, and phone numbers) from its third-party CRM platform through social engineering, though customer tenants remain unaffected. The attack is linked to ShinyHunters' ongoing campaign targeting Salesforce instances via OAuth app social engineering, which has affected multiple major companies, including Adidas, Google, and luxury brands. Attackers pose as HR or IT staff via phone/text to trick employees into revealing credentials, then use malicious OAuth apps to exfiltrate databases for extortion purposes.
N-central is a popular platform, developed by N-able, that is used by managed services providers (MSPs) and IT departments to monitor and manage networks and devices from a centralized web-based console. N-able has announced two vulnerabilities that allow authenticated attackers to inject commands due to improper sanitization of user input and execute commands on unpatched devices by exploiting an insecure deserialization weakness. The vulnerabilities are reportedly under active exploitation.
Hundreds of TeslaMate setups are exposed online with no authentication, leaking GPS, vehicle, and charging data. Attackers can track vehicle locations and patterns, presenting serious privacy and physical security risks for Tesla owners. The fix is to secure deployments with authentication and firewalls.
Researchers found critical vulnerabilities in Axis Communications' surveillance camera systems that could allow hackers to remotely access, control, and disable cameras at thousands of organizations. Axis has released security patches, and users are advised to update their systems right away to prevent exploitation.
AI agents using LLMs can boost security productivity by 1,000x in tasks like vulnerability patching, but need strict implementation with permissions, transparency, and security controls to prevent hallucinations and data leaks. Security professionals should adopt a "yes with guardrails" approach: automate low-level tasks such as CSV processing and ticket creation while maintaining evidence validation, treat MCP servers as APIs with proper authentication, and ensure vendor AI products don't share data externally. Focus on upskilling teams in AI tools for multiplication, ask critical questions on permissions and data flows before deployment, and keep source code visible for all AI implementations.
Sponsored
Dropzone AI [11] becomes your team's intelligent partner - autonomously investigating alerts, surfacing critical insights, and accelerating decision-making. From 40-minute investigations to 3-minute conclusions. No playbooks required. Just seamless
DllShimmer parses DLLs and extracts information about exported functions (name, ordinal number, and forwarder info) and creates a boilerplate C++ file (.cpp) based on this information. The generated file allows you to add your own code to each function exported from the original DLL without disrupting the normal operation of the program.
Wallarm offers a unified platform for API and AI security, providing real-time attack blocking, abuse detection, and advanced penetration testing for AI through intelligent agents.
Certipy is a tool to enumerate and assess Active Directory Certificate Services (AD CS) for misconfigurations.
Security researchers found malicious npm packages "solana-pump-test" and "solana-spl-sdk" posing as Solana SDK components but stealing cryptocurrency data from Russian developers. These infostealers send data to US servers, suggesting possible state-sponsored activity targeting Russia's ransomware ecosystem relying on cryptocurrency. The attacker, using the handle "cryptohan," promotes these packages that expose password files, exchange credentials, and wallet data from infected systems.
The U.S. Department of Justice confiscated more than $2.8 million in cryptocurrency, $70,000 in cash, and a luxury car from Ianis Aleksandrovich Antropenko. He is accused of participating in the Zeppelin ransomware scheme from 2019 to 2022. Antropenko faces charges of computer fraud and conspiracy to launder money, having processed funds through ChipMixer while targeting healthcare and IT companies worldwide. The Zeppelin ransomware operation ended in November 2022, and its source code was later sold for only $500 on a hacking forum in January 2024.
A federal class-action lawsuit accuses Otter.ai of violating privacy laws by secretly recording and using meeting participants' voices to train its AI without consent, particularly affecting non-account holders who join virtual meetings. The Otter Notetaker bot can automatically join meetings linked to workplace calendars and record all participants, with the lawsuit citing cases where sensitive business discussions were inadvertently captured and shared. With 25 million users and over 1 billion meetings processed, the case could set a precedent for AI transcription services' consent requirements and data usage practices.
Cybercriminals are using phishing kits to hijack brokerage accounts and coordinate “ramp and dump” schemes by inflating foreign stock prices with compromised accounts after failing to cash out funds directly.
Nuance, owned by Microsoft, agreed to pay $8.5 million to settle a lawsuit after hackers exploited the MOVEit software, exposing the data of over 1.2 million people.
PipeMagic is a malicious backdoor disguised as an open-source ChatGPT desktop app that facilitates ransomware operations.