Parse notes
Sponsored
Explore security tools built specifically for AWS environments [5]. Deploy and test advanced solutions in minutes with free trials and pay-as-you-go pricing. From next-gen firewalls to automated compliance tools. Browse the complete collection and start your free trial today.
Toys “R” Us Canada has sent notices to customers of a security incident in which threat actors leaked data they stole from its systems. The breached data includes full names, physical addresses, email addresses, and phone numbers.
Endpoint security firm Koi Security uncovered a new self-spreading malware targeting developers, embedded in VS Code and OpenVSX extensions. The malware was pushed via hidden code in compromised extensions, which downloaded an infostealer that stole cryptocurrency wallet data and credentials for GitHub, npm, and OpenVSX accounts. The malware also attempts to infect any extensions it gains access to to self-propagate.
DataDog Security Labs identified a new phishing method exploiting Microsoft's Copilot Studio chatbots. Attackers can tailor the Login topic to create convincing phishing pages hosted on copilotstudio.microsoft.com. The attack involves administrators approving permission requests from the application, which can be a “demo website” that does not need Microsoft's verification.
Agentic browsers like OpenAI Atlas are vulnerable to exploitation if input boundaries are not strictly enforced. Attackers can create strings that look like URLs but contain natural-language commands, which the omnibox might interpret as user intent. This can allow malicious actors to override user commands, leading to unintended or harmful actions, such as opening phishing sites or executing destructive instructions.
File hashes, IP addresses, and domains are usually seen as indicators of compromise (IoCs), but they have limited value in investigations because adversaries can easily alter them. These IoCs can be more insightful if supplemented with additional contextual data like fuzzy hashes, GeoIP information, and domain reputation. As AI enhances malware developers' abilities, IoCs will no longer serve as standalone alerts but will evolve into data points that help build a comprehensive understanding of a threat actor's behavior.
This post demonstrates how to use LLMs with Model Context Protocol (MCP) servers integrated into IDA Pro and Ghidra to accelerate malware reverse engineering through automated function analysis, code documentation, and variable renaming. Testing on IcedID malware compared cloud-based Claude Sonnet 3.7 ($2.91-$13.24 per analysis, 18-11 minutes) against local Ollama/Devstral models ($0 cost, 22-46 minutes), with cloud models providing more thorough analysis but at a higher expense. Key limitations include token costs escalating with file complexity, context window truncation causing local models to forget instructions mid-analysis, and security risks from prompt injection, tool poisoning, and potential data exfiltration when using untrusted MCP servers.
Sponsored
Learn how to defend cloud control planes, adapt endpoint detection mindsets to cloud environments, and find the right balance in detection rules. Datadog Detect [13] (October 30, 12PM ET) [13] brings together security researchers from Red Canary, Corelight, and Datadog to share practical approaches for building scalable detection and
Maigret collects a dossier on a person by username alone, checking accounts across a vast number of sites and gathering all available information from web pages. No API keys are required. Maigret is an easy-to-use and powerful fork of Sherlock.
Sketchy is a cross-platform security scanner that checks for signs that a package, repository, or script might be malicious.
ExCyTIn-Bench is the first benchmark for evaluating LLM-based agents in threat hunting that uses security-question-answering pairs.
AI-powered browsers promise convenience but can unintentionally follow dangerous instructions hidden in web content, risking user security. Comet's recent vulnerability exposed how easily AIs can be manipulated. They are like naive assistants who often cannot distinguish malicious commands from user input. A simple hidden command can hijack and send private data to a thief.
A federal judge issued a permanent injunction against NSO, banning it from using Pegasus spyware on WhatsApp users and requiring it to delete illegally obtained data. The ruling, from Meta's lawsuit, revealed that Pegasus infected activists', diplomats', and journalists' devices. Punitive damages were reduced, but the case sets a precedent that enhances privacy protections and makes attacks on encrypted platforms like WhatsApp riskier.
Attackers used phishing to compromise npm maintainer accounts in September, injecting malicious code into 18 popular packages with over 2 billion weekly downloads to steal cryptocurrency and credentials from CI/CD pipelines. Cloudflare's Page Shield, using ML-based analysis of 3.5 billion scripts daily, detected all compromised packages with 98% precision and 90% recall by identifying obfuscated code and changes to wallet interfaces. Organizations should audit dependencies, rotate credentials, pin safe versions, and consider Cloudflare's Client-Side Risk Assessment for supply chain security.
Sponsored
From lawsuits to data leaks, Slack data risk is real. BENlabs used Onna to stabilize costs, contain exposure, and safeguard growth.
An 85% increase in cyberattacks on US government agencies since October has led to over 555 million projected attacks this month.
Reddit sued AI startup Perplexity, Lithuanian firm Oxylabs, SerpApi, and Russian company AWMProxy for allegedly circumventing platform protections by scraping Reddit content from Google search results to train AI models and resell data to companies like OpenAI and Meta.