Parse notes
Sponsored
Poorly-managed passwords are the #1 cause of breaches, and they leave IT teams struggling with fragmented access management and manual onboarding/offboarding processes. Reddit was dealing with all these challenges, plus a compromised security vendor. They needed a solution that reduced credential risk without slowing down their employees.
LayerX Security uncovered a flaw in OpenAI's ChatGPT Atlas browser that allows attackers to inject malicious commands, leading to remote code execution and persistent access. The exploit manipulates the browser's AI functions to process hidden malicious instructions, as Atlas provides 90% less phishing protection than Chrome or Edge. Security teams should restrict Atlas for sensitive accounts, monitor endpoints, and await OpenAI patches, treating AI browsers as higher risk with heightened security.
An extensive SMS phishing campaign, attributed to a Chinese-speaking group called Smishing Triad, has used over 194,000 domains since early 2024. The attackers impersonated services such as banks and delivery firms to steal personal data via urgent texts. Their tactics include cycling through disposable domains and running a phishing-as-a-service operation, making detection challenging for authorities worldwide.
Western Sydney University (WSU) reported its third security incident of the year, with an unauthorized user accessing data belonging to staff and students. The breached data includes tax file numbers, bank account details, passport and driver's license details, visa information, health and disability information, addresses, email addresses, phone numbers, names, dates of birth, ethnicities, and student and staff IDs. WSU stated that the breach was caused by a daisy chain of supply chain attacks culminating in a third-party student management system being breached.
Malware can easily detect VirtualBox environments through obvious indicators such as registry keys, file artifacts, MAC addresses, and VirtualBox-specific naming conventions, undermining VM-based malware analysis. Security researchers created vbox_stealth (Bash) and VBoxCloak (PowerShell) tools to mask VM indicators by renaming hardware identifiers, modifying registry entries, and removing VirtualBox-specific processes and files. While these tools improve VM stealth capabilities, sophisticated malware may still employ more subtle detection methods that remain difficult to circumvent.
When launching AWS ECS tasks on EC2 instances, each task, by default, has access to the Instance Metadata Service (IMDS), which can be used to access credentials of other tasks or to escalate privileges to the instance role. Using IMDSv2 with a hop limit of 1 is not effective for stopping this attack vector, as some networking modes can still access IMDS. The article includes details for blocking IMDS access in each networking mode.
Prompt injection is an increasingly critical security issue as AI-driven browsers gain agentic capabilities: they can now act on users' behalf, from opening web pages to handling emails and files. This opens up new attack vectors, such as direct injection via URLs or indirect injection hidden within website or document text, allowing attackers to trick bots into performing dangerous actions without user consent. While some countermeasures, such as reduced privileges and human oversight, can lower risks, experts believe prompt injection is unavoidable, not just a bug but a fundamental vulnerability whenever AI interprets untrusted data.
OSDFIR Infrastructure is a Kubernetes-based platform that uses Helm charts to simplify the deployment and integration of multiple open source digital forensics tools, including Timesketch, Yeti, OpenRelik, GRR, and others. The platform enables collaborative forensic investigations by providing a unified environment where tools can work together and share data through workflows and integrations. It streamlines the setup process for DFIR teams who want to deploy a comprehensive suite of forensic analysis tools in local or cloud Kubernetes clusters.
Sublime Security has developed an agentic email security platform that leverages AI agents to analyze messages in search of threats. The platform uses a distributed detection model that conducts intent and behavioral analysis, along with deep content inspection.
A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world.
The New York State Department of Financial Services announced new guidance regarding the use of third-party service providers. Third-party suppliers can cause supply chain attacks if attackers compromise them, and can be the weak link in an organization's security strategy. The new guidance does not impose new regulations or restrictions on regulated organizations.
Chinese threat actors exploited the ToolShell SharePoint vulnerability (CVE-2025-53770) just two days after Microsoft patched it in July, compromising a Middle East telecoms company and multiple government agencies by using the Zingdoor backdoor, the ShadowPad Trojan, and KrustyLoader malware. The attackers demonstrated rapid exploitation capabilities by mass-scanning for vulnerable systems, then deploying sophisticated toolsets, including DLL sideloading techniques, credential-dumping utilities, and the Sliver C2 framework for persistent access. Organizations should prioritize immediate patching of SharePoint servers and monitor for indicators, including the provided file hashes, with particular focus on DLL sideloading activities and connections to the identified AWS-hosted C2 infrastructure.
Ransomware groups are adapting as ransom payment rates hit historic lows at just 23% of ransom attacks. Attackers are increasingly using social engineering and insider bribes, like in Medusa's BBC attack, driven by shrinking profits and tougher defenses. Mid-market firms remain the most frequent victims, but larger enterprises face new, targeted extortion methods.
Sponsored
Malware monsters. Defender superheroes. Epic battles for your data. We're making cybersecurity as entertaining as your favorite Halloween movie. Real lessons, zero boredom. October 30th, 2-3pm CET. Don't miss
X will require users with hardware security keys or passkeys to re-enroll their 2FA devices by November 10, as it is moving from twitter.com to x.com.
Meta's latest smart glasses are pushing wearable surveillance into daily life, challenging both privacy laws and social norms.
Chrome 154 will enable "Always Use Secure Connections" by default in October 2026 to protect against MITM attacks.