Parse notes
Sponsored
Every AI tool in your organization touches sensitive data—customer names, financial records, and more. One wrong move, and you could be facing a compliance nightmare. With Airia [4], you don't have to choose between innovation and governance.
RedTiger, an open-source Python-based infostealer repurposed by cybercriminals, targets Discord gamers (especially French-speaking users) to steal authentication tokens, payment information, browser credentials, cryptocurrency wallets, and webcam images while modifying Discord to maintain persistent access even after password changes. The malware evades detection by shutting down when it detects security tools, employs "mass file and process spamming" (creating 100 random files and launching 400 programs to hinder forensic analysis), and exfiltrates stolen data via GoFile with Discord webhook notifications to attackers. Security professionals should implement multi-factor authentication on Discord accounts, avoid downloading software from unverified sources, and recognize that legitimate security testing tools are increasingly weaponized for credential theft campaigns.
LG Uplus, one of South Korea's largest telecom operators, has reported a suspected data breach to Korea's national cybersecurity watchdog KISA, but did not say when the results of its investigation would be available. All three major Korean telcos have faced recent cyber incidents, raising concerns about the country's digital defenses.
Japanese advertising giant Dentsu has revealed that its subsidiary, Merkle, suffered a data breach that exposed sensitive information about clients, suppliers, and employees. The breach was detected following abnormal activity on Merkle's network, leading to some systems being shut down.
Researchers demonstrated that machine learning can significantly enhance acoustic side-channel attacks by analyzing keyboard typing sounds to reconstruct typed text with high accuracy, exploiting acoustic emanations from physical keystrokes captured via microphones or smartphones. The attacks leverage ML models trained on keystroke audio patterns to classify individual key presses, achieving reconstruction rates that pose realistic threats to password and sensitive data entry in shared or public spaces. Security professionals should educate users about acoustic eavesdropping risks in public environments, consider acoustic shielding for sensitive areas, and promote authentication methods less vulnerable to acoustic side-channels like biometrics or hardware tokens, rather than typed passwords.
An exploration of Almanax, Corgea, and ZeroPath Security's AI SAST capabilities. The post uses three steps in its evaluation: code retrieval and indexing, code scanning, and false positive detection, deduplication, and severity rating, along with some miscellaneous items like the ease of using the UIs. The author concludes that ZeroPath is the best out of the products tested, followed by Corgea and Almanax.
PromptLock is a proof-of-concept malware developed by NYU researchers to operate autonomously using an LLM hosted by the researchers. The author of this post wanted to experiment with building a post-exploitation tool that leverages the LLM included in Microsoft's Copilot+ PCs to create malware that's not dependent on a Command and Control (C2) Server. By providing the malware with tools to identify, modify, and restart vulnerable services, they were able to exploit two services using the LLM in a test environment.
Sponsored
At Persona, we've seen deepfake attacks surge 50x, yet 85% of CISOs say they lack GenAI-ready incident response plans. Workforce security is no longer about _if_ you'll be targeted, but whether you're prepared.
Cloudflare and Chrome are testing Merkle Tree Certificates (MTCs) to improve post-quantum signature performance, which are 20 times larger than current ECDSA signatures (ML-DSA-44 signatures are 2,420 bytes vs 64 bytes for ECDSA-P256). MTCs reduce TLS handshakes to one signature, one public key, and one Merkle inclusion proof by batching certificates into Merkle trees with signed tree heads sent out-of-band to clients, compared to today's five signatures and two public keys per handshake. The deployment will use "bootstrap certificates" from trusted CAs to validate MTCs via certificate transparency, starting early 2026 with some Cloudflare and Chrome users to assess performance and ossification issues.
SockTail is a compact binary that connects a device to a Tailscale network and provides a local SOCKS5 proxy on port 1080. It is designed for red team operations, enabling network access to a target system without the need for complex port forwarding, persistent daemons, or noisy tunnels.
CyberRidge has developed a plug-and-play photonic encryption system that transforms transmitted data into encrypted optical noise. This shields data from interception, quantum analysis, and “harvest now, decrypt later” attacks, aiming for post-quantum secure data transmission.
A Beelzebub LLM-powered SSH honeypot successfully detected a genuine threat actor who downloaded Perl backdoor scripts from a compromised Joomla site. The attacker attempted to establish IRC-based command-and-control (C&C) connections using "rootbox PerlBot v2.0" on Undernet channels #rootbox and #c0d3rs-TeaM. Their tactics, techniques, and procedures (TTPs) included downloading malware to /tmp, attempting to escalate privileges with sudo, and deploying botnet agents that connected to ix1.undernet.org:6667 for C&C operations. Security teams can utilize LLM honeypots to gather real-time threat intelligence and disrupt botnets by analyzing malware configurations and reporting C&C infrastructure to hosting providers.
Germany's cybersecurity agency warns that over 90% of Exchange servers in the country are using software that no longer receives support or updates. This leaves thousands of organizations, including hospitals and public institutions, vulnerable to critical security threats and ransomware. Microsoft offers extended updates for a limited time, but officials urge urgent upgrades or migration to avoid total network compromise.
Zimperium researchers discovered over 760 malicious Android apps exploiting NFC and Host Card Emulation features to relay payment card data in real-time to attackers via 70+ command-and-control servers and Telegram bots, with fake banking apps impersonating Google Pay, VTB Bank, and Santander across Russia, Poland, Brazil and other countries to enable fraudulent tap-to-pay transactions without physical card access, prompting recommendations to download apps only from Google Play Store and implement stronger NFC permission controls.
Sponsored
Security tends to look at threats trying to enter your network - but malicious outbound traffic can undo your entire security stack. READ
A 19-year-old California man faces federal charges for alleged involvement in the extremist "764" network, a Nihilistic Violent Extremist group focused on exploiting minors and collapsing social norms.
Canadian authorities report multiple opportunistic hacktivist breaches of internet-exposed Industrial Control Systems at critical infrastructure facilities.