Parse notes
Sponsored
ThreatLocker's annual Zero Trust World [4] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
Marquis, a Texas-based fintech that provides marketing and compliance services to over 700 US banks and credit unions, suffered a ransomware attack on August 14 that exploited a zero-day vulnerability in SonicWall. Attackers stole sensitive customer data, including names, contact details, financial account numbers, and Social Security numbers, impacting at least 400,000 people so far. The total is expected to grow as more state notifications are filed.
A critical flaw in React 19, dubbed React2Shell, allows attackers to execute code remotely on applications that use newer server-side features and common frameworks. Many cloud environments are reportedly exposed. Vendors are already shipping detection and protection rules.
Freedom Mobile, Canada's fourth-largest wireless carrier, disclosed a data breach impacting an undisclosed number of customers. The breached data includes first and last names, home addresses, dates of birth, home and/or cell phone numbers, and Freedom Mobile account numbers. The data was breached via the account of a subcontractor. Ransomware was not involved.
Cotool tested an AI agent's ability to solve security operations tasks using the Splunk BOTSv3 dataset and frontier models from Claude, OpenAI, and Gemini. Cotool found that while GPT-5.1 and Opus 4.5 achieved the top accuracy at 63%, Opus was 3x more expensive than GPT-5.1 but also completed tasks in half the wall-clock time of any other model. The Gemini models performed notably poorly on the tasks and failed to complete several tasks.
Ransomware operators often use remote access tools such as AnyDesk and UltraViewer to maintain persistence, execute remote tasks, and transfer files while avoiding detection. Their typical attack involves using stolen credentials to compromise an employee, then either hijacking existing tools or installing legitimate remote access software, followed by establishing persistence, escalating privileges, and disabling security tools. Subsequently, they deploy payloads, move laterally within the network, and finally execute their ransomware attack.
Researchers trapped North Korean operatives from Lazarus Group's Famous Chollima division inside an extended ANY.RUN sandbox environments, documenting their full operational workflow for infiltrating Western companies as remote IT workers. The operators recruit developers via GitHub spam. They offer 20-35% salary cuts in exchange for using victims' identities and laptops for job applications, relying on AI interview tools, AstrillVPN, and remote access software rather than malware. Poor operational security allowed researchers to delay, monitor, and ultimately expose the scheme targeting the finance, crypto, and healthcare sectors.
7AI builds an “agentic security” platform where autonomous AI agents investigate alerts, correlate data, and take or recommend actions to reduce alert fatigue.
Open source compliance automation for SOC 2, GDPR, ISO27001, NIST 800-53, and more.
God's Eye is an ultra-fast subdomain enumeration and reconnaissance tool with local LLM analysis via Ollama.
GoldFactory is a cybercrime group targeting Android users in Indonesia, Thailand, and Vietnam with tampered banking apps that still appear legitimate while secretly installing remote-access malware. The malware abuses accessibility services and hooking frameworks to bypass security checks, hide its presence, control devices in real time, and steal banking data at scale. At least 11,000 infections have been identified so far.
Arizona Attorney General Kris Mayes has joined several other states in suing Temu and its parent company over allegations that the online retailer is stealing customers' data. Mayes stated that the app collects a startling amount of data without users' consent, specifically citing GPS location and a list of other apps on users' phones. Mayes also expressed concerns over the quality of products sold on Temu and whether the retailer has “ripped off” other businesses.
Anthropic evaluated ten frontier models on a dataset of 405 historical smart contract exploits and found that the agents produced working attacks against 207 of them, totaling $550M in simulated stolen funds. Anthropic measured the model's current capabilities by plotting each model's total exploit revenue against its release date. The models also discovered two previously undisclosed zero-days.
Sponsored
Blumira's SOC Auto-Focus translates complex findings into plain language, giving teams instant clarity, clear priorities, and guided next steps, without replacing human judgment. Learn more about Blumira
Malwarebytes' Lock and Code podcast revisits UK research revealing that air fryer companion apps requested precise location and audio recording permissions without explanation.
A website called Proxyearth, launched in October, enables anyone to retrieve Indian citizens' full names, Aadhaar numbers, residential addresses, and live locations using only a mobile number.