Parse notes
Sponsored
ThreatLocker's annual Zero Trust World [4] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
An unsecured 16TB MongoDB database was discovered on November 23. The database contained 4.3 billion professional records, including LinkedIn-like data such as names, emails, phone numbers, job roles, employers, work histories, and social media accounts. It was secured two days after discovery, but prior access remains unknown. This exposed data could facilitate large-scale AI-powered social engineering, phishing attacks, CEO fraud, and credential stuffing by enabling automated personalized messaging and profile enrichment when combined with other breach data. Security teams should urgently monitor threat intelligence, improve email security to prevent AI-driven phishing, and train users to recognize advanced social engineering that exploits professional profiles.
A campaign attributed to likely Eastern European threat actors is distributing PyStoreRAT malware through GitHub repositories disguised as OSINT tools, GPT wrappers, and DeFi bots, using artificially inflated star counts and social media promotion to build credibility. The modular JavaScript-based RAT executes via mshta.exe, scans for cryptocurrency wallets, evades detection by CrowdStrike and Cybereason, and delivers the Rhadamanthys infostealer as a secondary payload. Security teams should audit dependencies from trending GitHub repositories, monitor for scheduled tasks masquerading as NVIDIA updates, and deploy endpoint detection and response solutions capable of identifying mshta.exe activity and JavaScript-based payloads to strengthen defenses against PyStoreRAT.
A widely trusted Chrome and Edge extension, Urban VPN Proxy, was updated in 2025 to inject JavaScript that hooks network APIs, silently captures all AI chatbot prompts and responses, plus metadata, and then sends them to Urban VPN's analytics servers. The data is shared with parent company BIScience for commercial insights, despite “AI protection” marketing and a privacy policy that downplays risks. Security teams should review browser extension permissions, monitor network traffic for unusual API calls, and enforce policies restricting the installation of unverified extensions to prevent data exfiltration by malicious extensions such as Urban VPN Proxy.
Four new phishing-as-a-service kits have emerged: BlackForce ($200-300, MFA bypass via Man-in-the-Browser attacks), GhostFrame (iframe-based evasion with 1M+ attacks), InboxPrime AI ($1,000 perpetual license with AI-generated emails mimicking Gmail behavior), and Spiderman (targeting European banks via Signal with OTP/PhotoTAN interception). These kits feature anti-analysis techniques, real-time credential exfiltration to Telegram, and spintax-based email variation to bypass signature detection. Organizations should implement phishing-resistant MFA, such as FIDO2, and monitor for the emerging Salty-Tycoon hybrid, which combines multiple kit techniques to evade detection rules.
A new group is running a phishing campaign that impersonates payment confirmations to trick finance-related staff into opening a ZIP file containing a malicious ISO image. Once mounted and executed, the ISO drops a multi-stage payload chain that ultimately runs Phantom Stealer, which uses DLL injection, anti-analysis checks, and steganography to load and hide its code. The stealer targets browser credentials, cookies, credit cards, crypto wallets, Discord tokens, clipboard data, keystrokes, and selected files, then exfiltrates everything via Telegram bots, Discord webhooks, or FTP.
Chrome DevTools Protocol (CDP) allows tools to inspect, debug, instrument, and profile Chrome and other Chromium browsers. CDP provides a tempting target for C2 communication because the traffic can blend in with existing traffic and because browsers are usually already configured with appropriate proxy and firewall information. This post demonstrates a C2 implant that uses CDP to run in a headless browser and communicate with the C2 server via XHR requests driven by CDP JavaScript.
Sponsored
AI-powered attackers are already chaining recon, exploitation, and lateral movement autonomously, as shown in Anthropic's GTG-1002. Watch XBOW's Nico Waisman and Albert Ziegler break down offensive AI [11]—and how the same agentic technology behind the #1 HackerOne AI can defend you. Try XBOW Lightspeed by Dec 26 with a money-back
KustoHawk is an incident triage and response tool for Microsoft Defender XDR and Sentinel. It collects indicators of compromise and shows device or account activities. Using Graph API, it runs hunting queries in the Resources folder.
RegScale provides an AI-powered Continuous Controls Monitoring platform that automates governance, risk, and compliance processes, replacing manual, document-based workflows with real-time, integrated, “compliance as code” across highly regulated environments.
Pro-Russian hacktivist group CyberVolk's new VolkLocker ransomware-as-a-service contains a critical implementation flaw that hard-codes AES-256 master keys in binaries and writes them to a plaintext file in the %TEMP% folder, enabling free decryption without paying the ransom. The Golang-based malware targets Windows and Linux systems, featuring privilege escalation, VM detection, shadow copy deletion, and a 48-hour enforcement timer that wipes user folders if payment isn't made. Victims should check for the system_backup.key file in their Temp directory before considering a ransom payment, as this oversight renders the $800-$2,200 RaaS offering ineffective for attackers.
Jaguar Land Rover confirms that a cyberattack in August not only halted factory production, it also exposed payroll data for current and former staff, including bank details and tax information. The incident has driven reported sales losses of £1.5 billion, plus £196 million in related losses, and is estimated to have cost the broader UK economy up to £2.1 billion, with the Scattered Lapsus Hunters group blamed.
Nathan Austad, a 21-year-old from Minnesota known as “Snoopy,” admitted to helping run a credential stuffing scheme that compromised over 60,000 betting-site accounts, drained roughly $600,000 from about 1,600 victims, and sold access via online shops. He now faces up to five years in prison and is the third defendant tied to the DraftKings-related hacks.
Sponsored
Get Infosec IQ security awareness training for your organization and receive 3 complimentary Infosec Skills seats—giving your technical staff access to hands-on cyber ranges and labs. Limited time offer.
Have I Been Pwned has added 630 million passwords from FBI-seized devices, including 46 million previously unseen credentials originating from dark web marketplaces, Telegram channels, and infostealer malware, to its free password-checking service, which now handles over 18 billion monthly queries.
Google is shutting down its dark web reports feature, which notified people when their personal data appeared on criminal marketplaces.
Hamas-linked threat group Ashen Lepus (WIRTE) has expanded its espionage campaign to target diplomatic offices across the Middle East using new AshTag malware delivered via geopolitical-themed lure documents.