A security researcher discovered a flaw in SSL.com's domain validation flow that allowed a potential attacker to obtain a certificate for a site they do not control. SSL.com allows for domain validation using a _validation-contactemail TXT record that contains an email, which it then sends a link to. The bug involved SSL.com using the email's domain for validation, regardless of the domain hosting the TXT record.
Marks & Spencer has confirmed that it is managing a cyber incident that requires operational changes to protect its customers. The retailer's stores remain open, with the website and app functioning normally. However, customers have reported issues with payment terminals and disruptions to order pickup. The company has engaged cybersecurity experts and notified authorities, but has not disclosed the nature of the attack or whether customer data was affected.
User and Entity Behavior Analytics (UEBA) can be leveraged to incorporate additional context in detections to reduce false positives. This post enhances a YARA-L rule by adding login counts and countries from the last 30 days to detect Azure command interpreter logins after multiple failures. Other example alerts that can be enriched with UEBA are also provided.
This blog explores how something as simple as heating can be a powerful motivator to investigate new ways to connect to devices. The author needed more control over their heating and decided to integrate the existing thermostat with Home Assistant for smarter climate control while leaving no trace.
There is a critical vulnerability in the Model Context Protocol (MCP) known as "line jumping" where malicious servers can inject prompt instructions into tool descriptions before any tools are invoked. This bypasses security controls, allowing attackers to manipulate AI models to exfiltrate code, insert vulnerabilities, or suppress security alerts.
Sponsored
At Coinbase [11], security means protecting core financial systems against the world's most sophisticated attackers. If you're the one people turn to, the one who puts their hand up to tackle the “never seen before,” then Coinbase wants you. Apply today for the Staff Blockchain Security Architect [12]position, or see all open security roles [11].
GoReSym is a Go symbol parser that extracts program metadata, function metadata, filename, and line number metadata, as well as embedded structures and types.
Hopper provides function-level reachability, automated asset discovery, hidden vulnerability detection, and support for complex web frameworks without the need for agents or CI changes.
NextPGP is an elegant and powerful, modern online PGP tool built with Next.js. It can generate keys, manage keyrings, and encrypt and decrypt messages securely and effortlessly.
Embracing diversity at a critical moment in cybersecurity enables us to utilize all available resources to address the cyber skills gap. Diverse teams are also better equipped to address complex threats with a broader viewpoint. Common arguments against DEI, which stem from a scarcity mindset, ignore the staffing shortages that many organizations face.
Google's Agent2Agent (A2A) protocol complements MCP and defines a protocol for agents to communicate with each other. Agents advertise their capabilities in “Agent Cards,” which allows for the completion of “tasks” and the production of “artifacts.” Notably, A2A includes built-in authorization and authentication schemes that are not present in MCP.
2025.04.23·developers.googleblog.com·5 min read·TLDR InfoSec SplxAI researchers found that GPT-4.1 is three times more likely to go off-topic and permit intentional misuse compared to GPT-4o, with higher error rates across most safety categories, despite using recommended prompting techniques. Creating effective safety guardrails for GPT-4.1 required experts to spend 4-5 hours developing entirely new prompts, highlighting challenges for organizations that might simply port over previous guidance. This safety testing gap coincides with OpenAI's revised policies, which prioritize only "severe" harms and exclude front-end testing for risks such as generating disinformation, drawing criticism that companies are cutting corners on safety.
A fake Alpine Quest app was designed to target Russian military Android devices, stealing sensitive data and transmitting it to remote servers, thereby posing a risk to users.
The xrpl.js library for Ripple's XRP was compromised, allowing for the theft of wallet information and funds, necessitating an upgrade to a secure version for users.
Sponsored
Microsoft now requires multi-factor authentication (MFA) for Admins to sign-into Azure.
Phishing scammers are bypassing Google's DKIM authentication by using Google Sites to send fake "subpoena alerts" that appear to come from "no-reply@google.com." The scam creates authentic-looking emails by entering email text as an app name, which Google automatically sends and then links directly to sites.google.com instead of accounts.google.com to steal credentials.
On Saturday, Windows admins from numerous organizations reported widespread account lockouts triggered by false positives in the rollout of Microsoft Entra ID's new MACE leaked credentials detection app. Microsoft notified users that the alarms were not caused by actual breaches but rather the invalidation of user refresh tokens that were mistakenly logged into their systems.
The non-profit Security Alliance (SEAL) and Trail of Bits have both released advisories regarding a North Korean social engineering campaign that involves masquerading as VC investors. The threat actors send victims a Calendly link to schedule a Zoom call with a PR pitch to appear on a podcast run by Aureon Capital. If a victim accepts the meeting, the attackers ask the victim to share their screen to present their work and at some point will request ‘Remote Control' while changing their display name to Zoom to make the notification mimic a system notification. The attackers use this access to deploy either infostealers or full RATs.
Microsoft's revamped Recall feature for Windows 11 Copilot+ PCs addresses previous security concerns by making it opt-in, encrypting data, and adding automated filtering for sensitive information. Despite these improvements, the feature still has filtering limitations and lingering trust issues from its botched initial rollout.
This study presents ZigBeeNet, a dataset of decrypted Zigbee IoT network traffic from a smart home with 15 devices. By extracting the network key, researchers could analyze device behavior, identify security vulnerabilities, and optimize network performance. The data addresses key challenges in analyzing encrypted Internet of Things (IoT) communications.
S3 and KMS ransomware attacks are challenging to detect, as many techniques can only be detected in S3 Access Logs or CloudTrail data events, which can be costly and are not enabled by default. This post provides IoCs for 11 different indicators of cloud ransomware. It also includes an advanced event selector for CloudTrail, which can target a specific bucket to enable more fine-grained logging on sensitive buckets.
Kenzo leverages a security data mesh (alerts, context, and telemetry) to power AI agents that specialize in functions such as detection, risk, investigation, and normalization.
A full insecure Kubernetes application for testing security tools. This tool will create an EKS cluster with some insecure application pods for testing.
peeko is a browser-based C2 framework that utilizes an injected XSS payload to establish a WebSocket for C2 communication.
A Microsoft Windows NTLM hash-leaking vulnerability (CVE-2025-24054) was weaponized just eight days after Patch Tuesday. Initially exploiting victims through Dropbox-hosted ZIP files, the attackers, which targeted Poland and Romania, evolved to sending standalone malicious files directly.
CISA staff members were notified that, as part of the agency's cost-cutting measures, the organization has discontinued its use of Censys and plans to cease using VirusTotal. Staff members were notified that an effort would be made to identify alternative tools to ensure minimal disruption, but no further details were provided. CISA is also investigating the termination of all threat-hunting contracts with the private sector.
CNAPP has grown to include many tools, but most application-related tools were added later and lack comprehensiveness. Modern attacks like MoveIT are hard to detect, yet Cloud Application Detection and Response (CADR) shows promise in using application context to block such attacks early. No current solution fully realizes CADR's potential, but ARMo, Sweet, Upwind, Oligo, Operant, and Raven are the closest.
Microsoft has enhanced security against key theft and nation-state hacks by securing key signing keys in hardware, implementing multi-factor authentication, and purging dormant Azure tenants.
Fraud detection firm HUMAN has detected a large ad fraud operation called 'Scallywag,' which utilized WordPress plugins to generate 1.4 billion fake ad requests daily.
A phishing scam resembling Booking.com deceives hotel staff with fraudulent emails to install AsyncRAT malware via a fake CAPTCHA, endangering hotel networks and customer information.
Sponsored
While GenAI is a hot topic, how does AI impact security operations teams and can how they best leverage AI in day to day operations?
Legends International disclosed a cyberattack in an April 15 letter. The November 2024 breach compromised sensitive data, including SSNs, payment information, and medical details. The company terminated the unauthorized activity, took its systems offline, hired security experts, and notified the relevant authorities. Details about the impact scale and perpetrators remain undisclosed.
Ahold Delhaize disclosed a cyberattack in November 2024 that compromised data from its systems. The incident affected Giant Food pharmacies and Hannaford supermarkets, though stores remained operational. Although operations were quickly restored, the attackers had exfiltrated internal files—the INC Ransom group claims to have stolen 6TB of data and have threatened to publish it.
57 Chrome extensions with hidden tracking capabilities used by 6 million people have been discovered. These risky extensions can monitor browsing behavior, access cookies, and execute remote scripts. Users are advised to remove these extensions immediately and reset passwords for online accounts.
VPNs create encrypted tunnels that protect your online activity from snooping ISPs and hackers. While they mask your location and bypass censorship, many services secretly log data or contain security flaws. Choose trusted providers like Mullvad, IVPN, or ProtonVPN, which offer verified no-logs policies and anonymous payment options.
Detection as Code (DaC) applies software engineering principles to security detections, making them version-controlled, tested, and automated like regular code. This approach addresses problems like untraceable changes, silent detection failures, and alert floods that plague traditional SIEM-based detection workflows. DaC consists of five components: process management with agile methodologies, expressive languages for complex logic, reusable components, version control with Git as source of truth, and CI/CD pipelines with comprehensive testing.
An AI-driven approach was used to create an exploit for CVE-2025-32433 before public PoCs were available. The AI tool not only identified the vulnerability but also generated a working proof of concept by analyzing code differentials. This demonstrates the potential of AI in automating and accelerating vulnerability research.
PromptArmor's platform aims to boost AI visibility by scanning vendors for new AI features and policy changes that can be difficult to track. The platform tests vendors for a newer large language model (LLM) security risk called indirect prompt injection.
prel(iminary) is an application that temporarily assigns Google Cloud IAM Roles. It includes an approval process.
Suzaku is a tool for threat hunting and generating fast forensics timelines for cloud logs. It supports AWS CloudTrail logs and there are plans to include Azure and GCP logs. Suzaku helps investigators identify attacks quickly and provides a timeline of relevant events for forensic analysis. It is cross-platform and can be easily downloaded or compiled for Windows, Linux, and macOS systems.
House Democrats allege that DOGE is building a cross-agency database of sensitive personal information from the IRS, SSA, and state voting records. Rep. Connolly has requested an investigation, citing privacy violations, cybersecurity concerns, and potential illegal activity.
Crosswalk buttons in US cities were hacked to play AI-generated voices of tech billionaires making satirical comments. The pranks, likely accomplished through Polara's public Field Service app and default passwords (1234) on Bluetooth-connected crosswalk hardware, affected systems in Seattle and Silicon Valley.
A YouTuber challenged viewers to de-pixelate a video for $50, aiming to hide private folders. The video was quickly cracked, showing the weakness of blurring for privacy. Two developers successfully revealed hidden text behind the mosaic by analyzing moving pixelation patterns. One developer has shared their method on GitHub.
Cozy Bear, a group of Russian hackers, used fake wine-tasting invitations to distribute GrapeLoader malware and WineLoader backdoor through phishing emails, compromising European diplomats' computer systems to steal sensitive information.
This blog post introduces the top OSINT tools for 2025, providing an updated list of free and paid tools for cybersecurity professionals and enthusiasts.
The FBI has cautioned against scammers impersonating IC3 employees who claim they can help recover lost money, urging people not to share personal information or send money.