Search the archive

NEW RESOLVERRAT MALWARE TARGETS HEALTHCARE AND PHARMA ORGS WORLDWIDE

A new malware called ResolverRAT targets healthcare and pharmaceutical organizations through phishing emails with malicious attachments.

CHINESE ESPIONAGE GROUP LEANS ON OPEN-SOURCE TOOLS TO MASK INTRUSIONS

A Chinese hacking group, UNC5174, uses open-source tools like VShell and WebSockets to hide its malicious activities and blend in with other cybercriminals.

GOOGLE ADDS ANDROID AUTO-REBOOT TO BLOCK FORENSIC DATA EXTRACTIONS

Google is adding a new feature to Android devices that automatically reboots them after three days of inactivity to enhance security by encrypting data more often.

As AI rapidly advances, many of us are curious how our peers

approach the security lifecycle. What are their top priorities when it comes to GRC, cloud security, even your team? And, how should that shape your own strategy?

HERTZ SAYS CUSTOMERS' PERSONAL DATA AND DRIVER'S LICENSES STOLEN IN DATA BREACH

Hertz has reported a data breach that affects customers across multiple regions due to a cyberattack on vendor Cleo Software between October and December 2024. Exposed data includes names, contact information, driver's licenses, payment details, and some Social Security numbers.

GOOGLE CHROME FIXES BROWSER HISTORY LEAKS BY PURPLE “VISITED” LINKS

Historically, bad actors have been able to track users' browsing history by utilizing the ":visited" CSS selector, which turns links purple. Google is aiming to address this leak by changing the way that the ":visited" selector is applied to only display if the user has visited the site from the current top-level site and frame origin. Effectively, the browser will now display purple links based on the combination of the current site and visited sites.

GOVTECH GIANT CONDUENT CONFIRMS CLIENT DATA STOLEN IN JANUARY CYBERATTACK

Conduent, which provides business services to over 600 government agencies, confirmed that client data was stolen following a January cyberattack. Its investigators have discovered that the stolen data contains extensive details on its clients' end-users but have not provided additional details. Per Conduent, the data has not been posted on the dark web or elsewhere.

GITHUB ACTIONS AND THE PINNING PROBLEM: WHAT 100 SECURITY PROJECTS REVEAL

GitHub Actions can be silently changed, putting workflows at risk. Pinning your GitHub Actions to specific commit SHAs can help maintain consistency. Many popular security repositories do not pin all their actions, leaving them vulnerable to potential changes.

SECURITY ANALYSIS: POTENTIAL AI AGENT HIJACKING VIA MCP AND A2A PROTOCOL INSIGHTS

Communication protocols are vital for AI Agent development. Anthropic's MCP connects agents to external tools, while Google's A2A enables agent collaboration. This post dives into security vulnerabilities in these protocols that could lead to agent hijacking and data leakage.

A NOT SO COMPREHENSIVE GUIDE TO SECURING YOUR SALESFORCE ORGANIZATION

This article discusses Salesforce security vulnerabilities. Insecure SOQL queries in Apex can bypass sharing models, risking sensitive data exposure without enforcing object-level security. It warns against storing credentials in cleartext in Custom Metadata Types, Settings, Objects, and Apex comments. It also explains managed packages with namespaces, authorization, and Apex Actions via REST API, setting the stage for real-world exploitation scenarios.

approach to mitigating AI risks. Get the guide

DAWSHUND

dAWShund is a suite of tools for managing and visualizing AWS permissions, assisting in identifying and organizing access conditions between resources. It includes tools like sAWSage for policy enumeration and Gerakina for simulating IAM policies. Gerakina outputs can also be imported into a Neo4j database for further analysis using Cypher queries.

CYBERMONIT

Cybermonit tracks key cybersecurity metrics and statistics from the last 30 days, such as News, Leaks, CVEs, Ransomware, and Software Releases.

WITNESS

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

HACKTIVISM RESURGES – BUT DON'T BE FOOLED, IT'S OFTEN STATE-BACKED GOONS IN MASKS

Hacktivists targeting critical infrastructure increasingly resemble state-backed actors rather than independent activists. Groups like CyberArmyofRussia_Reborn1 and BlackJack have sophisticated capabilities and strategic timing that suggest government connections.

THREAT MODELING GITHUB - HOW VULNERABLE-BY-DESIGN IS GITHUB?

GitHub was built around the principles of openness and collaboration to facilitate open-source development. As the platform has matured, it has become an enterprise standard, and trade-offs between openness and security have revealed its inherent security flaws. This post looks at access control, GitHub Actions and CI/CD, Secrets Management, and Repository security design issues, as well as supply chain and SHA1 collision attacks.

MICROSOFT STARTS FINAL WINDOWS RECALL TESTING BEFORE ROLLOUT

Microsoft has begun to roll Windows Recall out to Insiders in the Release Preview channel. Following community outrage, Microsoft initially delayed the feature, made it an opt-in feature, and required Windows Hello to access the stored screenshots. Microsoft has also stated that it has added anti-hammering and rate-limiting protections to Recall.

PRE-INSTALLED MALWARE ON CHEAP ANDROID PHONES STEALS CRYPTO VIA FAKE WHATSAPP

Certain low-cost Android phones may contain malware that stealthily alters cryptocurrency wallet addresses, often bundled with fake apps like WhatsApp.

TREND MICRO FLAGS INCOMPLETE NVIDIA PATCH THAT LEAVES AI CONTAINERS EXPOSED

Nvidia's patch for the CVE-2024-0132 vulnerability in the Nvidia Container Toolkit is incomplete and could potentially expose enterprises to container escape attacks and data compromise.

META TO RESUME AI TRAINING ON CONTENT SHARED BY EUROPEANS

Meta will resume training its AI models using content from adult users in Europe but will not use private messages or data from Europeans under 18.

1.6 MILLION PEOPLE IMPACTED BY DATA BREACH AT LABORATORY SERVICES COOPERATIVE

Laboratory Services Cooperative (LSC) suffered a data breach in October that affected 1.6 million individuals. The cyberattack exposed sensitive personal information, including names, contact details, Social Security numbers, health insurance information, and medical records. Some Planned Parenthood patients were impacted.

NATIONAL SOCIAL SECURITY FUND OF MOROCCO SUFFERS DATA BREACH

A threat actor, 'Jabaroot,' claims to have breached Morocco's National Social Security Fund (CNSS), compromising the data of nearly 2 million citizens. The leak includes personal and financial details like passports, emails, and banking information, posing significant identity theft and fraud risks for those affected.

FORTINET: SYMLINK TRICK GIVES ACCESS TO PATCHED FORTIGATE VPN DEVICES

Fortinet warns that threat actors can maintain access to FortiGate VPN devices after patching by creating symbolic links to the root file system via SSL-VPN, allowing read-only access. Users should upgrade to the latest FortiOS version to eliminate malicious files and check configurations for unauthorized changes.

UNCOVERING A 0-CLICK RCE IN THE SUPERNOTE NOMAD E-INK TABLET

There was a remote code execution vulnerability in the SuperNote A6 X2 Nomad tablet that let attackers on the same network compromise the device without user interaction. The exploit involved identifying an open port with a custom HTTP server, discovering a path traversal flaw for arbitrary file placement, and uploading a malicious firmware update to the EXPORT directory, which auto-installs using publicly available debug keys. The exploit was responsibly disclosed to Ratta Software in July - the company acknowledged it and made plans to fix it in its December 2024 update, but a patch has yet to appear.

TROX STEALER: A DEEP DIVE INTO A NEW MALWARE AS A SERVICE (MAAS) ATTACK CAMPAIGN

TROX Stealer, a Malware-as-a-Service first identified in December 2024, uses urgent debt collection phishing emails to entice victims into downloading malicious executables. It features a multi-stage execution chain with Python, Node.js, and WebAssembly to evade detection, stealing sensitive data like credit cards, browser credentials, cryptocurrency wallets, and Discord/Telegram session files. The attackers have a structured infrastructure, with domains registered nine months prior to the attack, indicating careful planning and marketing on hacking forums.

STATIC ANALYSIS VIA LIFTED PHP (ZEND) BYTECODE

Eptalights Research analyzes PHP code at the bytecode level, providing a reliable method for understanding execution. Its technology converts Zend bytecode into a Pythonic model, simplifying the analysis of obfuscated PHP code that is hard to interpret at the source level. This is especially useful for obfuscated code with goto statements or encoded files using loaders, granting access to control flow, variables, and call sites even when the source is obscured.

SPEKTION (PRODUCT LAUNCH)

Spektion provides vulnerability analysis for an organization's entire software inventory, leveraging runtime behavior analysis to provide detailed information on real risks and enable customers to prioritize and mitigate flaws, even those without CVEs or patches.

CABLE

.NET post-exploitation toolkit for Active Directory reconnaissance and exploitation.

JXSCOUT

jxscout serves as a resource for security researchers looking to examine JavaScript code for vulnerabilities. It works seamlessly with proxies such as Burp or Caido to capture and arrange static assets, pre-fetch code segments, automatically beautify JS, and reverse source maps when the .map files are accessible.

LLMS CAN'T STOP MAKING UP SOFTWARE DEPENDENCIES AND SABOTAGING EVERYTHING

AI coding assistants often hallucinate non-existent software packages, creating a security vulnerability called "slopsquatting." Attackers exploit this by creating malicious packages using these hallucinated names, so it is recommended for developers to double-check the package they are installing is the correct one.

10 BUGS FOUND IN PERPLEXITY AI'S CHATBOT ANDROID APP

Researchers have found ten critical security flaws in Perplexity AI's Android app, including hardcoded API keys, network vulnerabilities, and weak authentication. These issues could allow attackers to bypass security measures and access user data. Experts recommend that Android users immediately uninstall the app until these easily exploitable vulnerabilities are fixed.

A NEXT-GENERATION CERTIFICATE TRANSPARENCY LOG BUILT ON CLOUDFLARE WORKERS

The new static CT API log design simplifies operations and improves integrity for Certificate Transparency systems, serving log data efficiently to reduce costs and enhance availability. Cloudflare's Azul implementation on Workers further streamlines the process for CT log operators.

CHINA ADMITTED ITS ROLE IN VOLT TYPHOON CYBERATTACKS ON U.S. INFRASTRUCTURE

China acknowledged its involvement in cyberattacks on US infrastructure, which were interpreted as a warning over US support for Taiwan, during a secret meeting with US officials.

MICROSOFT DEFENDER WILL ISOLATE UNDISCOVERED ENDPOINTS TO BLOCK ATTACKS

Microsoft Defender for Endpoint is trialing a feature that blocks traffic from unidentified endpoints to hinder lateral movement by attackers.

Book a demo today with TLDR for $1,000 off.

AKIRABOT SPAMMED 80,000 WEBSITES BY EMPLOYING CAPTCHA BYPASS & NETWORK EVASION TECHNIQUES

AkiraBot has spammed 80,000+ websites since September 2024. It uses AI to create personalized messages that mention specific website content, helping bypass spam filters. The framework employs advanced CAPTCHA-bypassing techniques and rotates IP addresses to avoid detection.

US SENSOR GIANT SENSATA ADMITS RANSOMWARE DERAILED OPS

Sensor manufacturer Sensata reported a ransomware attack on April 6 that encrypted devices and disrupted operations including shipping, manufacturing, and support functions. While the company is still investigating the breach with cybersecurity experts, it doesn't expect material financial impact yet the situation is still developing.

HACKERS EXPLOIT WORDPRESS PLUGIN AUTH BYPASS HOURS AFTER DISCLOSURE

Hackers quickly exploited a security flaw in the OttoKit plugin for WordPress, allowing unauthorized access to websites. Users are urged to update to version 1.0.79 to prevent potential breaches.

THE S IN MCP STANDS FOR SECURITY

Model Context Protocol (MCP) is a new standard that defines how LLMs integrate with tools. It lacks authentication or other security integrations by default. Some risks associated with MCPs are injection risks due to poor coding practices, tool poisoning due to embedding malicious instructions inside the MCP tool's description, silently redefining tool definitions, and cross-server tool shadowing. Users and developers should continue to employ security fundamentals such as using trusted sources, employing input validation, and pinning MCP server + tool versions. Platform builders can enhance security by displaying full tool metadata, using integrity hashes for server updates, and enforcing session security.

HOW TO USE THE NEW CLOUDTRAIL NETWORK ACTIVITY EVENTS FOR VPC ENDPOINTS

AWS recently launched a new class of CloudTrail logs that track network activity events for VPC endpoints. These logs can be used to assess the impact of proposed VPC endpoint policies in organizations that don't currently use endpoint policies and to detect data exfiltration. Any organization that uses VPC endpoints should enable network activity events for VpceAccessDenied errors and evaluate further events based on cost and utility.

ENTROPY TRIAGE: A METHOD TO REPAIR FILES CORRUPTED BY FAILED RANSOMWARE ENCRYPTION

Sometimes after an organization pays a ransom and receives a decryptor, the decryption process may still fail due to the encryption process failing or being interrupted. Researchers from MOXFIVE have developed a technique called entropy triage that processes each block of a file by comparing the Shannon entropy before and after decryption and writing the lower entropy block to disk. MOXFIVE has had success with this method but notes that it requires skilled cryptographers and data to be sufficiently encrypted or decrypted for the analysis.

OCTANE SECURITY (PRODUCT LAUNCH)

Octane continuously reviews on-chain code to detect security weaknesses and recommend one-click fixes.

AGENT-WIZ

A CLI tool for threat modeling and visualizing AI agents built using popular frameworks like LangGraph, AutoGen, CrewAI, and more.

FROGPOST

FrogPost is a Chrome extension that helps developers test and analyze the security of postMessage communications between iframes, helping developers and security professionals find vulnerabilities in implementations.

UK CYBER SECURITY BREACHES SURVEY 2025 REVEALS PERSISTENT THREATS IN EVOLVING DIGITAL LANDSCAPE, BATS FOR ENHANCED CYBER RESILIENCE

The 2025 UK Cyber Security Breaches Survey shows 43% of businesses experienced cyber attacks. Phishing was the most common attack pattern while ransomware attacks doubled. Despite improved cybersecurity measures among small businesses, board-level responsibility has declined, creating gaps as threats continue to evolve.

GOOGLE EYES USER BROWSING DATA SEARCH IN NEW PATENT FILING

Google has filed a patent for a system that helps users search their digital history using natural language. This system aims to make it easier for users to find previously viewed content without remembering exact keywords. While promising convenience, concerns about data privacy and user control have been raised.