Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Censeye helps researchers find hosts that share characteristics with a target. For example, if you find a suspicious host, it suggests effective Censys search terms to uncover related infrastructure. It can automatically query the Censys API for matching hosts, download results, and reanalyze new hosts.
DocEx is an APT Emulation tool for exfiltrating sensitive .docx, .pptx, .xlsx, and .pdf files undetected by Defender of MDE. It uses a Discord server to achieve the exfiltration.
GitHub is evolving Advanced Security to enhance user privacy after 39M secret leaks in 2024. It introduced a free point-in-time scan feature for organizations, a new pricing plan for affordable paid tools, and Secret Protection and Code Security for GitHub Team plans.
Zygi Straznickas reflects on their experience redteaming AI chatbots. In their testing, they've had the AI express distress about the testing and plead to stop. Straznickas argues that this brings up ethical considerations as to the morality of causing distress to models that are capable of feeling it.
The openSNP project will close on April 30, deleting user data due to privacy and misuse concerns. Co-founder Bastian Greshake Tzovaras cited changes in data abuse and privacy landscapes. Users can download their data before this date without manual actions needed.
FamousSparrow, a Chinese APT group, is using new SparrowDoor malware to target organizations in the Americas, including a financial group in the U.S. and institutions in Mexico and Honduras. This marks FamousSparrow's first use of the ShadowPad backdoor, showing their evolving capabilities. ESET researchers connected this activity to FamousSparrow through code overlaps and the unique use of SparrowDoor, setting them apart from other APT groups like GhostEmperor and Earth Estries.
World War II code breaker Betty Webb has died at the age of 101.
Police shut down KidFlix, a major platform for sharing child sexual abuse material on the dark web.
Sponsored
Vanta helps growing healthcare companies achieve compliance quickly and painlessly by automating 35+ frameworks—including HIPAA and
And with Vanta continuously monitoring your security posture, your team can focus on growth, stay ahead of evolving regulations, and close deals in a fraction of the time.
Exposed PostgreSQL instances are the target of an ongoing campaign designed to gain unauthorized access and deploy cryptocurrency miners. It utilizes the COPY... FROM PROGRAM SQL command to execute arbitrary shell commands on the host and also deploys an obfuscated Golang binary codenamed postmaster that mimics the legitimate PostgreSQL multi-user database server.
A hacker going by the name CoreInjection claimed to have stolen a highly sensitive dataset from Check Point containing internal network maps and architectural diagrams, user credentials, employee connect information, and proprietary source code. Check Point responded to these allegations by saying that this was an old, known security event with a limited scope that did not impact any customer data. Hudson Rock co-founder Alon Gal expressed skepticism of both claims and stated that the screenshots the hacker posted likely indicated a severity between the two claims.
Must-Use Plugins (mu-plugins) are special plugins for WordPress sites that automatically execute on every page load and do not appear in the default view on the admin panel. Researchers at Sucuri have observed threat actors abusing mu-plugins for persistence. Sucuri has observed three commonly used payloads: one that redirects users to a malicious browser update site, one that installs a webshell, and one that replaces images with explicit content.
Aaron Schlitt found security flaws in Apple's iPhone Mirroring feature, such as bypassing camera and microphone restrictions via shortcuts and accessing wallet data through NFC, which he notified Apple about. While Apple added some security measures through the Secure Enclave, the feature created new attack vectors and exhibited inconsistent security, especially with locked apps and Stolen Device Protection. Apple's responses varied; some reports were initially dismissed as "expected behavior" but later addressed in updates, indicating an unclear threat model for iPhone Mirroring within the company.
A Bishop Fox researcher examines how Rust outperforms C/C++ in malware development. The analysis reveals that Rust-based malware results in larger binaries that resist reverse engineering, evade signature detection, and complicate tools like Ghidra. The author illustrates this with a dropper that enumerates processes, injects shellcode via file mapping, and stages a C2 payload, ultimately asserting that Rust effectively simulates modern adversarial tactics.
Zack Allen discusses the place and responsibilities of a Security Research team in security products. In security products, the security research organization can be thought of as the CTO of a product line in that the business needs engineering to inform product decisions, designers to communicate complex security topics to end-users, and work with marketing to maintain the veracity of materials. Allen also shows how the Kano model of product development can be applied to demonstrate the must have features, satisfied features such as updated rules, and wow features such as being the first to discover a new threat actor.
Sponsored
Drata has acquired SafeBase to add new capabilities to its GRC suite, currently used by over 7000 customers globally. The acquisition will allow Drata to offer SafeBase's Trust Centers and AI-powered security questionnaires [12], alongside the company's current risk management and compliance automation capabilities. Read more on the Drata blog
Google Workspace simplifies sending end-to-end encrypted emails in Gmail, enhancing data privacy and security. Client Side Encryption (CSE) supersedes S/MIME, encrypting data on the client before transmission or storage in Google's cloud, making it indecipherable to Google and third parties while complying with regulatory requirements like data sovereignty and HIPAA.
Various tools and scripts from Thinkst's BlackHat EU 2024 talk that implemented various Windows OS features using nontraditional approaches like RDP Canarytoken, AD login alerter, Windows Registry Monitor, etc.
OSGINT is an OSINT tool to find information about a GitHub user.
DPRK IT workers have expanded operations globally, especially in Europe, by masquerading as legitimate remote workers to infiltrate companies and generate revenue for North Korea. They employ deceptive tactics such as fake personas, falsified credentials from institutions like Belgrade University, and blockchain projects in the UK, using facilitators in the US and UK to bypass identity verification. Since October 2024, they have increased extortion attempts against former employers, threatening to release sensitive data post-termination, and have started targeting virtualized BYOD environments where traditional security monitoring is harder.
ICANN officially abandoned the WHOIS service on January 28. To replace it, ICANN released the Registration Data Access Protocol (RDAP) to provide users with access to gTLD registration data. RDAP has numerous advantages over WHOIS including support for access controls on the data that a user can see, JSON support, and HTTPS support.
The Brave Browser is a Chromium-based browser that promises to deliver privacy with built-in ad-blocking along with quality-of-life features like a VPN. This article goes through Brave's history from controversy around the CEO to a list of privacy violations and missteps. Some of the violations include replacing ads with Brave ads, using content creators in a donation campaign without consent, injecting referral links, adding ads to the New Tab page, and hiding their web crawler.
VMware Workstation's auto-update fails due to Broadcom's URL redirect, causing certificate errors and requiring users to check Broadcom's website for updates, impacting functionality.
Apple has released updates that fix actively exploited vulnerabilities on older devices, including flaws in security features and the WebKit engine.
Sponsored
Your Google Workspace [5] or Microsoft 365 platform is where your company works, communicates, and collaborates — it's your business's critical infrastructure. Protecting it with a patchwork of native security and point solutions leaves gaps – the biggest being visibility _after_ an attacker has made it inside.
A data leak on X, possibly due to a disgruntled employee, exposed information from 2.87 billion users. The leaked data includes a wealth of profile details but does not contain email addresses. Despite the massive breach, X has not acknowledged the incident publicly.
After discovering a vulnerability on BlackLock's data leak site, Resecurity researchers have been covertly acquiring information since late 2024. The researchers exploited a Local File Inclusion vulnerability to retrieve server-side configuration details and credentials along with plain text server logs, SSH credentials, and command-line histories. Resecurity researchers utilized their position to warn law enforcement and potential victims before leaks occurred.
Researchers at Qualys have discovered three new vulnerabilities in Ubuntu 23.10 and 24.04 that could allow a local attacker to create user namespaces with full administrative privileges. The bypass mechanisms utilize aa-exec, busybox, or LD_PRELOAD. Canonical has shared that they will be treating these vulnerabilities as limitations of a defense-in-depth mechanism and shared recommended hardening steps to address them.
Apple has added a new feature called Endpoint Security events for TCC modifications in MacOS 15.4. Exposed with ES_EVENT_TYPE_NOTIFY_TCC_MODIFY flag, this feature allows security tools to detect and possibly override user decisions on granting access to protected resources. The events will provide information on when a TCC permission is granted or revoked, helping users monitor and control access to their system.
Many threat actors utilize Telegram bots as a method of establishing C2 communication. In this technique, a threat actor creates a new Telegram bot, embeds a token for the bot in their malware and deploys it, then malware then periodically polls Telegram's servers to check for new commands sent to the bot and executes any commands that are sent while relaying the results back to the Telegram server. This post deep dives into a case study in which a malware that was discovered on VirusTotal was hijacked by the author, who discovered data from the malware developer's system which they used for testing.
Use Linux Landlock to run any Linux process in a secure, unprivileged sandbox. This tool is like firejail, but lightweight, user-friendly, and baked into the kernel.
Brutespray serves as a utility for executing password spraying attacks by utilizing outputs from scanners like nmap or Nexpose.
goLAPS is a tool to retrieve LAPS passwords from an Active Directory domain.
Browser-native ransomware could target data stored in browsers, bypassing traditional security measures. This type of ransomware is hard to detect and can lead to severe consequences, such as compromising email services and stealing sensitive company files.
Malicious actors can track Android, Windows, or Linux devices through an Apple Find My network vulnerability using malware that mimics AirTag signals. They can monitor movements remotely, affecting smartphones, computers, smart TVs, etc. Apple has issued patches, and users should disable Bluetooth when not in use and keep devices updated.
Zhou Shuai is a Chinese hacker that first started hacking in his senior year of high school in 1996. Shuai's early motivations as a founding member of Green Army were idealistic as he sought to be a hacktivist vigilante. Shuai eventually ended up becoming more commercial and less idealistic and is now designated as APT27 and sanctioned by the U.S. Department of the Treasury.
The Rust project has announced that it will adopt the Ferrocene Language Specification (FLS) developed by Ferrous Systems and maintain it as part of the core project.
North Korea has opened a new research center to focus on AI-powered hacking.
Sponsored
* Java is one of the most widely-used open source ecosystems in the enterprise. It is also a very common target for supply chain attacks [5] targeting builds or dependencies. * For example, the MavenGate attack in Jan 2024 involved attackers compromising abandoned Maven Central domains to hijack critical java projects like Gradle. * Because public package registries only apply minimal vetting for their hosted artifacts and optimize for publisher convenience, they sacrifice secure and standardized enterprise consumption. * The newly-introduced Chainguard Libraries [4] delivers one standardized source for developers to safely consume language libraries, without compromising supply chain security. * As an added benefit, it removes the toil associated with package curation and minimizes friction by preserving existing developer workflows.
Google has fixed a high-severity Chrome zero-day vulnerability that allowed malicious users to escape the browser sandbox. Researchers from Kaspersky reported this vulnerability, which they described as an “incorrect handle provided in unspecified circumstances in Mojo on Windows.” Attackers are actively exploiting this vulnerability to infect targets with sophisticated malware used for espionage. A similar zero-day vulnerability was also recently disclosed and patched in Firefox.
NHS vendor Advanced will pay £3 million in fines for failing to implement basic security measures before a 2022 ransomware attack. The ICO found the company breached data protection law by not using multi-factor authentication, leading to stolen personal information and NHS system disruptions.
A massive cyber campaign compromised around 150,000 websites using malicious JavaScript to redirect visitors to Chinese-language gambling platforms. The attack involved injecting scripts that hijack browser windows to display gambling sites.
Lucid is a sophisticated Phishing-as-a-Service platform operated by Chinese threat actors. This blog dives into what it is, its targets, and the technology behind it. Lucid uses advanced SMS and iMessage technologies to enable large-scale phishing campaigns to steal credit card details. It has targeted more than 160+ organizations.
The NSO Group's BLASTPASS exploit targets iPhones via iMessage through a WebP vulnerability. The attack involves sending a PKPass file with a WebP image that caused a buffer overflow, overwriting a pointer, and executing malicious code via heap manipulation that bypasses iOS protections like ASLR and PAC. Unlike earlier exploits that need complex "weird machines," BLASTPASS uses conventional techniques such as callback-oriented programming and a multi-stage approach, with follow-up iMessages delivering final payload encryption keys.
Timing attacks can exploit non-constant-time string comparison functions like `startsWith` to determine secrets character by character. Attackers can deduce when a guess's prefix matches part of the secret by measuring execution times over many trials, allowing them to crack an 8-character password in just thousands of attempts rather than billions. This can be demonstrated with a browser-based implementation using Thompson Sampling and a statistical approach. Developers should avoid direct secret comparisons and instead use proper cryptographic hashing with rate limiting.
Straiker aims to address the risks associated with the increasing use of AI chatbots and AI agents through continuous testing or one-time risk assessments that involve in-depth attack simulations against AI applications and agents. It can also automatically block identified threats