Search the archive

NAKAMOTO

Nakamoto is a 2-layer encryption tool that protects your data and cryptocurrency private keys.

SPYAI

SpyAI is malware that captures full-monitor screenshots and exfiltrates them via Trusted Channel Slack to a GPT-4 Vision C2 server for daily frame-by-frame analysis.

MICROSOFT WOULDN'T LOOK AT A BUG REPORT WITHOUT A VIDEO

Security researcher Will Dorman attempted to report a vulnerability to the Microsoft Security Response Center by providing a report with a clear description of the bug and supporting screenshots. However, Microsoft responded that it could not review the report until a video was submitted. This was unnecessary and time-wasting, as it would provide no additional details and would just show the commands that have already been screenshotted.

UK'S FIRST PERMANENT FACIAL RECOGNITION CAMERAS TO BE INSTALLED IN SOUTH LONDON DESPITE BACKLASH

The Metropolitan Police will install permanent live facial recognition cameras in Croydon, London, to catch criminals by matching faces against a wanted list. Privacy campaigners strongly oppose the move, calling it a potential "dystopian nightmare" with no proper oversight.

COFFEELOADER PRETENDS TO BE ASUS SOFTWARE TO STEAL YOUR DATA

Zscaler researchers have discovered a new malware family, CoffeeLoader, active since September 2024. It masquerades as the ASUS Armoury Crate utility and delivers an infostealer like Rhadamanthys using sophisticated evasion techniques such as GPU code execution, stack spoofing, and sleep obfuscation.

FAKE SNOW WHITE MOVIE TORRENT INFECTS DEVICES WITH MALWARE

Scammers are spreading malware by offering fake Snow White movie downloads to torrent users.

NEW SECURITY REQUIREMENTS ADOPTED BY HTTPS CERTIFICATE INDUSTRY

Google's Chrome Root Program has introduced new security initiatives, including Multi-Perspective Issuance Corroboration and Linting, to enhance the reliability and agility of TLS connections used by Chrome users.

T-MOBILE COUGHED UP $33 MILLION IN SIM SWAP LAWSUIT

T-Mobile must pay $33 million for a SIM swap attack that let hackers steal cryptocurrency and access accounts.

Try runZero free →

NEW NPM ATTACK POISONS LOCAL PACKAGES WITH BACKDOORS

Researchers at Reversing Labs identified two malicious packages on npm targeting the ‘ethers' package: ‘ethers-provider2' and ‘ethers-providerz.' These packages stand out because they download a secondary malware stage that monitors the legitimate ‘ethers' package, then swaps its ‘provider-jsonrpc.js' with a trojanized version. This trojanized file downloads a third-stage malware that creates a reverse shell to a malicious IP address. Reversing Labs emphasizes the severity of this issue, as removing the malicious package does not eliminate the risk since the trojanized legitimate package can still harbor the malware.

NEW ATLANTIS AIO AUTOMATES CREDENTIAL STUFFING ON 140 SERVICES

Researchers from Abnormal Security have discovered a new Credential Stuffing as a Service (CSaaS) called Atlantis AIO. Atlantis AIO can automate the process of account takeovers via brute forcing, credential stuffing, or abusing account recovery with pre-built integrations for 140 services. It also aids threat actors in bypassing CAPTCHAs and monetizing stolen credentials/accounts.

MACOS USERS WARNED OF NEW VERSIONS OF READERUPDATE MALWARE

ReaderUpdate macOS malware loader has evolved to other languages such as Go and Rust. Initially a Python binary, it targets x86 Intel systems through third-party software sites, deploying adware and potentially serving as a pay-per-install platform for threat actors.

SCALING THREAT MODELING WITH AI: GENERATING 1,000 THREAT MODELS USING GEMINI 2.0 AND AI SECURITY ANALYZER

This blog post presents a method to produce high-quality threat models using Gemini 2.0 Flash Thinking and a series of prompts. The author found that the LLM performed poorly with prompts that were too long or too short but found that they could use multiple prompts that are in a “sweet spot” of length to science the desired results. They then used GitHub Actions to queue repositories into a pipeline that their AI Security Analyzer could then generate security design documentation, threat modeling, attack surface, and attack tree analysis for.

HOW TO HACK AN EIGHT SLEEP SMART MATTRESS “POD”

Security researcher Dylan Ayrey identified three key vulnerabilities in Eight Sleep's "Pod" mattress: a developer backdoor for SSH access, an exposed AWS key, and dependence on cloud services. He replaced the $4,700 hub with a $150 aquarium chiller, demonstrating a simpler solution for temperature control that avoided data collection and internet access, instead of relying on a $200-300 annual subscription.

DO YOU OWN YOUR PERMISSIONS, OR DO YOUR PERMISSIONS OWN YOU?

The article discusses how BloodHound Enterprise addressed false positives in Active Directory attack paths due to object ownership permissions. It explains how Microsoft's BlockOwnerImplicitRights feature prevents compromised accounts from altering security descriptors to elevate privileges. The author details the implementation of OwnsLimitedRights and WriteOwnerLimitedRights edges in BloodHound v7.1.0, which correctly identify when these features are active, reducing false positives for users blocking owner implicit rights.

scale for your business

SPLXAI (PRODUCT LAUNCH)

SplxAI relies on automated security testing, continuous monitoring, and dynamic remediation to secure internal AI agents and customer-facing AI systems, preventing attacks such as prompt injections, hallucinations, and off-topic responses.

UTMSTACK

UTMStack is a unified threat management platform that merges SIEM (Security Information and Event Management) and XDR (Extended Detection and Response) technologies.

PURPLELAB

PurpleLab is a readily deployable lab solution for cybersecurity professionals to test and create detection rules, simulate logs, and undertake various security tasks.

HOW THREAT ACTORS GET THEIR NAMES

Many threat actors are recognized by various names. These designations vary based on different vendors' conventions, such as Crowdstrike's use of animal names and Mandiant's APT classifications. This post features a list of threat actor names publicly disclosed by Microsoft, as well as additional names they are recognized by.

A SNEAKY PHISH JUST GRABBED TROY HUNT'S MAILCHIMP MAILING LIST

Troy Hunt of Have I Been Pwned recently fell for a phishing email that claimed his Mailchimp privileges were restricted, redirecting him to a site that stole his login and MFA code. The email's legitimacy was convincing, and fatigue combined with Outlook for iOS not displaying the email address contributed to his error. However, 1Password's lack of autofill should have prevented it. Hunt also questioned why Mailchimp kept unsubscribed emails and has added the breached email list to his site.

SECURITY ON THE PATH TO AGI

OpenAI is enhancing its security posture through a security grant program, a bug bounty cash increase, and AI-powered defense strategies. It is committed to protecting users, disrupting threats, and developing secure AI technologies as they advance toward AGI.

SOUTH AFRICAN POULTRY COMPANY REPORTS $1M LOSS AFTER CYBER INTRUSION

Astral Foods experienced a cybersecurity incident that resulted in $1.1 million in lost profits and disrupted poultry processing, but no customer data was compromised.

FILES STOLEN FROM NSW COURT SYSTEM, INCLUDING RESTRAINING ORDERS FOR VIOLENCE

Australian police are investigating a cyber attack on the NSW Online Registry that resulted in the theft of 9,000 sensitive files, prompting authorities to contact potentially affected individuals due to risks of victim exposure and extortion.

NEW RANSOMWARE GROUP CLAIMS ATTACK ON US TELECOM FIRM WIDEOPENWEST

A new ransomware group called Arkana Security claims to have hacked US telecom firm WideOpenWest (WOW!) and stolen customer information.

📗Get the eBook

BROADCOM WARNS OF AUTHENTICATION BYPASS IN VMWARE WINDOWS TOOLS

VMware Tools is a suite of drivers and utilities that enhance graphics, performance, and system integration for VMware guest operating systems. Positive Technologies, a Russian cybersecurity firm, reported a privilege escalation vulnerability in VMware Tools for Windows. This vulnerability enables a malicious actor with non-admin privileges to perform high-privilege operations within the VM. The exploit could potentially combine with recently disclosed VM escape vulnerabilities.

NEW WINDOWS ZERO-DAY LEAKS NTLM HASHES, GETS UNOFFICIAL PATCH

ARCOS Security found a vulnerability in all Windows versions that discloses NTLM hashes. It requires users to open a malicious file in Windows Explorer. ARCOS is offering a free, unofficial microcode patch until Microsoft issues an official patch.

NUMOTION DATA BREACH IMPACTS NEARLY 500,000 PEOPLE

Numotion, a mobility solutions provider, faced a data breach impacting about 500,000 customers last year. Hackers accessed employee emails from September to November 2024, risking exposure of personal, financial, and medical information.

MANAGE AUTHORIZATION WITHIN A CONTAINERIZED WORKLOAD USING AMAZON VERIFIED PERMISSIONS

Amazon Verified Permissions provides a mechanism for centralizing application authorization. This post from AWS provides four different deployment models for using Amazon Verified Permissions in containerized applications with various tradeoffs regarding resource use and authorization granularity: as an API Gateway external from a cluster, within the Kubernetes ingress controller, as a sidecar proxy, and within the application container directly.

MEASURING THE SUCCESS OF YOUR ADVERSARY SIMULATIONS

This post outlines how to measure the success of Adversary Simulation or Red Teaming exercises, focusing on three key goals: test controls, defensive enlightenment, and professional courtesy. Test Controls involves collaboration where testers validate expected security measures and share findings with defenders to enhance understanding and improve defenses. Testers should maintain professional courtesy throughout this process by being available, cleaning up data and tools, and acting transparently and humbly.

CONTINUOUS TRAIL

Threat models should be updated throughout software development. It is important to maintain trust zones, threat actors, connections, and security assumptions, as well as tracking components, sensitive data, and controls after systems stabilize. This post provides practical advice for incorporating threat modeling into all SDLC phases, adapting models to organizational needs, and identifying security risks early.

Get the 2025 Global Threat Intelligence Report by Flashpoint

DETECTION STUDIO (WEB APP)

Detection Studio is a playground that allows for converting Sigma detection rules to SIEM-specific languages entirely in the browser.

GO-OCSF

go-ocsf is a Go library and CLI tool that converts security findings and events into the Open Cybersecurity Schema Framework (OCSF) format with output options in JSON or Parquet.

CHARM SECURITY (PRODUCT LAUNCH)

Charm prevents scams before they occur by analyzing human vulnerability exposure and customer risk patterns and by providing actionable insights and tailored mitigation strategies.

THERE ARE PERHAPS 10,000 REASONS TO DOUBT ORACLE CLOUD'S SECURITY BREACH DENIAL

A hacker claims to have breached Oracle Cloud's login servers, stealing about six million records. Several security firms confirm the data's authenticity, with three customers verifying the leaked information. Although Oracle denies the breach, experts caution about potential cybersecurity risks.

AFTER DDOS ATTACKS, BLIZZARD ROLLS BACK HARDCORE WOW DEATHS FOR THE FIRST TIME

Blizzard will now allow character resurrections in World of Warcraft Classic's Hardcore mode if players die due to DDoS attacks. This policy change comes after repeated server disruptions that targeted the popular OnlyFangs guild. Players now have a fail-safe if they are targeted by these attacks.

SEMRUSH IMPERSONATION SCAM HITS GOOGLE ADS

Criminals are targeting Semrush to steal Google account credentials and access data like Google Analytics and Search Console. Malicious ads are impersonating Semrush to trick users into revealing sensitive information, posing a major threat to individuals and businesses.

CRUSHFTP WARNS USERS TO PATCH UNAUTHENTICATED ACCESS FLAW IMMEDIATELY

CrushFTP has a security flaw that allows unauthorized access - update v11.3.1+ resolves this flaw.

HACKERS ARE USING MICROSOFT'S .NET MAUI TO SPREAD ANDROID MALWARE

Cybercriminals are misusing Microsoft's .NET MAUI tool to spread Android malware, tricking users by hiding malicious code in seemingly legitimate apps.

300 ARRESTED IN CRACKDOWN ON CYBERCRIME RINGS IN AFRICA

Over 300 suspects were arrested in Africa for cybercrimes that targeted businesses and individuals in an Interpol-led crackdown called Operation Red Card.

Read the full benchmark report here →

AUTHENTICATION BYPASS IN NEXT.JS

Next.js has disclosed a Critical (9.1/10) auth bypass vulnerability. Next.js uses an internal header, X-middleware-subrequest, to prevent infinite loops from recursive requests. The vulnerability allowed users to abuse the header, bypassing middleware checks, including authorization.

CRITICAL INGRESS NGINX CONTROLLER VULNERABILITY ALLOWS RCE WITHOUT AUTHENTICATION

Five vulnerabilities in the NGINX Ingress Admission Controller, called IngressNightmare, enable remote code execution without authentication. Attackers can inject harmful configurations to compromise Kubernetes environments via the admission controller.