Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Researchers used AI tools to create malware that can steal login credentials from Google Chrome by manipulating generative AI platforms in a controlled narrative environment.
Hackers are hiding VenomRAT malware in virtual hard disk image files to infect devices.
Sponsored
You can't secure what you can't see.
California Cryobank, one of the largest reproductive tissue banks in the world, has disclosed a data breach that affects an undisclosed number of Americans. The hackers potentially stole data that includes SSNs, driver's license numbers, financial account numbers, and health insurance information. No known threat actor has claimed responsibility for the attack.
MegaRAC BMC software enables remote server management, allowing admins to troubleshoot as if present. Eclypsium researchers identified a CVSS 10 vulnerability permitting remote, unauthenticated attackers to control affected servers. AMI, the software's developer, has issued patches to OEM manufacturers for customer rollout.
VMware has released patches for three zero-day vulnerabilities in ESXi, which allowed threat actors to escape the hypervisor and access critical server data. The vulnerabilities are actively being exploited in the wild, posing a significant risk to organizations using VMware environments. It is crucial to patch affected systems promptly to prevent potential security breaches.
Researchers from Pillar Security have discovered a new prompt injection technique on Cursor and GitHub Copilot. These systems use rules files to guide the prompting for the LLM, which is often distributed by open-source projects or from other untrusted locations. This attack involves utilizing invisible Unicode characters to hide malicious instructions for the LLM that can be used to instruct it to poison the generated code.
This post outlines seven security flywheels: reducing costs to raise security baselines, transitioning threat intelligence from push to pull, creating digital twins through asset inventory, enhancing detection via red teaming, identifying adjacent business benefits of security measures, implementing continuous control monitoring and forming federated teams that seek assistance instead of pushing initiatives. Each flywheel creates a cycle where initial investments yield benefits that can be reinvested, ultimately easing the burden on security teams while sustaining or improving security posture.
Attackers can bypass Windows Defender Application Control with LOLBINs and Electron apps using tools like Loki C2. Modifying JavaScript in trusted Electron apps enables Node.js code injection to interact with the OS, allowing the execution of malicious payloads and the creation of advanced C2 agents like Dragon.
Sponsored
40,000+ new CVEs in 2024. Almost 600,000 issues per org. Weeks of manual triage. Why is AppSec failing, and what can be done differently? More tools aren't the answer. Read about the three ways to fix AppSec [11] on the Ox Security blog [11].
AWS IAM Policy Visualizer is a web app that visualizes the relations in an IAM policy in graph format. The tool also provides a search function for large policies.
cvss-bt enriches the NVD CVSS scores to include Temporal/Threat Metrics.
StringReaper extracts strings, such as JWT tokens and credentials, from remote process memory, saving time in engagements. It can filter memory regions and includes features like listing target sections and displaying remote environment strings.
A researcher has released an open-source decryptor for Akira ransomware that brute forces encryption keys. Akira generates unique keys for each file using four timestamp seeds, hashes them through 1,500 rounds, and encrypts them with another key, appending them at the end of each file. The researcher analyzed logs to estimate when the ransomware was active and used 16 4090s via RunPod & Vast.ai to decrypt a friend's files in 10 hours.
With Check Point and Palo Alto exiting CNAPP, the field has consolidated around Wiz and a few leaders, losing much of its previous hype. CNAPP tools will revert to their components: CSPM for vulnerability management, ASPM for secure code development, and CADR for responding to cloud alerts.
A malware campaign called 'DollyWay' has compromised over 20,000 WordPress sites globally, redirecting users to harmful sites since 2016. The campaign has evolved to include advanced evasion techniques and monetization strategies. GoDaddy researchers have linked this operation to a larger scam redirection system named 'DollyWay World Domination.'
A federal appeals court has decided that Capital One hacker Paige Thompson's sentence was too lenient for stealing data from millions of customers - the case is now going back to the district court for resentencing.
Researchers used AI tools to create malware that can steal login credentials from Google Chrome by manipulating generative AI platforms in a controlled narrative environment.
Hackers are hiding VenomRAT malware in virtual hard disk image files to infect devices.
…all led by a team of expert certified testers.
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
Microsoft Incident Response researchers report on a new RAT, StilachiRAT. This RAT can steal crypto wallet data, clipboard credentials, and Google Chrome local state files. It also features enhanced persistence, anti-forensics, and C2 command execution capabilities.
Hackers exploited an SSRF vulnerability in ChatGPT's pictureproxy.php file, enabling unauthorized requests. There were over 10,000 attacks from one IP focused on the US government and financial institutions in a week.
Researchers found server hosting tools for cyber attacks on South Korean entities, notably using Cobalt Strike Cat. The attacker targeted government and commercial organizations with open-source tools like SQLMap and Web-SurvivalScan. The malware campaign utilized Rust-compiled loaders and a modified Cobalt Strike for post-exploitation.
Trail of Bits' TRAIL (Threat and Risk Analysis Informed Lifecycle) is a threat modeling process that merges aspects of Mozilla's Rapid Risk Assessment, NIST SP 800-154, and NIST SP 800-53 to identify design-level security flaws. TRAIL constructs a model of system components and trust boundaries, documents threat scenarios of potential adversary exploitations, and generates actionable findings with short- and long-term mitigation recommendations. It addresses root causes at the architecture level, allowing clients to adapt their threat models as systems evolve and offering vital security insights throughout the software development lifecycle.
This blog explores how to exploit GitLab Enterprise through ruby-saml vulnerabilities using round-trip attacks and namespace confusion for unauthorized admin access. The technical details are provided for security education and understanding these attack vectors.
This article describes how to defeat string obfuscation in Node.js malware through Abstract Syntax Tree (AST) parsing, focusing on the Nebula Stealer sample. It outlines a method using the Babel library to safely analyze, extract, and execute obfuscated code in a VM context while replacing obfuscated strings with their decoded values. The author includes code snippets for renaming variables, extracting code segments, executing parts of the code to reveal hidden strings, and enhancing readability.
Sponsored
Businesses are cautiously optimistic about AI agents for SOC triage and investigation. This buyer's guide will help you understand what to look for in an AI SOC analyst [11], from a business and technical perspective. It also includes an RFP template that you can use as a
In the wake of the tj-actions and reviewdog supply chain attacks, this action scans GitHub Actions logs for exposed secrets and credentials.
AI HTTP Analyzer is a Burp App that provides an advanced security analysis assistant integrated into Burp Suite.
Dojo-101 is a project for capturing experience and knowledge in cybersecurity.
Amazon RDS IAM DB Authentication enables IAM principals to access RDS databases with their IAM credentials, eliminating the need for separate database credentials. It also reports IAM DB Auth error logs to CloudWatch and publishes authentication metrics automatically.
A JA4 TLS client fingerprint contains a 36-character fingerprint of the TLS Client Hello which can be used for identifying known bad actors. JA4 fingerprints are now supported in match statements in AWS WAF. Additionally, AWS WAF has added support for both JA3 and JA4 fingerprints to rate-based rules.
The UK's Online Safety Act enforcement began, requiring tech platforms to remove dangerous content or face fines up to 10% of global turnover. Elon Musk hopes Trump will intervene to weaken the law, but UK officials insist it will remain intact and may even expand, particularly to combat AI-generated CSAM.
Google has announced a definitive agreement to acquire cloud security platform Wiz, Inc. for $32 billion in cash.
Cybercriminals used infostealers to steal 2.1 billion credentials last year, leading to ransomware attacks and data breaches.
Sponsored
Most businesses don't have massive security teams or unlimited budgets—so they need tools that work for them.
100 dealerships have been compromised through ClickFix code displaying fake reCAPTCHA prompts. When clicked, these prompts copied commands to users' clipboards and instructed them to execute these in Windows Run, ultimately installing SectopRAT malware.
CVE-2025-24813 in Apache Tomcat is under active exploitation 30 hours post-disclosure. The vulnerability enables remote code execution through malicious serialized Java uploads via PUT requests, no authentication is required. It is critical to update to versions 9.0.99, 10.1.35, and 11.0.3 ASAP.
Proofpoint researchers uncovered a malware campaign using malicious OAuth apps posing as Adobe Drive, Adobe Drive X, Adobe Acrobat, and DocuSign. These apps request minimal benign permissions but redirect users to phishing pages or malware downloads.
Hotkey-based keyloggers register alphanumeric hotkeys that, on keypress, record the keystroke, unregister the hotkey, resend the keypress, and reregister the hotkey. These keyloggers are stealthy since the RegisterHotKey and UnregisterHotKey APIs are not monitored by ETW. In this post, Elastic researchers detail their detection method for hotkey-based keyloggers using an undocumented kernel data structure listing all registered keyloggers' hotkeys.
This post describes a method for obtaining backdoor persistence in AWS by modifying the AWSControlTowerExecution role to allow an attacker-controlled account to assume it. The attack is effective because many tools will not flag violations against this role, which contains AdministratorAccess by default. There are likely other AWS service roles that this attack could utilize.
The post covers how to use x64dbg Automate to automate repetitive x64dbg tasks like finding malware entrypoints, annotating payloads, and bypassing anti-debug checks. A malware sample is included for experimentation.
Sponsored
CVE management can be a thankless slog: engineering teams plug away without an effective strategy or end in sight, while business leaders lack data to make real changes. Chainguard's new CVE Visualizations functionality [13] allows organizations to better understand and communicate the benefits of zero CVE images versus the costs of
Aiceberg is designed to prevent unsanctioned, unsuitable, or illegal content and automatically redacts personal and other sensitive information. It can detect common cyberattack vectors such as prompt injection, prompt leaking, and jailbreaking and is capable of performing a security analysis of agentic workflows.