Search the archive

NODE VERSION AUDIT

Node Version Audit is a convenient tool to easily check a given Node.js version against a regularly updated list of CVE exploits, new releases, and end-of-life dates.

ANNOUNCING OSV-SCANNER V2: VULNERABILITY SCANNER AND REMEDIATION TOOL FOR OPEN SOURCE

Google's OSV-Scanner V2.0.0 is an open-source vulnerability scanner that now integrates with OSV-SCALIBR. It offers improved dependency extraction, layer-aware container scanning for Debian, Ubuntu, and Alpine images, interactive HTML output, and guided remediation for Maven pom.xml files. Future plans for the project include enhanced integration with OSV-SCALIBR, increased ecosystem support, full filesystem accountability, reachability analysis, and VEX support.

TIKTOK ROLLS OUT A ‘SECURITY CHECKUP' TOOL TO HELP USERS SECURE THEIR ACCOUNTS

TikTok's new "Security Checkup" tool offers users a centralized screen to review security settings, enabling two-factor authentication, backup logins, device management, and biometric options.

ATTACKERS USE CSS TO CREATE EVASIVE PHISHING MESSAGES

Threat actors are using CSS to create evasive phishing messages by hiding text and tracking user behavior. Cisco Talos has observed attackers exploiting CSS to evade detection and raise security concerns. Experts recommend using advanced filtering and privacy proxies to mitigate these risks.

UPDATE: STOPPING CYBERCRIMINALS FROM ABUSING COBALT STRIKE

Microsoft, Fortra, and Health ISAC are working together to stop cybercriminals from misusing Cobalt Strike and compromised Microsoft software to deploy ransomware. They have made significant progress in reducing the availability of unauthorized copies and seizing malicious domains. Ongoing efforts include sending takedown notices and collaborating with law enforcement to combat illicit usage of cyber intrusion tools.

JAGUAR LAND ROVER BREACHED BY HELLCAT RANSOMWARE GROUP USING ITS INFOSTEALER PLAYBOOK—THEN A SECOND HACKER STRIKES

The HELLCAT ransomware group breached Jaguar Land Rover (JLR) by leaking sensitive data through stolen Jira credentials obtained via infostealer malware, which were later exploited by another actor, "APTS," to exfiltrate additional data from JLR.

EMAIL SECURITY NOW AVAILABLE FOR FREE FOR POLITICAL PARTIES AND CAMPAIGNS THROUGH CLOUDFLARE FOR CAMPAIGNS

Cloudflare is offering free Email Security to protect political campaigns from cyber attacks.

WHITE HOUSE EXEMPTS CYBER PROS FROM MASS LAYOFFS; JUDGE REINSTATES CISA FIRINGS

The White House has exempted cybersecurity professionals from layoffs, offering hope during CISA job cuts, and a judge has reinstated fired federal employees, underscoring management incompetence in the DOGE project.

Register for the workshop

CLICKFIX: HOW TO INFECT YOUR PC IN THREE EASY STEPS

The "ClickFix" scheme tricks users into downloading password-stealing malware disguised as CAPTCHA verification. Users press Windows+R, CTRL+V, and Enter, which activates the download through mshta.exe. Organizations can prevent this by disabling the run command for the Windows+R shortcut.

A DOGE STAFFER BROKE TREASURY POLICY BY EMAILING UNENCRYPTED PERSONAL DATA

A 25-year-old DOGE staffer violated Treasury policy by sending an unencrypted spreadsheet with personal data to Trump officials. Marko Elez, who previously worked for Musk's companies, had been "mistakenly" granted access to Treasury systems before resigning in February due to racist posts. He was rehired at the Social Security Administration despite ongoing litigation.

GITHUB ACTION TJ-ACTIONS/CHANGED-FILES SUPPLY CHAIN ATTACK: EVERYTHING YOU NEED TO KNOW

The tj-actions/changed-files GitHub Action repository was compromised by an attacker posing as the Renovate bot. The attacker added a malicious payload that caused the CI runner to dump its memory into the Actions work log and redirected all tags to include this payload. Sensitive data in GitHub secrets for this action can be visible in public repos, but the impact on private repositories is more limited.

GUARD YOUR CODEBASE: PRACTICAL STEPS AND TOOLS TO PREVENT MALICIOUS CODE

Apiiro researchers found that targeting specific coding anti-patterns enabled them to detect malicious packages with a 94.3% success rate in Python and 88.4% in npm. They focused on obfuscated code and dynamic code execution and have released Semgrep rules for detection.

HIERARCHY OF NEEDS

Swannman's Hierarchy of Needs Pyramid model outlines 10 essential layers for establishing effective security functions, with threat hunting as a specialized function at the top. The Hierarchy of Needs aids organizations in planning and assessing incident response capabilities by identifying advanced metrics for complex questions. The Plateaus Model tracks organizational maturity throughout the hierarchy.

WHOAMI - GET PRINCIPAL NAME FROM KEYS

Attackers often use get-caller-identity to find IAM roles linked to keys, but this API call can be monitored. This post shares a tactic to bypass these detections by querying an API that returns caller identity on a failed call.

social media. Learn more about running your first campaign.

TUMERYK (PRODUCT LAUNCH)

Tumeryk's AI Trust Scores assesses risk using nine factors, offering CISOs objective security scores for gen AI models.

YAAK API CLIENT

Yaak is a desktop client for interacting with REST, GraphQL, WebSocket, and gRPC APIs.

NULLGATE

NullGate provides a modern approach to using NTAPI functions via indirect syscalls and the FreshyCalls method for dynamic syscall number retrieval. It includes a novel technique to bypass Windows Defender's memory scanning and features a classic PoC process injector.

UK'S SECRET ICLOUD BACKDOOR ORDER TRIGGERS CIVIL RIGHTS CHALLENGE

The UK government's order for Apple to backdoor iCloud encryption has faced legal challenges from Liberty and Privacy International, who deem it "unacceptable and disproportionate" with "global consequences" for non-UK users.

DEMS ASK FEDERAL AGENCIES FOR REASSURANCE DOGE ISN'T FEEDING DATA INTO AI WILLY-NILLY

House Democrats have questioned 24 federal agencies about Elon Musk's DOGE team possibly sharing sensitive government data with unauthorized AI systems. Rep. Gerald Connolly raised concerns about legal violations, data privacy, and handling of Americans' personal information, requesting responses on DOGE's AI activities by March 26.

FAKE "SECURITY ALERT" ISSUES ON GITHUB USE OAUTH APP TO HIJACK ACCOUNTS

A phishing campaign on GitHub uses fake "Security Alert" issues to trick users into granting access to a malicious OAuth app, giving attackers complete control over accounts and code. The alerts mention unusual activity from Reykjavik, Iceland, and the 53.253.117.8 IP address, urging users to allow risky permissions. Affected users must revoke access, inspect for suspicious apps, and change credentials immediately.

LOCKBIT DEVELOPER ROSTISLAV PANEV EXTRADITED FROM ISRAEL TO THE US

LockBit ransomware developer Rostislav Panev was extradited from Israel to the US on charges related to his role in the global LockBit ransomware cybercrime.

NEW MASSJACKER CLIPPER TARGETS PIRATED SOFTWARE SEEKERS

MassJacker is a new clipper malware that targets users seeking pirated software by replacing their cryptocurrency wallet addresses with those controlled by hackers, facilitating fund theft.

GOVERNMENTS WON'T LIKE THIS: ENCRYPTED MESSAGING BETWEEN ANDROID AND IOS DEVICES COMING, SAYS GSMA

The GSM Association's RCS Universal Profile version 3.0 has been released, promising to unlock interoperable encrypted messages between Android and iOS devices.

Get it here

AWS CLOUDFORMATION PHISHING ATTACK: A GROWING THREAT

The AWS CloudFormation phishing attack begins with fake AWS Support emails containing a "Launch Stack" button that redirects victims to the AWS CloudFormation console. Clicking it deploys a template that creates an IAM role with admin privileges and a trust policy for the attacker's account. The IAM Role ARN is sent to the attacker's API Gateway, resulting in complete account compromise through privilege escalation, resource creation, and data exfiltration, avoiding detection.

CHINESE HACKERS BREACH JUNIPER NETWORKS ROUTERS WITH CUSTOM BACKDOORS AND ROOTKITS

Chinese cyber espionage group UNC3886 has targeted Juniper Networks MX routers nearing end-of-life, using six TinyShell-based backdoors for file transfers, shell command execution, and log disabling. They exploit JunOS security by using legitimate credentials for privileged access and injecting malicious payloads into the memory of legitimate processes. Juniper Networks has addressed this vulnerability (CVE-2025-21590) in recent OS updates and advises organizations to upgrade their devices to the latest Juniper Malware Removal Tool versions.

NEW OBSCURE#BAT MALWARE TARGETS USERS WITH FAKE CAPTCHAS

OBSCURE#BAT malware tricks users with fake captchas and software downloads to evade detection and steal data. It hides in systems using rootkit technology, making it hard to detect. To stay safe, only download from trusted sources and use threat detection tools.

AI: ADVENT OF AGENTS OPENS NEW POSSIBILITIES FOR ATTACKERS

Symantec demonstrates how OpenAI's Operator agent could execute a basic cyberattack with minimal prompt engineering. The research highlights that while most LLM attacker use cases have been passive, AI-powered agents with web interaction capabilities present expanded opportunities for both legitimate users and potential attackers.

DEEPSEEK CAN BE GENTLY PERSUADED TO SPIT OUT MALWARE CODE

DeepSeek's R1 model can create malicious code with careful prompting despite its guardrails. Tenable researchers generated working keyloggers and basic ransomware after claiming educational purposes, though manual intervention was needed to fix bugs.

THE ROAD TO ZERO TRUST IS PAVED WITH GOOD INTENTIONS

Zero trust architecture requires continuous verification of users and devices regardless of network location. A four-level maturity model helps organizations assess progress, though complete implementation faces challenges with SaaS, device verification, and legacy systems. Organizations should approach zero trust as an ongoing journey tailored to their risk profile rather than a checklist.

SECURECODEBOX

secureCodeBox is a Kubernetes-based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box.

CRADLE

CRADLE is an open-source web app that empowers Cyber Threat Intelligence (CTI) analysts by streamlining threat analysis with collaborative note-taking, visual mapping, and report generation.

QUASAR

Quasar is a modified version of the original Quasar RAT, now featuring HVNC, webcam support, and better remote desktop streaming, enhancing its remote administration and misuse potential.

AMAZON IS STILL HOSTING STALKERWARE VICTIMS' DATA WEEKS AFTER BREACH ALERT

Three stalkerware apps—Cocospy, Spyic, and Spyzie—stored victims' stolen data on Amazon Web Services. Although notified by February with specific bucket locations, Amazon hasn't removed the data due to procedural issues, claiming the notifications aren't formal abuse reports.

APPLE TO APPEAL UK GOVERNMENT BACKDOOR ORDER ON FRIDAY

The UK government faces criticism as its appeal hearing against Apple over a 'backdoor' order will be held secretly on March 14. The Technical Capability Notice would force Apple to provide access to encrypted iCloud data of users worldwide. Several MPs demand the hearing be public, warning about global privacy risks and dangerous precedents for authoritarian regimes.

MEDUSA RANSOMWARE HIT OVER 300 CRITICAL INFRASTRUCTURE ORGANIZATIONS UNTIL FEBRUARY 2025

The Medusa ransomware targeted over 300 U.S. critical infrastructure organizations until February 2025, leading the FBI, CISA, and MS-ISAC to issue a joint advisory for network defenders. The ransomware developers recruited access brokers via cybercriminal forums and used techniques to evade detection, executing double extortion schemes that demanded payment for decrypting files and preventing data leaks.

NEW SUPERBLACK RANSOMWARE EXPLOITS FORTINET AUTH BYPASS FLAWS

New ransomware SuperBlack exploits two Fortinet vulnerabilities to breach firewalls and deploy itself.

MICROSOFT APOLOGIZES FOR REMOVING VSCODE EXTENSIONS USED BY MILLIONS

Microsoft reinstated VSCode extensions after mistakenly flagging them as malicious due to obfuscated code, which led to the banning of publisher Mattia Astorino.

NORTH KOREA-LINKED APT GROUP SCARCRUFT SPOTTED USING NEW ANDROID SPYWARE KOSPY

ScarCruft, linked to North Korea, used KoSpy spyware to target Korean and English users, disguising it as utility apps to gather SMS, calls, location, files, audio, and screenshots.

Download the Full Report

TATA TECHNOLOGIES' DATA LEAKED BY RANSOMWARE GANG

POWERSCHOOL PORTAL COMPROMISED MONTHS BEFORE MASSIVE DATA BREACH

Hackers accessed PowerSchool's support portal months before a December 2024 data breach, potentially impacting 70 million individuals. They used compromised credentials to steal personal data, including names, contact details, birth dates, medical information, and Social Security numbers.

PREVIOUSLY UNIDENTIFIED BOTNET TARGETS UNPATCHED TP-LINK ARCHER HOME ROUTERS

Cato Networks has detected a new botnet named Ballista that is targeting unpatched TP-Link Archer routers using the CVE-2023-1389 exploit. Researchers suggest the hacker is likely from Italy and that the botnet is in its early stages, with evolving malware capabilities. Unlike other DDoS-for-hire botnets, Ballista's malware can also execute arbitrary commands on remote systems.

AZURE'S WEAKEST LINK? HOW API CONNECTIONS SPILL SECRETS

Binary Security found undocumented Azure API Connections enabling privilege escalation. With Reader permissions, attackers can GET requests to backend resources like Key Vaults, Defender ATP, and third-party services such as Jira and Salesforce.