Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Attackers are using SSE-C to encrypt objects in ransomware attacks on AWS accounts. Jesse Griggs established a test environment to measure the alert response time through CloudWatch and how quickly Lambda could block the attacker or disable SSE-C. He noted alerts took about 6 minutes to arrive, while automated responses occurred immediately.
This article explores modern phishing techniques, from basic HTML pages to those that bypass multi-factor authentication. It covers attack methods such as Browser-in-the-Browser (BITB), Attacker-in-the-Middle (AITM), and WebRTC, as well as infrastructure considerations for hosting and delivery. Phishing has evolved with sophisticated techniques using cloud provider domains, making detection harder. Effective defense requires multi-layered approaches combining technical controls and human awareness.
Sponsored
Organizations have been using SIEMs for decades — but the needs of SOC leaders have changed dramatically. Move to a modern SIEM [11].
devcontainer always tries to find the best way to install the most popular tools, so they can all work seamlessly, and at the same time add security by default.
Fast Incident Response (FIR) is a cybersecurity IR management platform from the French Cert Societe Generale.
StreetCred is a tool created for Red Team operators to test default credentials and execute scripts over SSH and WinRM.
CISA's 100-member penetration testing team was terminated after Trump's DOGE unit canceled their contract, leading to cuts in another red team. The election security group EI-ISAC also shut down due to funding loss, raising concerns about cyberattack vulnerabilities.
Bybit experienced the largest cryptocurrency theft ever, totaling $1.4 billion, when attackers compromised a developer machine and injected malicious JavaScript into Safe{Wallet} UI, altering what signers saw. This off-chain attack tricked signers into approving a delegatecall that replaced the proxy implementation with the attackers' code, giving them control over all funds. The Lazarus group from North Korea executed this sophisticated attack by exploiting human verification vulnerabilities and the lack of human-readable formats for complex smart contract operations in the EIP-712 standard.
Over 110,000 iOS apps leak secrets, including sensitive data like cloud storage keys. Most apps expose at least one hardcoded secret, risking user breaches. Apple's App Store does not check for these vulnerabilities, underscoring the need for better security practices.
A criminal operation is spreading malware through fake Reddit and WeTransfer pages using the Lumma stealer.
Chinese hackers from the Volt Typhoon group breached a US electric utility in Massachusetts for over 300 days, collecting sensitive operational data.
Facebook disclosed a FreeType 2 vulnerability that could allow arbitrary code execution in all versions up to 2.13, with reports of active exploitation in attacks.
Sponsored
Executives are prime targets for cyber and physical attacks—are you equipped to protect them?
Bank of America has informed clients that it suffered a data breach due to a data destruction vendor's mishandling of sensitive documents. The bank reported that some documents were found outside of the secure containers on the exterior of the financial center. The documents may have included names, account details, addresses, contact information, date of birth, SSNs, and other government IDs.
In October, Palo Alto Networks discovered five vulnerabilities in the widely used SCADA software system, ICONICS. Although these vulnerabilities have been fixed, scans indicate that several dozen internet-facing systems remain unpatched. The vulnerabilities could enable privilege escalation, DLL hijacking, and, in some cases, total system compromise.
Healthcare tech company ESHYFT exposed over 86,000 sensitive records in an unsecured AWS S3 bucket, including nurses' medical information, facial images, and ID documents. Despite being notified in January, the company took over a month to secure the 108.8 GB database.
This story is about a freelance developer tricked by a fake recruiter on LinkedIn for a Web3 project. After accepting simple coding tasks as part of the interview process, they launched a server that secretly gave hackers user-level access to their system. The supposed recruiter and CTO disappeared afterward.
A comparison of three methods for detecting suspicious AWS API calls. Eventbridge offers quick response times and low cost but lacks support for multi-account or complex setups. CloudTrail to Lambda provides flexibility and visibility with easy multi-account integrations but is slower. The CloudWatch with Metric Filters approach is faster than Lambda, but increases complexity in AWS pattern syntax.
Trusted Types implementation in Gmail and AppSheet eliminated DOM XSS vulnerabilities using developer-focused approaches to find and fix violations. Key strategies included deploying static analysis tools for early detection and utilizing runtime analysis techniques to track violations through script-sample searches and minified code examination. The work created patterns and tools like Trusted Types Helper to fix violations, contributing to better security practices across the JavaScript ecosystem.
Sponsored
Drata partnered with Wakefield Research to survey 300 U.S. IT and security professionals for the new State of GRC 2025 report [11]. The data shows that GRC programs, traditionally viewed as cost centers, are now increasingly being seen as revenue drivers. AI is poised to deliver further transformation in compliance. Read the full report →
Sola is a new security platform that uses AI to query data within existing or built-in security applications. It aims to create more streamlined security services for organizations, which, in theory, will do exactly what they want and at a fraction of the cost.
VulnViper is a powerful, customizable web server vulnerability scanner written in Python that helps ethical hackers, penetration testers, and security professionals identify security issues in web servers.
Baby Naptime is an open-source implementation of Google's Project Naptime, which uses LLMs to discover and exploit native vulnerabilities.
The New York Attorney General has sued Allstate for inadequate system security following breaches in 2020 and 2021, which exposed nearly 200K customers' personal information, including driver's license numbers. Allstate denies liability, claiming improved security and patched vulnerabilities.
Switzerland's NCSC has announced a new rule that requires critical infrastructure organizations to report cyberattacks within 24 hours of discovering them. Cyberattacks include any actions that jeopardize the operation of critical infrastructure, such as manipulation, encryption, or data exfiltration; malware installed on systems; unauthorized access to systems; and extortion, threats, or coercion. This new requirement will take effect on April 1, with a grace period until October.
The South American cyberespionage group Blind Eagle has compromised over 1,600 Colombian organizations. It exploited security vulnerabilities and cloud accounts to deploy malware and gain unauthorized access.
Microsoft has patched a privilege escalation flaw in the Win32k driver that has been exploited since 2023 in attacks using a backdoor called PipeMagic.
Apple fixed a serious security vulnerability, CVE-2025-24201, that let attackers escape the Web Content sandbox and was exploited in sophisticated cyber attacks.
Scammers impersonated Binance, offering a fake TRUMP coin via email, leading users to download malware that granted attackers full control of computers.
…all led by a team of expert certified testers.
Sponsored
As a 5 star rated, global certified CREST provider, ThreatSpike offers top-quality penetration testing at an unbeatable price. Get unlimited penetration testing for just $1,500 per month [4] and ensure your business is always protected.
X faced an eight-hour outage on Monday. Elon Musk attributed this to a "massive cyberattack" from a country or group protesting his government role with "DOGE."
Four healthcare organizations reported data breaches last week that impacted over 560,000 individuals. Sunflower Medical Group had the largest breach, affecting 220,000, with the Rhysida ransomware group claiming responsibility. Other breaches involved Hillcrest Convalescent Center, Gastroenterology Associates, and Community Care Alliance.
Several US cities have warned of a phishing campaign that uses texts which claim users have an unpaid parking balance, risking a daily $35 fine. The messages exploit a redirect on google.com to hide the phishing site and evade iMessage protections. This article includes a breakdown of a text purportedly from New York City.
AWS SES allows sending emails using an individually verified email or any email in a verified domain. If an attacker has the requisite IAM privileges, they can spoof any email address in a verified domain for phishing attacks and there is no ability to log emails sent. Use verified emails or the "ses:FromAddress" condition in SES IAM policies to prevent this attack.
Kubernetes provides robust audit logs essential for investigations. This post outlines common issues with cloud providers, including inconsistent logging policies, vendor modifications to Kubernetes logs, and cloud providers controlling audit policies. Use dynamic admission controllers and cloud-specific logs like CloudTrail, or VPC Flow Logs to address these issues.
VS Code extensions allow attackers to stealthily install malware, despite Microsoft's protective prompts. This post illustrates how the initial installation process can evade these defenses and affect existing installations, along with detection methods for this attack.
A comprehensive security dashboard that tracks malicious activities with advanced analytics capabilities.
ssdeep is a command line tool and API for computing fuzzy hashes.
Twilio Security Scanner is a tool for detecting misconfigurations and security risks in Twilio accounts.
Despite recent conflicts among maintainers, Rust is still advancing within the Linux kernel. The Prossimo project showcases increasing acceptance of Rust across various subsystems, primarily due to its memory safety advantages, with mainline integration anticipated in the next 18 months.
Google paid $11.8 million to 660 researchers for bug bounties in 2024. Some highlights include Android/Google mobile vulnerabilities earning $3.3 million and new AI bug bounties receiving 150 reports worth $55,000.
The "Stolen Device Protection" feature was introduced in iOS 17.3 to prevent unauthorized access to sensitive iPhone data. This feature complicates data extraction for forensic experts by requiring biometric authentication to pair with a computer, limiting traditional extraction methods. Manual inspection may be the only viable forensic method for devices protected by this feature, but it has limitations and is not forensically sound.
Researchers have found a new attack where malicious browser extensions can clone legitimate ones that look identical to the real ones, making it hard for users to spot the scam.
SideWinder, a prolific APT group, has updated its tools to target maritime and nuclear sectors.
U.S. authorities seized $23 million in stolen cryptocurrency from a $150 million Ripple wallet theft and the 2022 LastPass breach.
and improved labor efficiency by 50%. * Practical strategies to enhance security, streamline compliance, and minimize risk.