Search the archive

REGISTER TODAY

SILVER FOX APT EXPLOITS SIGNED WINDOWS DRIVER TO DELIVER VALLEYRAT

Silver Fox APT exploits a Microsoft-signed but vulnerable WatchDog Antimalware driver (amsdk.sys v1.0.600) to disable security processes on Windows 10/11 and deploy ValleyRAT malware, with the driver never being flagged by Microsoft's Vulnerable Driver Blocklist or LOLDrivers database. The attackers bypassed hash-based blocklists even after a patch by changing a byte in the driver's timestamp while keeping its valid Microsoft signature, showing how trusted signed drivers can be weaponized. The campaign exposes gaps in Microsoft's driver blocklist and the need for security teams to use additional verification beyond signature validation, as the malware terminated nearly 200 security processes targeting mainly Asian organizations.

WORDPRESS WOES CONTINUE AMID CLICKFIX, TDS THREATS

Cybercriminals are exploiting vulnerable and fake WordPress plugins to hijack sites and redirect visitors to malicious destinations. Two major campaigns, ClickFix ("ShadowCaptcha") and Help TDS, have targeted thousands of websites for scams and data theft. Attackers often gain access through stolen credentials or unpatched plugins, making regular updates, strong authentication, and vigilant plugin management critical for site security.

IRANIAN HACKERS EXPLOIT 100+ EMBASSY EMAIL ACCOUNTS IN GLOBAL PHISHING TARGETING DIPLOMATS

An Iran-linked hacking group executed a broad spear-phishing campaign, compromising over 100 embassy and government accounts worldwide. Masquerading as urgent diplomatic emails, attackers distributed malware using Word documents with malicious macros. The operation, associated with the group Homeland Justice, mainly targeted Europe and Africa.

AGENTIC AI: A CISO'S SECURITY NIGHTMARE IN THE MAKING?

Agentic AI's autonomous decision-making poses cybersecurity risks, including shadow AI deployments without IT oversight, multi-agent systems spreading sensitive data, and AI chaining actions that mimic multi-stage attacks while evading security controls. CISOs struggle with visibility into these systems, increased attack surfaces via third-party APIs, and distinguishing between emergent AI behavior and security breaches. This calls for new defense models with real-time monitoring, tight governance, and cross-team coordination. Organizations must adopt secure-by-design methods and proactive governance to maximize AI benefits while managing risks from systems that can access data, decide, and adapt without human oversight.

HOW THEY GOT IN — DAVITA INC.

The data breach at DaVita Inc. unfolded due to a combination of weak security controls, persistent vulnerabilities, and a lack of timely action on previous advisories. Attackers exploited leaked credentials, unpatched internet-facing systems, legacy software, and insufficient monitoring, allowing them to compromise sensitive healthcare data. The repercussions were serious: DaVita's stock value plunged over 14%, substantial regulatory fines are expected, and the company's reputation took a significant hit.

AZURE AD CLIENT SECRET LEAK: THE KEYS TO CLOUD

Exposing Azure AD credentials in public configuration files (like appsettings.json) gives attackers direct access to cloud resources because with these secrets, attackers can impersonate trusted apps, exfiltrate data, escalate privileges, and persist within an organization. Leaks occur due to misconfiguration, poor secrets management, and insufficient security checks. To prevent this, restrict access, move secrets out of code, rotate exposed keys immediately, use least privilege, and monitor for misuse to prevent severe breaches.

actually matters. Get the report

SUDOMY

Sudomy is a subdomain enumeration tool that collects subdomains and analyzes domains, performing advanced automated reconnaissance (framework). This tool can also be used for OSINT (Open-source intelligence) activities.

MSSQLHOUND

MSSQLHound is a PowerShell collector for adding MSSQL attack paths to BloodHound with OpenGraph.

DETECTION ENGINEERING FRAMEWORK

The Detection Engineering Framework is a comprehensive framework for SOC use case development, detection engineering, implementation, and management.

PROLIFIC RUSSIAN RANSOMWARE OPERATOR LIVING IN CALIFORNIA ENJOYS RARE LENIENCY AWAITING TRIAL

Russian national Ianis Antropenko, arrested for deploying Zeppelin ransomware against 138 U.S. victims, including critical infrastructure, from 2018 to 2022, remains free on bail in California despite multiple parole violations and $2.8M in seized cryptocurrency—a rare leniency that security experts suggest may indicate cooperation with authorities. His poor operational security, including using personal PayPal accounts linked to ransomware operations and storing cryptocurrency seed phrases in iCloud, enabled FBI investigators to trace over 101 Bitcoins through the seized ChipMixer service and build their case. The case highlights the evolving challenge of prosecuting cybercriminals operating from within U.S. borders, with Antropenko's lenient pretrial conditions (including no ban on internet use) contrasting sharply with the typical detention of ransomware suspects, raising questions about potential cooperation agreements or intelligence value.

INLINE STYLE EXFILTRATION: LEAKING DATA WITH CHAINED CSS CONDITIONALS

Attackers can now use only inline CSS styles—with the help of chained if statements—to steal sensitive data like user IDs directly from web pages, all without external files or selectors. This creative trick works on Chromium browsers and highlights how inline CSS itself can be a security threat if user-controlled content isn't locked down properly.

FIRE ANT: A DEEP-DIVE INTO HYPERVISOR-LEVEL ESPIONAGE

Cybersecurity firm Sygnia has been tracking a campaign targeting VMware ESXi, vCenter, and network appliances to compromise environments. The attackers compromise the hypervisor by exploiting CVE-2023-34048 to obtain code execution and install an HTTP backdoor on the hypervisors. The attackers then used PowerCLI commands to compromise guests without guest credentials and also ran unregistered VMs with the VMware CLI to bypass registration in vCenter.

GMAIL'S PROTECTIONS ARE STRONG AND EFFECTIVE, AND CLAIMS OF A MAJOR GMAIL SECURITY WARNING ARE FALSE.

Google has refuted recent inaccurate claims about a major Gmail security issue, reaffirming that its protections block over 99.9% of phishing and malware attempts while recommending users adopt passkeys and follow phishing prevention best practices.

GOOGLE FIXES ACTIVELY EXPLOITED ANDROID FLAWS IN SEPTEMBER UPDATE

Google's September Android security update patches 84 vulnerabilities, including two actively exploited zero-day privilege escalation flaws (CVE-2025-38352 in the kernel and CVE-2025-48543 in Android Runtime) under limited targeted exploitation, plus four critical RCE vulnerabilities affecting System and Qualcomm components.

CISA, NSA, AND 19 INTERNATIONAL PARTNERS RELEASE SHARED VISION OF SOFTWARE BILL OF MATERIALS FOR CYBERSECURITY GUIDE

CISA, NSA, and partners release a vision document to promote global Software Bill of Materials (SBOM) adoption to improve software transparency and mitigate supply chain risks through standardized practices.

Download the guide for free →

OK BOOMER, WHAT'S NEXT? RETHINKING GENERATIONAL MARKETING MYTHS

Generational marketing based on birth-year labels is oversimplified. Instead, focus on factors like life stage, identity, fandoms, microcultures, and behavioral mindsets to understand real consumer motivations. Segmentation works best when it blends cultural nuance, data, and psychographics rather than relying on clichés. Generational cohorts can provide context, but shouldn't be the main lens. Marketing today requires interest-driven and culturally attuned approaches to reflect how people actually live.

WHAT AI MARKETING JOBS LOOK LIKE TODAY

AI has become a central part of marketing jobs, with many listings now requiring AI skills or experience. About 75% of workers report using AI because it is officially or unofficially expected, yet 95% of genAI programs at work are failing. New roles such as AI marketing program managers at large companies like Stripe pay up to $210,000, while startups like Firecrawl are experimenting with fully AI-driven agent roles offering $5,000 monthly retainers. The future of marketing jobs is splitting into three paths: fully AI-focused roles, traditional roles adapted with AI expectations, and fully AI agents replacing human work, leaving nearly 60% of marketers worried about job replacement.

WIN REPORT: REMEMBER ME? HOW SAVED SESSIONS BOOSTED CONVERSIONS BY 16%

A travel booking platform tested a “welcome back” prompt that reminded users of the last experience they viewed. The prompt helped visitors continue their browsing without restarting, which addressed a major friction point in vacation planning. The test showed a 16% increase in conversions among returning visitors. The results highlight the importance of continuity in multi-session decision-making.

FROM QUERY TO CITATION: HOW SNIPPET SIGNALS INFLUENCE AI SEARCH

AI search engines reward content that aligns with user intent and search language. Informational queries need precision, with 70% of cited pages matching at least 60% of query terms and over 60% using phrases like “how to” or “what is.” Commercial queries favor breadth, with 25% of titles using synonyms and 90% having under 30% word overlap. To improve visibility, match titles and slugs to user intent, keep phrasing clear for informational searches, and use synonyms and related terms for commercial ones.

HOW TO RUN GMAIL ADS IN 2025

Google has reintroduced Gmail Ads through Demand Gen campaigns, allowing advertisers to run campaigns exclusively in Gmail. Gmail Ads can appear as single image, carousel, video, or product feed ads, and they show in the Promotions or Social tabs with a teaser ad that expands into a full ad when clicked. Targeting options include demographics, in-market segments, custom segments, lookalikes, and retargeting, though content targeting is not available. Success is measured through engagement rate, click-through rate, and conversion rate, with strategies varying depending on whether the audience is warm or cold.

CUSTOM GPT TIP

Use “input flows” when building custom GPTs to improve output quality. Instead of giving one big prompt, break the task into a series of structured questions, each with predefined answer options. For example, when creating a content marketing GPT, ask about audience familiarity, topic, primary audience, and key messages step by step. This approach mimics a human interviewer, ensuring the GPT receives a clear, detailed brief so it can deliver better results.

LISTEN LATER

Listen Later converts written content, such as articles, blog posts, PDFs, newsletters, and email text, into audio podcast episodes. The service cleans up the content, removes ads, converts it to audio, and delivers it to a private podcast feed that works in any standard podcast app for listening on the go.

HUBSPOT UNVEILS LOOP MARKETING STRATEGY TO ADDRESS AI DISRUPTION

60% of searches now end on platforms like Google or ChatGPT. HubSpot launched “the Loop” to address shrinking website traffic and evolving customer journeys. The framework consists of four stages (Express, Tailor, Amplify, and Evolve) that accelerate campaign launches, improve personalization, and boost performance through AI-assisted iteration.

WILL GOOGLE'S ANTITRUST SEARCH RULING IMPACT MARKETING SEO STRATEGIES?

Google will be required to share parts of its search index and user-interaction data with qualified competitors, including AI platforms such as ChatGPT and Perplexity, marking a major regulatory milestone in the search market. While immediate effects on rankings may be limited because core algorithms and advertising data remain under Google's control, the decision signals a longer-term shift toward a more fragmented search ecosystem as Google's market share drops below 90% and AI-driven assistants gain momentum. For marketers, this creates a future where visibility will depend on building authority, securing placement across multiple discovery platforms, and optimizing for both search engines and AI assistants.

MOST MARKETERS ARE FRAUDS

Every marketer should do a rotation in customer support before touching a campaign.

DON'T SHIP A PRODUCT WITHOUT A BETA

Don't launch a product or a campaign without first running an alpha or beta test.

A DEMO OF VEED FABRIC 1.0

Sections in the video marked with “Generated with VEED Fabric 1.0” are AI-generated, making it easy to distinguish human from AI parts.

PROMISES FROM THE GROUND UP

Promises in JavaScript aren't always intuitive to use, but they're required to be productive with JavaScript. Promises are needed because JavaScript is single-threaded, which can cause issues when blocking operations like window.prompt() are used. This post dives into the mechanics of Promises, their states (pending, fulfilled, and rejected), and how to work with them using the .then() and .catch() methods. It also covers creating custom Promises, chaining them together, passing data between them, and the modern async/await syntax for a more synchronous-like experience.

HOW RUBYGEMS.ORG PROTECTS OUR COMMUNITY'S CRITICAL OSS INFRASTRUCTURE

RubyGems.org uses a multi-layered security approach including automated detection, risk scoring, and retroactive scanning to proactively identify malicious gems, successfully detecting 70-80% of threats before they're publicly reported. In a recent incident involving credential-stealing gems discovered by Socket.dev, the RubyGems security team had already flagged and removed nearly all malicious packages within days of detection in July.

SAY BYE WITH JAVASCRIPT BEACON

The JavaScript Beacon API provides a reliable way to send data to servers when users leave a website. This is unlike traditional methods like XMLHttpRequest or fetch in “beforeunload” events, which often fail because browsers don't wait for JavaScript execution when navigating away. The Beacon API works as a "fire-and-forget" mechanism with a simple syntax (`navigator.sendBeacon()`), allowing the browser to send the request immediately without waiting for a response, though it's limited to small amounts of data and only supports POST requests.

HOW TO GIVE A GOOD TALK

Good talks should inform the audience about the work's value, educate them with portable insights, and entertain them to hold their attention. It's important to understand the audience's shared values and frame the work in terms of efficiency and correctness.

THE BITTER LESSON IS MISUNDERSTOOD

The Bitter Lesson has been misinterpreted as prioritizing computation above all else. Scaling laws show that data is equally, if not more, crucial, as compute power is wasted without sufficient data. AI progress now depends on either finding ways to wring more value from existing data through improved model architectures or creating entirely new data through innovative "alchemical" methods like self-play.

HOW MUCH SHOULD YOU SPEND ON ACCESSIBILITY?

Digital accessibility should be treated as a core compliance investment. Companies generally spend 3-10% of annual revenue on compliance overall, making accessibility investments range from 0.1-0.5% of total revenue for most organizations. The cost of non-compliance is nearly three times higher than compliance costs, making proactive accessibility investment both a legal necessity and a good opportunity to reach over 1 billion people with disabilities worldwide.

Download the report ⬇️

CLAUDE CODE: NOW IN BETA IN ZED

Zed has released a beta version of Claude Code integrated directly into the Zed editor via the new Agent Client Protocol (ACP). This allows developers to use Claude Code's features like real-time code editing and custom workflows within the Zed environment. ACP is an open standard designed to allow any AI agent to connect with Zed and other compatible editors.

AGENTSCOPE

AgentScope is a framework for building LLM apps with a focus on agent-oriented programming. It prioritizes transparency, real-time steering, agentic features like tool management and long-term memory, and model agnostic design. The framework offers modules for models, tools, MCP (Model Context Protocol), agents, tracing, memory, evaluation, and formatting, all highly customizable and modular.

REGEXP EQUIVALENCE CHECKER

This tool checks the equivalence of two JavaScript regular expressions (excluding global, local, unicode, backreferences, lookbehind, and word boundary syntax), showing if they match the exact same strings or providing example strings that demonstrate their differences.

AUTOLINKING'S BROKEN PROMISE

Dependency management is complex in Expo and React Native apps, partly due to the "broken promise" of autolinking to simplify native module dependencies. Expo SDK 54 has several fixes, including direct Metro dependencies, removing implicit dependencies, consistent autolinking, and a CLI fallback resolver, to address these challenges and support various package managers and monorepos. The updated autolinking system now discovers transitive dependencies, allowing `expo-doctor` to proactively report duplicate modules and potential conflicts for developers to resolve.

MIT STUDY FINDS ARTIFICIAL INTELLIGENCE USE REPROGRAMS THE BRAIN, LEADING TO COGNITIVE DECLINE

A recent MIT study investigated the cognitive effects of using ChatGPT for essay writing. The study found that students who relied on ChatGPT experienced weakened brain connectivity, impaired memory recall, and a diminished sense of authorship. EEG scans revealed decreased neural activity, especially in areas related to attention and visual processing.

FOR ALL THAT'S HOLY, CAN YOU JUST LEVERAGE THE WEB, PLEASE?

This dev went through a convoluted and frustrating offline customer service process for registering a washing machine warranty, contrasting it with the efficient and modern online option of uploading a photo for AI-powered product number extraction.

101 REAL-WORLD GEN AI USE CASES WITH TECHNICAL BLUEPRINTS

Google Cloud shows 101 architectural blueprints with corresponding tech stacks to help developers and business leaders implement generative AI across 10 major industries.

TUFTE CSS

Tufte CSS provides a CSS framework to style web articles with a focus on simplicity, sidenotes, tight integration of graphics, and careful typography.