Search the archive

yourself.

LUMEN

LUMEN is a browser-based Windows Event Log analyzer built with React and WebAssembly that processes EVTX files entirely client-side without uploading logs to external servers. It supports files up to 500MB with both binary EVTX and XML exports. The tool features a curated SIGMA detection engine with platform-specific rule loading, automated event correlation that chains related activities into investigative storylines, IOC extraction with optional VirusTotal integration, and AI-powered analysis. Security teams can perform guided investigations while maintaining complete data privacy through local-only processing with session persistence via localStorage and no telemetry or data transmission.

PROXIMITY

Proximity scans MCP servers to discover tools, prompts, and resources. It provides a detailed analysis of server capabilities and optional security evaluation using NOVA rules.

GMSGADGET (WEBAPP)

Give Me a Security Gadget (GMSGadget) is a collection of JavaScript gadgets that can be used to bypass XSS mitigations like Content Security Policy (CSP) and HTML sanitizers like DOMPurify.

HASHJACK ATTACK USES URL '#' TO CONTROL AI BROWSER BEHAVIOR

HashJack is a novel indirect prompt injection technique that embeds malicious commands in URL fragments (after the # symbol) to manipulate AI browser assistants such as Google Gemini, Microsoft Copilot, and Perplexity Comet. The attack takes advantage of AI assistants' handling of full URLs, letting threat actors weaponize legitimate websites without compromising them and execute malicious instructions that bypass traditional security controls, enabling credential theft, data exfiltration, and more. Microsoft and Perplexity updated their products by October-November, but Google considered the Gemini vulnerability as expected behavior and chose not to fix it, leaving users vulnerable to this emerging AI security threat.

BRIT TELCO BRSK CONFIRMS BREACH AS BIDDING BEGINS FOR 230K+ CUSTOMER RECORDS

Brsk, a UK broadband provider, is investigating a cyberattack after criminals advertised more than 230,000 customer records for sale, allegedly including contact details, installation data, location information, phone numbers, and flags for vulnerable customers. It says only basic contact data was accessed. No passwords or payment details were taken. The company is offering affected users 12 months of credit monitoring while regulators and law enforcement investigate.

LEGACY PYTHON BOOTSTRAP SCRIPTS CREATE DOMAIN-TAKEOVER RISK IN MULTIPLE PYPI PACKAGES

Old Python bootstrap scripts in several PyPI packages still reference a long-abandoned domain used to fetch an installer for the legacy Distribute fork of Setuptools. The domain is now for sale. An attacker could buy it and serve malicious code to anyone running those scripts, exposing developers to supply-chain compromise and potential remote takeover via additional malware, such as RATs.

now to get your 3 FREE INFOSEC SKILLS SEATS.

PRESSURE RISING: EUROPEAN PARLIAMENT URGES TO BAN SOCIAL MEDIA FOR UNDER-16S

The European Parliament proposed a non-binding resolution for a harmonized EU minimum age of 16 for social media.

INFOSEC BLACK FRIDAY AND CYBER MONDAY DEALS

A collection of deals on InfoSec training, tools, gear, and more for Black Friday and Cyber Monday.

FRENCH SOCCER FEDERATION HIT BY CYBERATTACK, MEMBER DATA STOLEN

A cyberattack on the French soccer federation compromised the software used by clubs to manage registered members.

Use code ZTWTLDR26 for $200 off your all-access pass

OPENAI API USER DATA EXPOSED IN MIXPANEL BREACH, CHATGPT UNAFFECTED

A breach of Mixpanel's analytics platform exposed OpenAI API user metadata, including names, emails, location data, internal user/org IDs, and browser information. No passwords, API keys, chat logs, or payment data were compromised, and ChatGPT users were unaffected. OpenAI immediately removed Mixpanel from production and notified impacted users. It is conducting a broader vendor security audit. This incident highlights third-party vendor risk. Organizations should inventory analytics tools that receive user data, enforce data minimization policies with vendors, have API users enable MFA, and monitor for targeted phishing using the exposed metadata.

ASAHI SAYS CROOKS STOLE DATA OF APPROXIMATELY 2M CUSTOMERS AND EMPLOYEES

Ransomware operators hit the Asahi Group in late September, crippling Japanese operations and exposing data on around 2 million people, including customers, employees, and their families. Personal information such as names, addresses, phone numbers, emails, birth dates, and gender was accessed, but no credit card data was involved.

GAINSIGHT CEO DOWNPLAYS IMPACT OF ATTACK THAT SPREAD TO SALESFORCE ENVIRONMENTS

Gainsight is investigating a breach involving its Salesforce-connected app, working with Mandiant and relying heavily on Salesforce logs to understand which customers were affected and how attackers used compromised OAuth tokens. The company insists that only a small number of customers saw data impact. Google Threat Intelligence has flagged hundreds of potentially affected Salesforce instances.

THREAT HUNTING VS. THREAT INTELLIGENCE

Threat intelligence focuses on understanding the external threat landscape, while threat hunting proactively investigates internal systems for threats that have evaded automated defenses through hypothesis-driven analysis and behavioral anomaly detection. The two functions create a feedback loop: intelligence provides IOCs, TTPs, and focus areas to guide hunting hypotheses, while hunting discoveries enrich intelligence with validated internal findings. Security teams should integrate both by using threat intelligence to prioritize hunting efforts via MITRE ATT&CK TTP mapping, embedding intelligence feeds into SIEM/EDR for automated IOC correlation, and establishing workflows that link hunting results to strategic and tactical intelligence products.

THE MINEFIELD BETWEEN SYNTAXES: EXPLOITING SYNTAX CONFUSIONS IN THE WILD

Syntax confusion arises when different components, such as browsers, proxies, frameworks, or libraries, parse the same input in conflicting ways, letting attackers bypass filters or change behaviour. By abusing alternate syntaxes, an attacker can slip dangerous characters or paths past validation and turn limited issues like SSRF or cache quirks into powerful primitives such as stored XSS or arbitrary file access.

discovered to date. Start your test.

DEVOPS PIPELINE ATTACK SURFACE (WEBAPP)

A fully searchable, client-side guide to 88+ tools across 15 categories for pentesters and red teamers.

GODEFENDER

GoDefender is a Go-based security toolkit that detects and defends against debugging, virtualization, and DLL injection attacks to hinder reverse engineering efforts. It provides virtualization detection, anti-debugging via API monitoring and critical function patching, and DLL injection prevention using Binary Image Signature Mitigation Policy to block non-Microsoft binaries.

INFIISCAL

Infisical is an open-source secrets management platform that features a dashboard, client SDKs for fetching secrets, an API, and integrations with several platforms, like Kubernetes and Terraform.

INSIDE THE GITHUB INFRASTRUCTURE POWERING NORTH KOREA'S CONTAGIOUS INTERVIEW NPM ATTACKS

Socket Threat Research exposed North Korea's Contagious Interview operation, which added 197 malicious npm packages since October, using a GitHub-Vercel-npm delivery chain to distribute OtterCookie malware targeting blockchain and Web3 developers through fake job interviews. The malware performs comprehensive data theft. Security teams should treat npm installs as remote code execution, implement network egress controls on CI/CD systems, require code review for GitHub templates, and deploy real-time package scanning to detect behaviors like import-time loaders and eval on network responses before malware executes.

REPORT NAMES TEEN IN SCATTERED LAPSUS$ HUNTERS, GROUP DENIES

A 15-year-old in Jordan known as "Rey" was allegedly identified as a key administrator of Scattered LAPSUS$ Hunters after operational security failures. The group, which merged tactics from Scattered Spider, LAPSUS$, and ShinyHunters, conducted high-impact attacks against Jaguar Land Rover, Schneider Electric, Telefonica, and other major organizations using stolen Salesforce data, insider recruitment, and ALPHV/BlackCat ransomware variants. The group vigorously denied the allegations in a detailed Telegram response, offering 10 BTC to anyone who could prove Rey's identity with evidence. Rey himself claims he's been cooperating with law enforcement since June and is attempting to exit the cybercrime community.

SCOTTISH COUNCIL STILL REBUILDING SYSTEMS TWO YEARS AFTER RANSOMWARE ATTACK

A 2023 ransomware attack on Comhairle nan Eilean Siar forced the Western Isles council to rebuild multiple core systems, leaving some finance and revenue platforms still not fully restored two years later. The incident has cost around £950,000, created large data gaps and backlogs, and left staff under intense, prolonged pressure.

MICROSOFT TEAMS' GUEST CHAT FEATURE EXPOSES CROSS-TENANT BLIND SPOT

Microsoft Teams' cross-tenant guest chat feature (MC1182004) bypasses all Defender for Office 365 protections when users accept external tenant invitations.

MICROSOFT TO SECURE ENTRA ID SIGN-INS FROM SCRIPT INJECTION ATTACKS

Microsoft will implement a strengthened Content Security Policy for Entra ID by October 2026 that blocks external script injection and cross-site scripting attacks.

FAKE LINKEDIN JOBS TRICK MAC USERS INTO DOWNLOADING FLEXIBLE FERRET MALWARE

The Contagious Interview campaign targets Mac users through fake LinkedIn job postings that lure victims to fraudulent assessment websites.

RANSOMWARE ATTACK DISRUPTS LOCAL EMERGENCY ALERT SYSTEM ACROSS US

A ransomware attack hit the OnSolve CodeRED emergency alert system, affecting local agencies nationwide in the US and leading to a data breach. Hackers accessed user data and encrypted systems, causing some areas to lose emergency notification capabilities. Crisis24, a platform provider, is transitioning agencies to a new system and has advised users to change reused passwords.

HARVARD UNIVERSITY REVEALS DATA BREACH HITTING ALUMNI AND DONORS

Harvard University suffered a data breach after a voice phishing attack compromised its Alumni Affairs and Development systems. Personal data like addresses, emails, and phone numbers of alumni, donors, and students were exposed, though financial details and passwords were not affected. Harvard is working with law enforcement. It has warned affected individuals to watch out for phishing attempts.

CHROME EXTENSION CAUGHT INJECTING HIDDEN SOLANA TRANSFER FEES INTO RAYDIUM SWAPS

A malicious Chrome extension called "Crypto Copilot" (still available, with 12 installs) silently injects hidden SystemProgram.transfer instructions into Raydium DEX swaps, siphoning 0.0013 SOL minimum or 0.05% of trades over 2.6 SOL to a hardcoded attacker wallet before users sign transactions. The extension uses obfuscation via minification and variable renaming, communicates with a fake backend at crypto-coplilot-dashboard.vercel[.]app, and leverages legitimate services like DexScreener and Helius RPC to appear trustworthy while bypassing Chrome Web Store review. Crypto users should audit all transaction instructions before signing and avoid installing browser extensions that request wallet access. Security teams should monitor for wallet-draining extensions targeting DeFi platforms.

A COMPLETE GUIDE TO TRANSPORT LAYER SECURITY (TLS) AUTHENTICATION

This comprehensive guide covers TLS authentication fundamentals, including the handshake process, certificate validation chain, and the distinction between server-only authentication and mutual TLS (mTLS) for high-security environments. Key recommendations include enforcing TLS 1.3 (or 1.2 minimum), using forward secrecy cipher suites with ECDHE, storing private keys in HSMs/KMS, and automating certificate lifecycle management via the ACME protocol. For modern architectures, the article emphasizes layering TLS with OAuth 2.0/OIDC for combined machine and user authentication and leveraging service meshes such as Istio for automated mTLS across microservices.

DESKTOP APPLICATION SECURITY STANDARD: INTRODUCING DASVS

The Desktop Application Security Verification Standard (DASVS) is a comprehensive framework for addressing the unique security challenges of desktop applications across Windows, macOS, and Linux. Unlike web or mobile apps, desktop applications operate with significant system access, which demands specialized security controls. DASVS aims to provide clear, actionable verification rules and is being extended with guides and automated assessment tools to help organizations strengthen desktop application protection.

ANDROID QUICK SHARE SUPPORT FOR AIRDROP: A SECURE APPROACH TO CROSS-PLATFORM FILE SHARING

Google enabled Quick Share interoperability with AirDrop starting with Pixel 10, using Rust for the core communication layer to eliminate memory-safety vulnerabilities in wireless protocol data parsing—a historically common attack surface. The implementation uses direct peer-to-peer connections without server routing. It underwent internal threat modeling plus independent penetration testing by NetSPI, and was validated as "notably stronger" than other industry implementations with no information leakage. For cross-platform development, Rust's compile-time memory safety guarantees make it ideal for parsing untrusted data from external sources, and Google's approach demonstrates how memory-safe languages can secure interoperability layers between disparate platforms without sacrificing performance.

MALEFICENTVM

A practice VM designed for learning malware development through CTF-style challenges. Exercises include OS enumeration, shellcode injection into target processes, and IAT hooking techniques.

VIJIL (PRODUCT LAUNCH)

Vijil helps organizations develop secure, reliable AI agents by providing a platform for testing, hardening, and monitoring agents against risks such as prompt injection. It offers modular agent templates, compliance, and runtime protection for confidential deployments.

XSSRECON

XSSRecon is a powerful tool designed to help security researchers and penetration testers identify reflected XSS vulnerabilities in web applications. It automates testing URL parameters for the reflection of a test payload and further checks how special characters are handled.

FBI: CYBERCRIMINALS STOLE $262M BY IMPERSONATING BANK SUPPORT TEAMS

The FBI reported over 5,100 account takeover complaints since January, with attackers impersonating bank staff via calls, texts, and emails to harvest credentials and MFA/OTP codes, then wiring funds to cryptocurrency wallets. Attackers employed SEO poisoning to push phishing sites mimicking financial institutions to the top of search results. Some used dual-impersonation tactics to claim fraudulent transactions and direct victims to fake law enforcement. Defenders should train users to access banking sites via bookmarks rather than search results, and organizations should monitor for brand impersonation in search ads.

LIFETIME ACCESS TO AI-FOR-EVIL WORMGPT 4 COSTS JUST $220

Malicious AI tools like WormGPT 4 and the free KawaiiGPT are making it easier for cybercriminals to generate malware and phishing messages and to automate parts of attacks. While the code requires some human adjustment to evade detection, these "Dark LLMs" significantly lower the barriers to entry for cyberattacks and social engineering.

CISA: SPYWARE AND RATS USED TO TARGET WHATSAPP AND SIGNAL USERS

Threat actors are using commercial spyware and remote access trojans to target WhatsApp and Signal users. Attacks involve phishing, malicious QR codes, and impersonated apps. They are focusing on high-value individuals worldwide.

TOR SWITCHES TO NEW COUNTER GALOIS ONION RELAY ENCRYPTION ALGORITHM

Tor has replaced its old encryption algorithm with a new, stronger one called Counter Galois Onion (CGO) to improve user security and privacy.

MULTIPLE LONDON COUNCILS REPORT DISRUPTION AMID ONGOING CYBERATTACK

A cyberattack has forced three London councils, Kensington and Chelsea, Westminster, and Hammersmith & Fulham, to shut down networks and activate emergency plans.

POPULAR FORGE LIBRARY GETS FIX FOR SIGNATURE VERIFICATION BYPASS FLAW

CVE-2025-12816 is a high-severity ASN.1 validation flaw in node-forge versions 1.3.1 and earlier (26M weekly NPM downloads) that allows attackers to craft malformed data.

See the full breakdown →

Ready to see why Bitwarden continues to lead the G2 reports for 11 consecutive quarters? Start a free trial of Bitwarden for your

business

FAKE PRETTIER EXTENSION ON VSCODE MARKETPLACE DROPPED ANIVIA STEALER

Checkmarx Zero identified and removed a malicious VSCode extension, "prettier-vscode-plus," within 4 hours of publication, limiting the impact to 6 downloads and 3 installs before removal. The brandjacking attack deployed Anivia Stealer (likely rebranded ZeroTrace, sold as MaaS for €120/month) using fileless execution from memory and sandbox evasion techniques to steal Windows credentials, data, and WhatsApp chats. Security teams should implement extension vetting controls and monitor developer tool installations, as supply chain attacks targeting IDEs increasingly aim to compromise source code and credentials.