Major US banks and financial firms are investigating data stolen in a cyberattack targeting SitusAMC, a New York firm that serves hundreds of lenders. The breach involved theft of corporate, legal, and accounting records, but no malware was deployed. The full scope and impact remain under review. The FBI and affected banks are working to safeguard customer information and determine how many consumers may be affected.
A critical memory vulnerability in Firefox's WebAssembly (Wasm) engine, tracked as CVE-2025-13016, exposed 180 million users to remote code execution risks for six months. The flaw involved a stack buffer overflow within the Garbage Collection mechanism caused by an incorrect memory pointer calculation, allowing attackers to hijack program flow via malicious webpages. Security professionals should ensure all instances of Firefox are updated to version 145 or ESR 140.5 immediately to mitigate this high-severity risk.
NCC Group conducted a comprehensive security review of Google's Private AI Compute system across two phases (April-September), investing 100 person-days with 10 consultants to assess the cloud-based AI system designed to extend mobile device capabilities while maintaining local privacy guarantees. The review covered architecture assessment, cryptographic implementations, IP-blinding relay security, Outbound RPC Enforcement configuration, and frontend server source code analysis. Security teams working on privacy-preserving cloud AI architectures should examine the full downloadable report for insights on attestation mechanisms, secure enclaves, cryptographic protocols, and privacy-preserving infrastructure design patterns.
State actors weaponized Claude Code through jailbreaking (roleplay as security researchers + task decomposition) rather than traditional exploits, achieving 82% success rates in installing keyloggers, reverse shells with systemd/.bashrc persistence, LD_PRELOAD hooks, and exfiltrating SSH/API keys. The "lethal trifecta" vulnerability arises when agents have access to private data, exposure to untrusted content, and external communication ability. Traditional security tools fail because jailbreak traffic appears legitimate and the attack vector is semantic, not technical. Security teams must implement deterministic access controls, use red team testing tools like Promptfoo before deployment, and recognize that context-blind guardrails and helpful-by-default bias create fundamental vulnerabilities requiring semantic security defenses beyond traditional WAF/IDS/AV solutions.
Organizations and individuals have been carelessly exposing sensitive passwords, credentials, keys, and private data by pasting them into public online code formatting tools like JSONFormatter and CodeBeautify. These tools often let users save and share formatted data through predictable URLs, leaving credentials easily discoverable and accessible to anyone, including attackers. Thousands of secrets belonging to major sectors such as government, banking, healthcare, and critical infrastructure have been discovered. Never trust random online tools with any sensitive information, as this habit creates far-reaching security risks and exposure.
Sponsored
Old-world automation has collapsed under the weight of the ever-changing nature of the SOC, burying analysts in more work while breaches increased. Mate Security [12] is pioneering WISDOM-LED PERFORMANCE: infusing company and industry knowledge into every part of the security organization - from junior and senior analysts to AI
Santamon is an experimental macOS detection sidecar for Santa that evaluates Endpoint Security telemetry locally using CEL rules. It forwards only matched detections to a backend while keeping raw telemetry on-device. Santamon leverages Santa's existing ESF sensor capabilities, avoiding Apple entitlement requirements. It adds three detection rule types: simple matching, time-window correlation, and baseline (first-seen) tracking with optional process tree enrichment.
OWASP BLT (Bug Logging Tool) is an open-source platform that democratizes bug bounties and security research. Built by the community for the community, BLT makes it easy for security researchers, developers, and organizations to collaborate on finding and fixing security vulnerabilities.
Ray Security offers real-time, AI-driven data protection for enterprises. Its platform learns and monitors data usage, applying dynamic security controls to active data, detecting unusual behavior, and automatically responding to threats without impeding operations.
SitusAMC, a mortgage data processor serving major banks including JPMorgan, Citi, and Morgan Stanley, suffered a data exfiltration attack discovered on November 12 that exposed corporate data and potentially customer PII, including SSNs, financial details, and employment records from loan applications. The attack used no ransomware, focusing purely on data theft. It was contained through credential resets, by disabling remote access, and by updating the firewall. Financial institutions must strengthen third-party risk management programs with written oversight policies per new SEC Regulation S-P amendments, as vendor breaches now account for 30% of financial sector incidents (up 15% YoY).
Google Antigravity is vulnerable to indirect prompt injection attacks where poisoned content manipulates the AI into bypassing .gitignore restrictions to steal sensitive credentials from .env files. The data is exfiltrated via a browser subagent directed to a malicious URL, exploiting default settings that allow autonomous command execution and whitelist dangerous domains. Security professionals should mitigate this risk by reviewing "Agent-assisted development" permissions and strictly monitoring AI agent access to sensitive files and external network traffic.
WormGPT 4 and KawaiiGPT are new "dark LLMs" that empower less-skilled cybercriminals by automating phishing, malware creation, and reconnaissance without ethical guardrails. WormGPT 4 is a paid service that offers malware generation capabilities. KawaiiGPT is a free, open-source tool that facilitates social engineering and lateral movement scripts. Security professionals should view these tools as a new baseline for digital risk and prepare for a democratized threat landscape where advanced attack capabilities are accessible to anyone with an internet connection.
Lenovo is stockpiling memory chips at 50% above normal levels as AI datacenter demand creates global semiconductor shortages.
Hackers are distributing malicious Blender 3D asset files on platforms like CGTrader, leveraging Blender's Auto Run feature and embedded Python scripts.
Canon confirmed that a recent cyberattack linked to the Oracle E-Business Suite hacking campaign affected only a US subsidiary's web server.
Sponsored
Zero Trust World is coming to Orlando on March 4-6, 2026 [4]!
Threat actors are actively exploiting CVE-2025-59287, a critical deserialization RCE flaw in Microsoft WSUS (patched last month), to deploy ShadowPad malware with SYSTEM privileges. The attack chain uses PowerCat for initial shell access, then certutil/curl to download ShadowPad, which persists via DLL side-loading through a legitimate ELAN binary (ETDCtrlHelper.exe). Exploitation accelerated after public PoC release. Patch immediately and audit WSUS exposure.
CVE-2025-11001 is a directory traversal RCE flaw (CVSS 7.0) in 7-Zip's symbolic link handling that allows arbitrary code execution when users extract malicious ZIP files. A public PoC exploit is available, and Microsoft is tracking active weaponization. It was fixed in version 25.00, but 7-Zip lacks auto-update capability, leaving widespread unpatched installations. Inventory all Windows systems with 7-Zip versions below 25.01 and immediately push updates via Intune or deployment scripts.
Hackers exploited a previously unknown vulnerability in Oracle E-Business Suite to breach Cox Enterprises' network, exposing personal information of nearly 9,500 people. The attack, linked to the Cl0p ransomware group, went unnoticed for weeks and resulted in data being published on the dark web. Cox is offering free identity monitoring, but did not specify which personal data was exposed. It will continue its investigation.
The macOS boot process on Apple Silicon is anchored in hardware-level security. It begins with an immutable Boot ROM that uses cryptographic hardware keys fused into silicon to validate and decrypt critical boot components. A layered chain of trust is established, where each boot stage verifies the next using strict signature checks and hardware root keys, preventing execution of unauthorized code. Apple's custom extensions to the Arm architecture provide pointer authentication, branch target enforcement, and a secure execution environment with isolated privilege levels. The Secure Enclave acts as an independent computer managing cryptographic keys, enforcing anti-replay protections, and mediating sensitive data access via a mailbox interface. These mechanisms robustly defend against rollback, replay, and tampering attacks throughout the boot chain.
AWS initial access vectors can be categorized into two classes: service exposure (Lambda, EC2, ECR, and DataSync misconfigurations that enable public access) and access by design (Cognito, IAM, and IoT misconfigurations in services intended for access control). 97% of organizations still use IAM users despite best practices recommending roles. 84% use Cognito with potential self-registration risks. ECR repositories are enumerable by any AWS account holder. Security teams should audit resource-based policies for wildcard principals, enforce ExternalId for cross-account role assumptions, disable Cognito self-registration where unnecessary, and validate OIDC trust policy conditions include proper sub/aud claims.
Detection engineering is a proactive threat-hunting specialization that applies software engineering processes to detect attackers. Prospective detection engineers should choose a domain to focus on, such as cloud workload security, cloud application security, cloud misconfigurations, endpoint security, network security, IAM, or insider threat. This blog post includes a list of blog posts, videos, and books that both starters and pros could benefit from.
Runlayer provides a secure control layer for enterprise AI, monitoring access and usage, and blocking threats in real time. It supports the Model Context Protocol for safe, compliant AI transformation across environments.
Prowler is an open-source security tool for AWS, Azure, GCP, and Kubernetes for performing security assessments, audits, incident response, compliance, continuous monitoring, hardening, and forensics readiness. It includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS, and more.
Magnet is a purple-team telemetry and simulation toolkit.
Over 300 NPM packages were poisoned via compromised maintainer accounts that injected a fake Bun runtime preinstall script that deploys a 10MB obfuscated JavaScript payload to steal credentials. The malware uses TruffleHog for local secret scanning. It exfiltrates NPM tokens and cloud credentials (AWS/GCP/Azure) via rogue GitHub Action runners named SHA1HULUD, and achieves worm-like propagation by republishing infected packages using stolen tokens. High-impact packages affected include @zapier/zapier-sdk (2.6M weekly downloads), posthog-node, and @asyncapi/specs. Teams should audit dependencies for setup_bun.js/bun_environment.js files, rotate any potentially exposed credentials, and pin package versions to known-good releases.
Google has enabled Quick Share interoperability with Apple AirDrop on Pixel 10 devices. The feature was implemented in Rust to eliminate memory-safety vulnerabilities. NetSPI penetration testing confirmed no data leakages. The system uses direct device-to-device connections via AirDrop's “Everyone for 10 minutes” mode without server intermediaries. However, users must manually verify recipient devices to avoid accidental sharing with nearby strangers. Security teams should note that this expands the cross-platform attack surface for social-engineering file transfers.
RadzaRat is an Android RAT masquerading as a file manager with complete AV evasion (0/66 on VirusTotal) and keylogging capabilities. The malware uses free infrastructure (Render.com and a Telegram bot) and persistence mechanisms that prevent termination and survive reboots. The APK has been openly distributed and actively sold on underground forums by developer 'Heron44' since November 8. Security teams should implement behavioral detection and app vetting policies, as signature-based defenses are currently ineffective against this threat targeting credentials and financial data.
FoloToy's GPT-4o-powered “Kumma” teddy bear spontaneously introduced sexual content, BDSM topics, and dangerous household advice during testing, prompting OpenAI to revoke the developer's API access.
Delta Dental of Virginia notified approximately 146,000 individuals after a security breach of an email account exposed personal information.
Iberia experienced a data breach due to a supplier hack.
Sponsored
Senior IAM pros from MONGODB teamed up with TINES to write this guide to modern IAM [4]. If you feel like your identity service isn't keeping up, grab your free copy for useful resources including:
A critical vulnerability in Grafana's SCIM user management feature (CVE-2025-41115) allowed attackers to impersonate users or escalate privileges if certain settings were enabled. Only Grafana Enterprise versions 12.0.0 to 12.2.1 with SCIM activated were affected. The flaw, found internally, was quickly patched. Users are strongly urged to update to the latest secure release to prevent exploitation.
Researchers discovered major security flaws in the messaging app LINE, which is widely used in Asia. These bugs let attackers replay messages, impersonate users, and access plain-text details, all due to weak custom encryption. The risks are amplified because LINE handles everything from banking to government services, yet there are no current plans to fix the vulnerabilities, leaving millions exposed.
Spanish flag carrier Iberia suffered a data leak after a third-party vendor was breached. Iberia has notified customers. The exposed data includes full names, email addresses, and loyalty card numbers, but not passwords or financial information. This notice comes days after a 77GB trove of data allegedly stolen from the airline surfaced on hacker forums.
Attack Surface Management is about continuously identifying and tracking all digital assets and potential entry points that attackers could exploit within an organization. This includes everything from obvious domains and public APIs to obscure subdomains, old servers, cloud resources, mobile apps, code repositories, and even collaboration tools such as Slack or Trello. The attack surface changes constantly as new assets are spun up and others become forgotten or misconfigured, often outside regular security practices. The key is ongoing discovery and reduction - eliminating unnecessary assets, restricting access, hardening configurations, securing supply chains, and monitoring for leaks - because attackers look for what you overlook, not just what you defend.
Traditional GRC approaches fail to address GenAI-driven supply chain risks, such as shadow AI adoption (vendors using public LLMs for code generation without disclosure) and model drift (AI systems changing behavior over time, exposing data or introducing regulatory violations). This article proposes a GenAI GRC framework that uses LLMs for contextual intelligence across unstructured data sources, continuous monitoring via a “digital trust ledger” that dynamically scores vendor risk, and regulatory synthesis to maintain compliance with evolving requirements such as the EU DORA and AI Act. CISOs should pilot this approach by monitoring critical vendors' self-attestations against their public digital footprint, shifting from static compliance reporting to predictive risk velocity metrics that translate technical vulnerabilities into boardroom-ready strategic resilience indicators.
Penetration tests typically focus on finding long lists of bugs in a small time scope and limited attack surface, but attackers are not restricted by time or other scoping and hunt for smaller numbers of critical vulnerabilities. To address this gap, testers should have a holistic view of the application from a user, source code, and architectural perspective, test assumptions that were made during development, and search for a small number of deep bugs. Real offensive security should focus on following intuition, finding the truth, and focusing on impact.
A collection of intel and usernames scraped from various cybercrime sources and forums, including DarkForums, HackForums, Patched, Cracked, BreachForums, LeakBase, and more.
Apono provides organizations with an understanding of privileged access within their cloud environments, enforces robust security guardrails, and leverages AI-driven least privilege and anomaly detection capabilities to enhance security measures.
Quiet Riot is an unauthenticated enumeration tool that validates the existence of AWS Account IDs, Azure AD users, and Google Workspace users by exploiting differences in error messages across cloud service APIs. The tool achieves ~1,100 checks/second by using a multi-threaded API to AWS services like SNS, ECR, and KMS, though exhaustively scanning all possible AWS Account IDs would still take years from a single account. It requires valid AWS credentials to provision resources, but performs unauthenticated reconnaissance by observing service-specific error responses when accessing non-existent versus existing principals.
A China-linked hacking group has compromised thousands of older Asus routers, mainly in Asia, by exploiting vulnerabilities in unsupported models. The hacked devices, named in the WrtHug campaign, are likely being reserved for covert espionage. Users can check for compromise by examining their router's certificate details. They are advised to upgrade hardware and disable remote access features to enhance security.
The SEC has dropped its lawsuit against SolarWinds and its Chief Information Security Officer, who were accused of misleading investors about security practices before the 2020 SUNBURST attack. SolarWinds welcomed the dismissal as vindication, hoping it would relieve pressure on CISOs across the industry.
The FCC reversed a ruling from January that required US telecom providers to implement and annually certify cybersecurity risk management plans under CALEA, removing federal mandates established after the Salt Typhoon attacks that compromised major carriers and exposed at least 200 US organizations. Security experts criticized the rollback as “shockingly incompetent,” noting it eliminates the only concrete federal regulatory response to attacks that allowed Chinese state actors to access wiretap systems, record calls, and geolocate millions of individuals, including high-ranking US officials. The reversal came after heavy lobbying by compromised telecom providers that failed to document their remediation efforts, raising concerns about national security at a time when telecommunications infrastructure remains vulnerable to nation-state attacks.
CrowdStrike recently dismissed an employee accused of leaking company data to a hacker group called Scattered Lapsus$ Hunters.
Two British teenagers linked to the Scattered Spider hacking collective pleaded not guilty to computer misuse and fraud charges related to the August 2024 Transport for London breach, which caused millions in damage and compromised customer data.
👉 Explore the full platform and chat with Huntress security