Zimperium researchers discovered over 760 malicious Android apps exploiting Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data through NFC relay attacks, showing dramatic growth since April 2024. These apps impersonate trusted financial institutions and trick users into setting them as default NFC payment handlers, then use command-and-control servers to relay card terminal requests and exfiltrate EMV data to Telegram channels. The campaign has targeted over 20 institutions globally using 70+ C2 servers, primarily focusing on Russian banks but also affecting European banks, Brazilian institutions, and services like Google Pay.
Public incident reports intentionally omit staff attrition as a contributing factor to reassure customers that issues are being resolved, since mentioning workforce issues could undermine confidence and create liability. Internal analyses also rarely consider attrition, focusing instead on technical details rather than organizational factors that increase system vulnerability. Attrition is like smoking and lung cancer - it's a risk factor that heightens the likelihood of failures without being necessary or sufficient on its own.
AWS and Atos developed a cloud-based digital identity platform using MOSIP, addressing security challenges with multi-layered defenses like AWS Shield, WAF, CloudFront, segmented VPCs, and dedicated CloudHSM. It offers four hybrid deployment models for data sovereignty, from fully cloud to on-premises, with security controls such as data encryption, role-based access via OAuth2, and monitoring through GuardDuty and CloudWatch. Security teams should evaluate hybrid cloud architectures for sensitive government systems, implement defense-in-depth with hardware security modules, and use Infrastructure-as-Code for consistent security controls.
Time-Terrain-Behavior (TTB) mapping can be used to transform logs and security events into a 3D landscape to create a visual threat landscape. The x-axis is set as the terrain layer and measures how many different tools detected an entity, the y-axis measures how many different time periods an entity was active in, and the z-axis measures how many different actions an entity performs. This post works through applying this methodology to the Splunk BOTS v2 scenario.
2025.11.04·
dispatch.thorcollective.com·10 min read·TLDR InfoSec
AI is transforming productivity—but it's also expanding the attack surface. Learn how to build a resilient endpoint strategy that supports on-device AI innovation without compromising data integrity. Develop and deploy AI models on a secure, modern foundation with the latest Dell and Intel AI PCs. Get the eBook: Endpoint Security for AI
In this post, a researcher demonstrates firmware reverse engineering on the Epomaker Galaxy100 keyboard using Ghidra to bypass VIA configuration limitations and modify key mappings. The technical approach involved extracting firmware via DFU mode (Fn+L+Esc), setting up proper memory mapping in Ghidra for ARM Cortex-M3 architecture, locating USB HID keycode tables through pattern matching, and directly patching binary offsets to swap function key layers. Security professionals can apply these techniques for embedded device analysis, firmware modification workflows, and understanding how consumer hardware implements bootloader protections and keycode handling mechanisms.
Reflectiz provides an agentless web exposure management platform that detects third-party tools and code risks, de-obfuscates suspicious JavaScript, and gives organizations centralized visibility and control over website activity and security compliance.
Chinese cyber-espionage group Bronze Butler (Tick) exploited CVE-2025-61932, a critical request origin verification flaw in Motex Lanscope Endpoint Manager versions 9.4.7.2 and earlier, as a zero-day vulnerability for several months before it was patched in October. The attackers exploited this vulnerability to achieve unauthenticated remote code execution with SYSTEM privileges, deploying an updated Gokcpdoor malware variant that features multiplexed command-and-control communication and DLL sideloading for evasion, along with tools such as goddi Active Directory dumper and 7-Zip for data exfiltration to cloud storage services. Organizations using Lanscope Endpoint Manager must immediately upgrade to patched versions, as no workarounds exist, while security teams should monitor for indicators of Bronze Butler activity, including Gokcpdoor malware, OAED Loader, and connections to ports 38000/38002.
Hackers breached the University of Pennsylvania's systems, aiming to sell roughly 1.2 million lines of personal donor data. Unlike previous university hacks tied to diversity debates, this attack focused on financial gain, not ideology. U Penn is investigating and has involved the FBI as affected individuals have confirmed their stolen data.
London's Metropolitan Police credits live facial recognition technology with enabling 962 arrests over the past year. While officials cite improved public safety and broad support, privacy advocates raise concerns about racial bias, noting 80 percent of false alerts involved Black individuals. The report claims these disparities are not statistically significant, yet critics argue for better oversight and legal safeguards to protect civil rights.
Tines commissioned Forrester to ask 400+ IT leaders about their biggest AI challenges. The results show where AI adoption stalls, why orchestration unlocks value, and how IT is primed to lead. Read the
Threat actors are collaborating with organized crime groups to deploy legitimate RMM tools like ScreenConnect and SimpleHelp through spear-phishing and fraudulent freight listings to gain network access at logistics companies, enabling them to manipulate dispatch systems and steal physical cargo shipments, primarily food and beverage products.
Ukrainian cybercriminal Yuriy Igorevich Rybtsov, known as "MrICQ," was extradited from Italy to face charges for developing the Jabber Zeus banking trojan, which used man-in-the-browser attacks and real-time one-time password interception to steal tens of millions from US businesses through payroll manipulation and money mule networks.
POLAND HIT BY ANOTHER MAJOR CYBERATTACK AS HACKERS STEAL USERS' DATA FROM LOAN PLATFORM
Polish authorities are investigating a large-scale cyberattack that compromised personal data belonging to clients of the SuperGrosz online loan platform. Poland's Deputy Prime Minister Gawkowski reported that the attackers stole names, national identification numbers, ID card details, email and home addresses, phone numbers, nationality, bank account numbers, and other sensitive personal information. Affected users are advised to exercise caution, change passwords, enable 2FA, and use the government's mobile app to block their national identification number.
Iru is the AI-powered platform used by the world's fastest-growing companies to secure their users, apps, and devices. With Iru, you can secure Mac, Windows, & Android, enable passwordless single sign-on to every app, and stay audit-ready for SOC 2 and ISO 27001. Iru collapses the stack and gives IT & Security time and control back.
Threat Fabric has detected a new Android malware-as-a-service (MaaS) dubbed Herodotus that is being used in campaigns targeting Italian and Brazilian users through smishing. The malware uses a novel randomized delay of 0.3 to 3 seconds when typing to mimic human typing and evade behavioral detections. Herodotus also provides clients with a control panel to customize the SMS message, as well as the ability to overlay pages mimicking banking and crypto pages to steal credentials, overlay opaque pages to hide malicious behavior, an SMS stealer for MFA interception, and screen recording.
This past Friday, students and alumni of the University of Pennsylvania received a series of offensive emails from various university email addresses stating that their data had been leaked. The university reported that its incident response team is addressing the issue, but hasn't released more specifics. The article includes a copy of the email, which appears to be politically motivated.
EY accidentally left a massive, unencrypted 4TB SQL Server backup file publicly accessible online, exposing sensitive data that included API keys, passwords, and credentials. The database became accessible due to a misconfigured cloud bucket. The breach's duration is unknown. EY responded swiftly after being alerted and resolved the issue within a week, likely preventing further damage.
Platforms that enable anyone to build applications without prior coding experience are surging in popularity, but they also introduce serious security concerns. Escape's research analyzed over 5,600 publicly available applications created with these “vibe coding” tools and found more than 2,000 vulnerabilities, along with hundreds of exposed secrets and personal data. Many issues arose from inexperienced users misconfiguring security, particularly when platforms automatically integrated third-party services, such as Supabase, without strict access controls.
Mandiant uses a three-pillar approach to privileged account monitoring (PAM). The prevention pillar focuses on identifying all identities that can change system state, alter security policy, or reach sensitive data and tiering them into a hierarchy of privileged access. The detection pillar focuses on distinguishing PAM-related detections from regular abuse. The response pillar focuses on ensuring that break-glass accounts work and customizing an incident response plan for privileged accounts.
Traditional EDR evasion methods, such as runtime packers and post-compilation obfuscation, are increasingly ineffective due to high-entropy signatures and recognizable patterns, prompting a shift toward compile-time obfuscation using the LLVM Intermediate Representation. This approach applies transformations like control flow flattening and API call hashing during compilation, rather than after. IRvana is a tool that leverages LLVM IR for fileless execution by using lli.exe to directly interpret obfuscated IR files directly. It achieves strong static detection bypass while acknowledging that dynamic behavioral detection remains challenging. Security teams should focus their detection efforts on behavioral analysis and process injection techniques, rather than relying solely on static signatures, as IR-based evasion makes traditional binary analysis significantly more challenging.
Used effectively, IP reputation can reduce noise, improve detection accuracy, and support zero trust initiatives. But its real value depends on how it's applied. Read Intrusion's guide [12] to learn how to wield it to your advantage – within context, in real time, and as
Aardvark is OpenAI's new autonomous security research agent. Now in private beta, it is designed to help developers and security teams find and fix vulnerabilities. It continuously scans code repositories, prioritizes risks, and proposes targeted patches using AI-powered reasoning.
Open-source and next-generation Web Application Firewall (WAF). Being a full-featured web server (based on NGINX under the hood), it will protect your web services to make them secure by default.
A tool from Cisco AI Defense that scans MCP servers and tools for potential findings using the Cisco AI Defense inspect API, YARA rules, and LLM-as-a-judge.
Australia's ASD reported that over 400 Cisco IOS XE devices have been compromised with BadCandy webshell malware since July, exploiting CVE-2023-20198, a critical vulnerability that allows remote attackers to create administrative accounts and deploy Lua-based webshells with root privileges. The webshell persists until the device is rebooted, but can be easily reintroduced on unpatched systems, allowing attackers to detect its removal and re-exploit the same endpoints. Organizations must immediately patch affected Cisco IOS XE devices and follow the vendor's hardening guidelines, as state-sponsored actors, including Salt Typhoon, continue to exploit this two-year-old vulnerability for persistent network access.
The Eclipse Foundation revoked a small number of leaked Open VSX tokens after Wiz discovered some Visual Studio Code extensions exposing access tokens in public repositories. The investigation showed that the leaks were due to developer mistakes, not a compromise. Eclipse has introduced new token formats, tightened security, improved revocation procedures, and is scanning for malicious patterns.
Organizations using Cisco or Citrix VPNs are nearly seven times more likely to experience a ransomware attack. This is due to the growing complexity of properly securing on-premises VPNs. SonicWall VPN users were the second most likely to be breached, with a 5.8 times increased rate of incidence.
Unused admin accounts. Mysterious firewall rules. Default Windows settings that weaken your defenses. ThreatLocker Defense Against Configurations (DAC) finds these problems and maps them to your
A protocol called Garden, which facilitates the swapping of bitcoin across blockchains, suffered a $11 million hack just days after announcing a major milestone.
Arm contributed its Foundation Chiplet System Architecture (FCSA) specification to the Open Compute Project, joined the OCP board alongside AMD and Nvidia, expanded its Total Design ecosystem from 20 to over 50 partners, and added its Armv9 Edge AI platform to its Flexible Access licensing program, enabling startups and smaller teams to prototype with production-grade IP at low or no upfront cost.
Researchers demonstrated a remote RF-based side-channel attack on Nordic Semiconductor's nRF52832 BLE chip, recovering 128-bit AES keys at one meter using 2.4 GHz radio frequency analysis, raising security concerns for automotive and industrial systems.
Poorly-managed passwords are the #1 cause of breaches, and they leave IT teams struggling with fragmented access management and manual onboarding/offboarding processes. Reddit was dealing with all these challenges, plus a compromised security vendor. They needed a solution that reduced credential risk without slowing down their employees.
TEE.Fail is a side-channel attack that targets DDR5 memory systems which uses a $1,000 interposition device to physically monitor memory traffic and extract cryptographic keys from Intel TDX/SGX and AMD SEV-SNP trusted execution environments. The attack exploits weaknesses in AES-XTS deterministic encryption used by both vendors, enabling attackers to record memory operations between CPU and DRAM, extract ECDSA attestation keys, and compromise confidential virtual machines by faking attestation processes. Both Intel and AMD have classified this as an out-of-scope physical attack with no planned mitigations, leaving software countermeasures as the only defense option despite their high implementation costs.
Ribbon Communications has suffered a breach with attackers accessing the IT network from December 2024. No sensitive data exfiltration has been confirmed. Some customer files outside the main network were accessed, but notifications have been sent. The company does not anticipate a major operational or financial impact.
Conduent has confirmed a cyberattack exposed sensitive data of up to 10 million people. The breach, attributed to the SafePay ransomware gang, lasted nearly three months and compromised data such as Social Security numbers and medical information. Impacted individuals are spread across several states.
Researchers developed a defensive use of prompt injection to combat Shadow AI risks by embedding hidden warnings in corporate documents that trigger alerts when users upload sensitive files to unapproved AI tools like ChatGPT or DeepSeek, successfully displaying disclaimers and, in some cases, blocking processing entirely. The team built an open-source prototype tool called "Prompt Injection for the Good" to test effectiveness across multiple LLMs and file types, finding most models honor carefully-phrased warnings in .docx, .pdf, and .eml formats. It failed to detect prompts in heavily obfuscated text and OCR-based tools. Security professionals should experiment with embedding defensive prompt injections in corporate document templates and sensitivity labels as a user awareness mechanism for Shadow AI. This creative approach has limitations, including inconsistent LLM behavior, potential conflicts with vendor anti-injection defenses, and the dual-use risk of the technique itself.
Amazon offers the ability to use VPC endpoints for isolating network traffic and securing Amazon Simple Email Service (SES) SMTP connections. This walkthrough from AWS details the process for creating a secure SMTP configuration using VPC endpoints, security groups to limit SMTP traffic to approved networks, and IAM policies to limit SES usage to authorized accounts.
Socket has identified a campaign using 10 typosquatted npm packages that execute credential-stealing malware when installed. These packages exploit the npm postinstall lifecycle to run code automatically, showing a fake CAPTCHA and realistic installation prompts to deceive developers. The payload employs multiple layers of obfuscation, fingerprints victims by IP, and downloads a 24MB cross-platform information stealer that harvests credentials from system keyrings, browsers, and authentication services on Windows, Linux, and macOS.
Haunted by endless alerts and unseen attackers? Blind spots across cloud, identity, and network give adversaries the cover they need to strike. Vectra AI's Attack Signal Intelligence™ shines a light on hidden threats with faster MTTD, fewer false positives, and less analyst fatigue. Uncover what lurks in your environment in Mind Your Attack Gaps [11], then see how Vectra exposes them. See the unseen before it sees you. Book a demo [12].
Brida 0.6 now supports Frida 17+ after breaking changes in Frida removed runtime bridges from GumJS, which affected many tools, including earlier Brida versions. The update features major JavaScript refactoring for Frida 17.3.2+ compatibility, support for frida-compile 19.0.4, new Host:Port and DeviceId modes, OkHttp hostname verifier bypass, improved Android root detection, and Gradle configuration. Mobile security testers should upgrade to Brida 0.6 for current Frida support. 0.6pre remains for legacy use with older Frida versions on incompatible devices. It's pending approval in Burp Suite's BApp Store but available on GitHub.