Search the archive

EMAIL BOMBS EXPLOIT LAX AUTHENTICATION IN ZENDESK

SECURING AMAZON BEDROCK API KEYS: BEST PRACTICES FOR IMPLEMENTATION AND MANAGEMENT

AWS recommends using temporary STS credentials over API keys when possible, but when API keys are necessary, short-term keys with built-in expiration are preferred over long-term keys. Organizations should implement comprehensive monitoring through CloudTrail events, EventBridge rules, and AWS Config to detect API key creation and usage while using SCPs to control or block key creation entirely if not needed. The article provides detailed guidance on identifying, protecting, detecting, and responding to API key security events across the credential lifecycle.

HOW A FAKE AI RECRUITER DELIVERS FIVE STAGED MALWARE DISGUISED AS A DREAM JOB

A sophisticated phishing scheme targets developers by posing as an AI recruiter offering an enticing job. Victims are tricked into cloning and running a malicious code repository as part of a “technical assessment,” which then unfolds the attack over five stages: first, a hidden backdoor is silently activated, followed by advanced JavaScript and Python malware that steals credentials, crypto wallets, and browser data, monitors keystrokes and clipboard, and installs remote-access tools like AnyDesk. The malware uses deep obfuscation and persistence mechanisms to resist removal and detection, ultimately handing attackers full control and ongoing surveillance of the compromised system.

HOW I REVERSED AMAZON'S KINDLE WEB OBFUSCATION BECAUSE THEIR APP SUCKED

Frustrated by Amazon's Kindle app instability and restrictive DRM, this author set out to reverse-engineer Amazon's web obfuscation system. Instead of granting simple access to purchased ebooks, Amazon uses a system where the actual text is encoded as glyph IDs rather than characters, with the mapping randomized for every batch of pages. Overcoming these sophisticated protections required pixel-level glyph matching and leveraging font metrics to reconstruct the book, eventually allowing the owner to access their purchase in a way they controlled.

SEE THE PLATFORM

NANOCHAT LETS YOU BUILD YOUR OWN HACKABLE LLM

Andrej Karpathy's nanochat is an open-source project that enables the creation of a simple ChatGPT clone for approximately $100 using 8,000 lines of minimal-dependency code and a single speedrun.sh script, producing a 1.9 billion parameter model trained on 38 billion tokens in about 4 hours on NVIDIA 8XH100 GPU hardware. The accessible codebase allows security researchers and developers to experiment with LLM architecture, understand model training processes, and test modifications without commercial platform restrictions, with scaling to $1,000 enabling significantly more capable models for math, coding, and reasoning tasks. This transparent, hackable approach provides security professionals with valuable insight into LLM internals for threat modeling, adversarial testing, and understanding AI system vulnerabilities that commercial black-box models obscure.

DOMAINSTACK

Domainstack is an all‑in‑one app for exploring domain names. Search any domain (e.g., github.com) and get instant insights, including WHOIS/RDAP lookups, DNS records, SSL certificates, HTTP headers, hosting details, geolocation, and SEO signals.

SILENTPUSH (PRODUCT LAUNCH)

Silent Push offers proactive threat intelligence, detecting and mapping malicious infrastructure pre-attack as it supplies “indicators of future compromise” via continuous internet scans. It also supports threat hunting and brand protection, and integrates with existing security tools or can operate standalone.

WINOS 4.0 HACKERS EXPAND TO JAPAN AND MALAYSIA WITH NEW MALWARE

Winos 4.0 threat actors have expanded operations from China and Taiwan to Japan and Malaysia, deploying HoldingHands RAT through phishing emails with fake Finance Ministry PDFs containing embedded malicious links hosted primarily on Tencent Cloud infrastructure. The sophisticated multi-stage attack chain uses digitally signed executables, anti-VM checks, targets Norton/Avast/Kaspersky for evasion, leverages Windows Task Scheduler for persistence, and injects payloads into taskhostw.exe with process monitoring for re-injection, while newer variants added C2 IP update capabilities via registry (HKEY_CURRENT_USER\SOFTWARE\HHClient). Security teams should monitor for suspicious PDF attachments impersonating government finance documents, block identified C2 infrastructure, including IP 156.251.17[.]9 and domain twczb[.]com, implement behavioral detection for Task Scheduler manipulation and unusual dokan2.dll/TimeBrokerClient.dll activity in System32, and trace Tencent Cloud APPID patterns to identify related phishing infrastructure.

RUSSIAN LYNK GROUP LEAKS SENSITIVE UK MOD FILES, INCLUDING INFO ON EIGHT MILITARY BASES

Russian cybercrime group Lynx breached Dodd Group, a UK Ministry of Defence contractor, on September 23, stealing approximately 4TB of data, including sensitive files on eight RAF and Royal Navy bases such as RAF Lakenheath (hosting US F-35 jets and believed nuclear weapons storage), RAF Portreath (NATO radar site), and RAF Predannack (UK Drone Hub). The leaked data includes roughly 1,000 documents containing staff names, emails, phone numbers, vehicle details, visitor logs, security guidance, and construction records marked as “Controlled” or “Official Sensitive,” with the gang publishing data after failed ransom negotiations. Security professionals should prioritize third-party risk management and contractor security assessments, as supply chain compromises continue to expose critical defense infrastructure and personnel data that nation-state actors can leverage for intelligence gathering or future attacks.

Read the case study now

XUBUNTU.ORG MIGHT BE COMPROMISED

The Xubuntu.org website's torrent download links are serving malicious ZIP files containing a suspicious Windows executable with a 2026 copyright date (despite being 2025) and no actual torrent file inside.

MICROSOFT: OCTOBER UPDATES BREAK USB INPUT IN WINDOWS RECOVERY

Microsoft's October 2025 security updates (KB5066835) break USB mouse and keyboard functionality in Windows Recovery Environment (WinRE) on Windows 11 24H2, 25H2, and Windows Server 2025.

Register here →

💡 WHILE YOU WAIT FOR WEDNESDAY'S WEBINAR, check out RIPPLING IT'S

TWO NEW WINDOWS ZERO-DAYS EXPLOITED IN THE WILD - ONE AFFECTS EVERY VERSION EVER SHIPPED

Microsoft fixed three actively exploited vulnerabilities as part of the final Patch Tuesday for Windows 10. One of the vulnerabilities is a secure boot bypass, whereas the other two are privilege escalation vulnerabilities. Notably, a vulnerable legacy modem driver could allow for privilege escalation in every version of Windows.

GOOGLE ADS FOR FAKE HOMEBREW, LOGMEIN SITES PUSH INFOSTEALERS

Researchers at threat hunting company Hunt.io have uncovered a new malware campaign that uses ClickFix tactics and impersonates popular software to distribute malware. The campaign uses Google Ads to impersonate software like Homebrew, LogMeIn, and TradingView and requests users to copy commands they run in Terminal. The malware then downloads either Odyssey or AMOS infostealers to harvest credentials.

PROSPER DATA BREACH IMPACTS 17.6 MILLION ACCOUNTS

HACKING A BANNED CHINESE SECURITY CAMERA

A security researcher successfully conducted man-in-the-middle attacks against a banned Chinese security camera, demonstrating that the device fails to verify certificate signing chains properly and transmits unencrypted video data over UDP. While these vulnerabilities are concerning, the real security issue driving the US ban is the camera's automatic firmware update capability, which could allow manufacturers to push malicious software updates in the future. The analysis highlights how even devices with multiple security flaws may pose their most significant risk through remote update mechanisms that users cannot control or audit.

DEFENDERWRITE: ABUSING WHITELISTED PROGRAMS FOR ARBITRARY WRITES

Antivirus folders typically block file writes to prevent attacks, but some whitelisted Windows programs can bypass these restrictions. DefenderWrite is a tool that identifies which executables can write files into protected antivirus folders without elevated privileges or exploits. By scanning all .exe files and testing their capabilities, the tool reveals weak points in Windows Defender and other major AVs, showing that even protected folders can be compromised for stealthy persistence.

REVISITING BROWSER CACHE SMUGGLING

Browser cache smuggling is a technique that abuses how web browsers store files to sneak malicious code onto victims' systems. The method leverages browser caching to download files, then uses COM Hijacking (a way of loading malicious DLLs via Windows registry settings) to achieve persistent code execution each time the browser starts. Steganography is also used to hide additional payloads within cached images, making detection harder. By combining these approaches, attackers can reliably trigger their code from the browser cache without external downloads or easily detectable file changes, bypassing many modern endpoint protections and leaving few obvious traces.

SEMGREP'S AI ISN'T JUST AN API CALL TO AN LLM - IT CONFIDENTLY HANDLES AROUND 60% OF SAST TRIAGE FOR CUSTOMERS, WITH A 96% HUMAN-AGREE RATE. THIS MEANS SECURITY TEAMS CAN SPEND ALL OF THEIR TIME ON THE ISSUES THAT MATTER, WITHOUT WORRYING THAT THEY'VE MISSED OUT ON ANY REAL ISSUES. See how Semgrep compares to competitors.

KIEMPOSSIBLE

KIEMPossible is a Kubernetes Infrastructure Entitlement Management tool from Palo Alto Networks that provides visibility into permissions and their actual usage across clusters by analyzing RBAC configurations and audit logs from AWS EKS, Azure AKS, GCP GKE, and local Kubernetes environments. The tool flattens complex permission structures into granular entries, correlates them with audit logs to identify last usage timestamps, and stores the results in a MySQL database to help security teams enforce least privilege by identifying unused or risky permissions. It supports workload identity mapping and group inheritance tracking and generates reports on entities with dangerous unused permissions, making reducing attack surface without breaking legitimate access easier.

KNIGHTER

KNighter is an automated static analysis tool from UIUC that uses Large Language Models to synthesize custom code checkers by learning from historical patch commits in C/C++ codebases like the Linux kernel. The tool employs a three-stage pipeline of generation, refinement, and triage to create LLVM-based checkers that identify bug patterns, focusing on finding real-world vulnerabilities in large-scale systems. It integrates with OpenAI, Claude, Google, and DeepSeek models to automatically generate static analysis rules from git commit history, enabling security teams to discover previously unknown bugs based on patterns from past fixes.

FUZZFORGE AI

AI-powered workflow automation and AI Agents platform for AppSec, Fuzzing, and Offensive Security. Automate vulnerability discovery with intelligent fuzzing, AI-driven analysis, and a marketplace of security tools.

EUROPOL DISMANTLES SIM FARM NETWORK POWERING 49 MILLION FAKE ACCOUNTS WORLDWIDE

Europol's Operation SIMCARTEL dismantled a sophisticated cybercrime-as-a-service platform that operated SIM farms with 40,000 active SIM cards, enabling the creation of over 49 million fake online accounts used for phishing, investment fraud, and other criminal activities. The operation resulted in seven arrests, seizure of 1,200 SIM box devices, takedown of two websites, and freezing of nearly €700,000 in assets across multiple countries. Security professionals should monitor for SIM farm indicators in their threat detection systems and implement stronger verification processes that go beyond SMS-based authentication, as these operations demonstrate how easily criminals can bypass phone number verification on a massive scale.

NORTH KOREAN HACKERS COMBINE BEAVERTAIL AND OTTERCOOKIE INTO ADVANCED JS MALWARE

North Korean threat actors behind the Contagious Interview campaign have merged functionality from their BeaverTail and OtterCookie malware families, creating a more sophisticated JavaScript-based information stealer with enhanced keylogging, screenshot capture, and cryptocurrency wallet theft capabilities. The evolved malware uses legitimate npm packages and supply chain compromises to distribute through fake job interview processes, with new variants like OtterCandy combining remote access trojan functionality and utilizing blockchain-based command-and-control infrastructure via Ethereum and BNB Smart Chain. Security professionals should monitor for suspicious npm packages, implement stronger validation for job applicant technical assessments, and watch for the specific malware indicators, including the "node-nvm-ssh" package and associated file patterns used in these supply chain attacks.

VANILLA TEMPEST'S RHYSIDA RANSOMWARE ATTACKS FOILED

Microsoft dismantled an attack campaign by Vanilla Tempest (also called Vice Society), which used fake Microsoft Teams installers and over 200 fraudulent certificates to spread the Rhysida ransomware. The attackers used malicious ads and SEO techniques to lure users, delivering malware that enabled data theft and additional payload delivery.

BEIJING ALLEGES “IRREFUTABLE EVIDENCE” LINKING US TO MAJOR CYBERATTACK ON CHINESE AGENCY

China's State Security Ministry claims the NSA has been exploiting vulnerabilities in employees' mobile devices to gain unauthorized access to the National Time Service Center since 2022, using stolen credentials and 42 types of cyberattack tools to target the facility's timing systems and internal networks.

COLLINS AEROSPACE ATTACK CLAIMED BY EVEREST, LINKING RANSOMWARE GROUP TO LAST MONTH'S EUROPEAN AIRPORT CHAOS

The Everest ransomware group claims responsibility for breaching Collins Aerospace's MUSE check-in software in September, allegedly exfiltrating 50GB of data and causing days of disruption at major European airports, including Heathrow, Brussels, Berlin, and Dublin, by forcing manual check-in operations.

Learn more

FAKE LASTPASS, BITWARDEN BREACH ALERTS LEAD TO PC HIJACKS

Cybercriminals are conducting a phishing campaign targeting password manager users with fake breach notification emails that trick recipients into downloading malware disguised as "secure desktop versions" of LastPass and Bitwarden. The malicious downloads install Syncro MSP agent software configured to deploy ScreenConnect remote access tools, giving attackers full control over compromised systems while remaining hidden from users. Security professionals should educate users that legitimate password manager companies never request master passwords via email and that security incidents are always announced through official channels and verified company blogs.

HACKERS EXPLOIT CISCO SNMP FLAW TO DEPLOY ROOTKIT ON SWITCHES

Researchers at Trend Micro uncovered a malware campaign that exploits a recently patched remote code execution vulnerability in older Cisco IOS and IOS XE devices to install a Linux rootkit. This flaw leverages the Simple Network Management Protocol (SNMP) and permits attackers with root privileges to execute arbitrary code, bypassing security controls such as Cisco's Authentication, Authorization, and Accounting (AAA) framework and Virtual Teletype (VTY) access control lists. Once active, the rootkit conceals running configurations, manipulates logs, and resets timestamps to evade detection, thereby gaining persistent control over affected devices.

SENSITIVE CUSTOMER INFO EXPOSED IN MANGO DATA BREACH

Spanish fashion retailer Mango reported a data breach after one of its third-party service providers experienced unauthorized access. The breached data includes first names, countries, postal codes, email addresses, and phone numbers. Mango stressed that financial information, IDs, usernames, and passwords were not leaked.

CVE-2025-49844 - THE REDIS CVSS 10.0 VULNERABILITY AND HOW WE RESPONDED

Report URI's response to the critical Redis vulnerability demonstrates a layered defense strategy: they immediately implemented ACL restrictions to disable EVAL and EVALSHA commands as a temporary mitigation, then leveraged their recently deployed Redis Sentinel high-availability setup to perform zero-downtime upgrades to the patched version. Their existing security posture, which included network isolation, strict firewall rules, role-based access controls, and comprehensive logging, meant they were already protected from exploitation and could quickly verify that no compromise had occurred through command statistics analysis. Security teams should prioritize defense-in-depth architecture that enables rapid response to critical vulnerabilities, including network segmentation, quickly modifiable access controls, and high-availability configurations that allow for seamless patching without service disruption.

STARTUP SECURITY: RATIOS AND A 24-MONTH HIRING PLAN

The author recommends a 1:40 security-to-employee ratio and 1:100 IT-to-employee ratio for startups, based on research from successful companies like GitHub and GitLab. He advocates for organizing security teams into four distinct areas: IT (employee enablement), Security Operations (infrastructure and compliance), GRC (governance and customer-facing security), and Product Security (application security and engineering). The document includes a detailed 24-month hiring plan that scales from 5 security staff at 187 employees to 16 security staff at 600 employees, emphasizing that proper staffing ratios are essential for moving from reactive to proactive security postures.

AUTOMATION OF VHDX INVESTIGATIONS

Virtual Hard Disk (VHDX) files are commonly generated by Virtual Desktop Infrastructure (VDI) environments and can be very useful to forensic investigators. Velociraptor is frequently used in investigations but fails to discover or parse the NTUSER.DAT hives in VHDX files without injecting a synthetic ProfileList registry hive or customizing the Windows.Sys.Users artifact to support VHDX discovery logic. To perform this analysis at scale, a single remapping configuration can be used, multiple virtual Velociraptor clients can be launched, or a batch processing approach can be used as a middle ground.

See how BENlabs avoids millions in legal fees

MCPTOTAL LAUNCHES TO POWER SECURE ENTERPRISE MCP WORKFLOWS

MCPTotal launched as the first comprehensive security platform for Model Context Protocol (MCP) implementations, addressing critical vulnerabilities in enterprise AI integrations, including supply chain exposures, prompt injection attacks, rogue MCP servers, and data exfiltration risks that traditional security tools cannot monitor. The platform provides a hub-and-gateway architecture with centralized hosting, authentication, credential vaulting, and AI-native firewall capabilities. It monitors MCP traffic and enforces real-time policies while offering a vetted catalog of secure MCP servers. Security professionals should recognize that MCP adoption creates a new attack surface requiring specialized monitoring and governance, and should evaluate solutions that provide visibility into AI-to-enterprise system connections, implement proper authentication controls, and establish policies for employee MCP usage to prevent shadow IT risks.

SECUREVIBES

SecureVibes is an AI-native security system for vibecoded applications that uses Claude's multi-agent architecture to find security vulnerabilities in your code base autonomously.

MONDOO (PRODUCT LAUNCH)

Mondoo provides an agentic vulnerability management platform enabling organizations to categorize, prioritize, and remediate risks across on-prem, cloud, SaaS, and endpoints.

SOC 2 IS DEAD, LONG LIVE SOC 2!

The author argues that SOC 2 and other security compliance frameworks have fundamental flaws: vague control requirements disconnected from specific threats, audit methodologies that only assess current state rather than historical effectiveness, and static reports that quickly become outdated in dynamic environments. He proposes ALCOVE (Assurance Levels for Control Operating Viability & Effectiveness), a new framework inspired by software supply chain security models that would provide continuous monitoring, threat-informed requirements, and real-time dashboards showing historical control effectiveness. The proposal includes integrating cyber insurance incentives to drive adoption, where insurers would receive continuous control data from vendors in exchange for premium discounts, creating better-aligned incentives across all stakeholders.

APPLE TAKES DOWN NEW ICE APP THAT ARCHIVES AGENTS ARREST VIDEOS FOLLOWING ICEBLOCK REMOVAL

Apple has removed another anti-ICE app on the App Store. The “Eyes Up” app shared location data of arrests that have already happened and holds archives of arrest videos.