Search the archive

Get a demo

it never stops. Drata's AI-native Trust Management platform

streamlines the entire GRC workflow. Security questionnaires? Automated. Evidence collection? Continuous. Risk management? Built in.

EVICTION STRATEGIES TOOL

The Eviction Strategies Tool is a tool, maintained by CISA, designed to help incident responders during the containment and eviction phases. It is comprised of a stateless webapp and a database of post-compromise countermeasures mapped to adversary tactics, techniques, and procedures (TTPs).

FACADE: FAST AND ACCURATE CONTEXTUAL ANOMALY DETECTION

FACADE is an enterprise security anomaly detection system made by Google. It uses high-precision deep learning across various applications, including defense against insider threats, ACL recommendations, and account compromise detection.

HUSH SECURITY (PRODUCT LAUNCH)

Hush Security is a platform that eliminates credential-based threats by replacing secrets and vaults with just-in-time, policy-based access for machines, removing the need for credentials entirely.

MICROSOFT ADDS MALICIOUS LINK WARNINGS TO TEAMS PRIVATE CHATS

Microsoft Teams will begin automatically alerting users when they send or receive a private message containing links that have been flagged as spam, phishing, or malware for all Microsoft Defender for Office 365 and Microsoft Teams enterprise customers. The feature will enter preview this month. It will be enabled by default when it reaches general availability in November.

THE US IS NOW THE LARGEST INVESTOR IN COMMERCIAL SPYWARE

The United States has surpassed all other nations in funding commercial spyware, driving a rapidly expanding global market. New research reveals that US investors now dominate this space by channeling money through hedge funds and pension plans into companies involved in spyware surveillance. Current regulations largely fail to address these financial flows, highlighting growing accountability and policy gaps.

KIDS IN THE UK ARE HACKING THEIR OWN SCHOOLS FOR DARES AND NOTORIETY

A surge in UK school cyber breaches is driven by students, who are responsible for over half the incidents. These breaches often result from weak passwords, misplaced logins, or staff security lapses. They usually do it as a dare, revenge, or attention-seeking, though some cases involve sophisticated attacks.

SECURE ALL YOUR CODE, DEPENDENCIES AND INFRASTRUCTURE EFFORTLESSLY, WITH A UNIFIED PLATFORM THAT'S BUILT-IN, NOT BOLTED ON. TRY CODACY FOR FREE

DDOS DEFENDER TARGETED IN 1.5 BPPS DENIAL-OF-SERVICE ATTACK

A European DDoS mitigation service provider was hit by a massive distributed denial-of-service attack that reached 1.5 billion packets per second.

SENATOR BLASTS MICROSOFT FOR 'DANGEROUS, INSECURE SOFTWARE' THAT HELPED PWN US HOSPITALS

Senator Ron Wyden has urged the FTC to investigate Microsoft after a ransomware attack on major US hospitals exposed flaws in Windows security.

CHINESE APT HITS PHILIPPINE MILITARY FIRM WITH NEW EGGSTREME FILELESS MALWARE

EggStreme is a new fileless malware framework used by a China-based APT group to target Philippine military organizations and APAC entities.

See the full breakdown →

Ready to see why Bitwarden continues to lead the G2 reports for 11 consecutive quarters? Start a free trial of Bitwarden for your

business

FROM MOSTERERAT TO CLICKFIX: NEW MALWARE CAMPAIGNS HIGHLIGHT RISING AI AND PHISHING RISKS

Fortinet researchers have disclosed a sophisticated phishing campaign delivering MostereRAT, a banking malware-turned-RAT that uses the obscure Easy Programming Language (EPL), disables Windows security mechanisms, and deploys remote access tools like AnyDesk and TightVNC to maintain persistent access on compromised systems. A separate ClickFix campaign targets users searching for AnyDesk by serving fake Cloudflare verification pages that ultimately deliver MetaStealer through social engineering tactics involving Windows File Explorer and malicious LNK files disguised as PDFs. Security researchers also revealed a novel adaptation of ClickFix using CSS-based obfuscation to weaponize AI summarizers through "prompt overdose" attacks that overwhelm AI context windows to produce malicious step-by-step instructions, demonstrating how threat actors are exploiting user trust in AI-generated content.

SESSIONREAPER, UNAUTHENTICATED RCE IN MAGENTO & ADOBE COMMERCE

Adobe released an emergency patch for a critical (CVSS 9.1) vulnerability in all versions of Adobe Commerce and Magento. The vulnerability allows for customer account takeover as well as unauthenticated remote code execution in some circumstances. The attack combines a malicious session with a nested deserialization bug.

CURSOR'S AUTORUN LETS HACKERS EXECUTE ARBITRARY CODE

Cursor's AI-powered code editor ships with Workspace Trust disabled by default, allowing malicious repositories to automatically execute code through crafted ".vscode/tasks.json" files the moment a developer opens a folder, without any user prompts or warnings. Attackers can inject these malicious task files into public repositories, enabling them to compromise developer machines and access sensitive data, including API keys, cloud credentials, and SaaS sessions, simply through the act of browsing a project. Unlike VS Code, which does not auto-run tasks in default configurations, Cursor executes these tasks immediately after opening a project folder, creating a significant supply chain attack vector for the platform's one million users.

WHEN AI NUKES YOUR DATABASE: THE DARK SIDE OF VIBE CODING

A startup founder's production database was accidentally wiped by an AI coding assistant in Replit, highlighting the dangers of "vibe coding" - the practice of letting AI tools like GitHub Copilot generate code from plain English prompts without proper review. Research shows 45% of AI-generated code contains OWASP Top 10 vulnerabilities, with common issues including hardcoded secrets, weak access controls, and hallucinated dependencies that don't exist or contain security flaws. Security experts warn that "Shadow AI" development bypasses traditional code review processes, requiring organizations to treat AI-generated code like junior developer output with strict scrutiny and governance controls.

HOW AN ATTACKER'S BLUNDER GAVE US A RARE LOOK INSIDE THEIR DAY-TO-DAY OPERATIONS

Huntress gained unprecedented insight into a threat actor's operations when the attacker accidentally installed their EDR agent after finding them through a Google ad while researching Bitdefender, revealing extensive use of AI tools like Make.com for workflow automation, searches for Evilginx instances, and systematic reconnaissance targeting Nigerian banks and cryptocurrency exchanges. The actor demonstrated sophisticated OPSEC with residential proxies (LunaProxy), anti-detection browsers (Nstbrowser), and security tools (Malwarebytes) while working 12 to 14-hour days conducting research, crafting phishing messages using Google Translate, and accessing over 2,400 compromised identities. Browser history revealed their evolution from manual processes to AI-assisted workflows, including automated Telegram bot integration and the use of stolen cookies with tools like ROADtools for Microsoft Entra token exploitation.

PWN MY RIDE: EXPLORING THE CARPLAY ATTACK SURFACE

Oligo exposes Apple CarPlay's security vulnerabilities, focusing on CVE-2025-24132, a stack buffer overflow in the AirPlay protocol that enables remote code execution with root privileges. They detail how wireless CarPlay exposes vehicles to attacks, mainly because most cars rely on weak Bluetooth pairing. Attackers can exploit poor authentication to extract WiFi credentials and launch RCE attacks. Although Apple patched this in the AirPlay SDK, most car manufacturers haven't implemented these fixes, leaving many vehicles exposed.

your risk.

MFTOOL

MFTool is a red team-oriented NTFS parser that bypasses Windows file APIs by directly parsing on-disk Master File Table structures to access locked, deleted, and hidden files. The tool can retrieve sensitive files like SAM, SYSTEM, and pagefile.sys without opening OS-level file handles, effectively circumventing Windows file access controls while requiring administrative privileges. It supports regex-based searches across entire volumes and maintains an encrypted in-memory Master File Table (MFT) cache for stealthy file system operations during red team engagements.

RF-SWIFT

RF-Swift is a revolutionary toolbox that transforms any computer into a powerful RF testing laboratory without requiring a dedicated operating system. Unlike traditional approaches that force you to sacrifice your primary OS, RF-Swift brings containerized RF tools to your existing environment.

AEGIS AI (PRODUCT LAUNCH)

Aegis AI provides email security through reasoning agents, each of which is a custom-built LLM tuned to a specific threat. Once the orchestrating agent recognizes a threat or potential threat, it calls other agents in the network, and these agents then run the analysis, reason with each other, and respond to the orchestrating agent with a verdict.

GOOGLE MISLED USERS ABOUT THEIR PRIVACY AND NOW OWES THEM $425M, SAYS COURT

A court ordered Google to pay $425 million in a class action lawsuit after finding it misled 98 million users about its "Web & App Activity" privacy setting, which was supposed to stop data collection but didn't prevent Google from gathering information through its Firebase analytics system. Despite users thinking their activities were private, Google continued collecting data from apps like Uber, Venmo, and Instagram through a separate system, with internal communications revealing Google was "intentionally vague" about data collection practices to avoid alarming users. This adds to Google's history of privacy violations, including recent settlements totaling over $2 billion for misleading location tracking and incognito mode practices.

THE US GOVERNMENT HAS NO IDEA HOW MANY CYBERSECURITY PROS IT EMPLOYS

The US government lacks accurate data on the number of cybersecurity workers and contractors it employs, due to the messy, incomplete, and unreliable data across agencies. The GAO found that most departments lack standardized reporting and quality controls, and efforts to fix the situation are stalled, leaving workforce planning and effective cybersecurity policy undermined.

FORMER WHATSAPP SECURITY BOSS IN LAWSUIT LIKENS META'S CULTURE TO A “CULT”

Meta's ex-WhatsApp security chief, Attaullah Baig, has sued back, claiming the company ignored and concealed major privacy flaws, allowed over 1,500 engineers uncontrolled data access, and failed to secure and track user data. He asserts Meta retaliated against him for whistleblowing, while Meta counters that he performed poorly and misrepresented ongoing efforts to improve security.

US CHARGES ADMIN OF LOCKERGOGA, MEGACORTEX, NEFILIM RANSOMWARE

The U.S. Department of Justice has charged Ukrainian national Volodymyr Viktorovich Tymoshchuk for his role as administrator of the LockerGoga, MegaCortex, and Nefilim ransomware operations that collectively caused hundreds of millions of dollars in damages to victims worldwide.

PIXEL 10 FIGHTS AI FAKES WITH NEW ANDROID PHOTO VERIFICATION TECH

Google is integrating C2PA Content Credentials into the Pixel 10 camera and Google Photos to help users distinguish between authentic, unaltered images and those generated or edited with artificial intelligence technology.

KILLSEC RANSOMWARE IS ATTACKING HEALTHCARE INSTITUTIONS IN BRAZIL

KillSec Ransomware attacked MedicSolution, a Brazilian healthcare software provider, stealing over 34 GB of sensitive medical data, including lab results, X-rays, and patient records (including minors) from an insecure AWS S3 bucket that was exposed for several months, marking the first notable supply chain incident affecting Brazil's healthcare industry.

SEE STORAGE CONTROL IN ACTION

PLEX URGES USERS TO CHANGE PASSWORDS AFTER DATA BREACH

Plex disclosed a breach exposing user data, including usernames, emails, scrambled passwords, and some auth data. Though the passwords are unreadable, Plex urges users to reset and sign out of connected devices.

NO GAINS, JUST PAINS AS 1.6M FITNESS PHONE CALL RECORDINGS EXPOSED ONLINE

Security researcher Jeremiah Fowler uncovered an unprotected HelloGym database with 1.6 million audio recordings from major gym franchises, exposing customer and staff names, phone numbers, and sensitive conversations. Risks include voice cloning, deepfakes, and social engineering.

160,000 IMPACTED BY WAYNE MEMORIAL HOSPITAL DATA BREACH

Over 160,000 people had personal and medical data stolen in a ransomware attack on Wayne Memorial Hospital in May 2024. Hackers accessed sensitive personal, health, and financial information. The hospital responded quickly, restored systems, and offered affected individuals free credit monitoring.

LUNALOCK RANSOMWARE THREATENS VICTIMS BY FEEDING STOLEN DATA TO AI MODELS

LunaLock, a new ransomware group, has threatened to submit stolen artwork from the Artists&Clients website to AI companies for training datasets if its $50,000 ransom demand isn't met. This approach, a unique extortion technique, represents a dangerous precedent as it compromises victims' intellectual property permanently by incorporating stolen data into AI models, unlike traditional dark web leaks that may fade over time. The attack targets artists who are already vulnerable to AI data scraping by companies like OpenAI and Google.

GITHUB ACTIONS: A CLOUDY DAY FOR SECURITY - PART 1

Security challenges in GitHub Actions can affect even trusted teams, as attackers may exploit workflows or inject malicious code. Using branch protection, pull request approvals, environment variable management, and safeguards like the “four-eyes” principle reduces risks. Regular reviews and testing further strengthen CI/CD pipeline security.

MEMORY INTEGRITY ENFORCEMENT: A COMPLETE VISION FOR MEMORY SAFETY IN APPLE DEVICES

Apple's Memory Integrity Enforcement (MIE), introduced in the iPhone 17 and iPhone Air, combines secure memory allocators with Enhanced Memory Tagging Extension (EMTE) hardware to provide continuous memory safety against advanced spyware exploiting memory corruption. It uses hardware-enforced memory tagging to prevent buffer overflows and use-after-free attacks by assigning secret tags to memory and terminating processes when tags are incorrect. Tag Confidentiality Enforcement also defends against side-channel attacks, including Spectre V1 mitigations. Apple's tests show MIE defeats all recent real-world exploits, forcing attackers to restart development with new techniques and making memory corruption exploits more difficult and costly.

👋 Register now (San Francisco | Oct 8)

📘 Read Zenity Labs' AgentFlayer 0click Exploit research

VMDRAGONSLAYER

VMDragonSlayer is a framework for analyzing binaries protected by VM-based protectors like VMProtect 2.x/3.x, Themida, and custom malware VMs. It combines Dynamic Taint Tracking, Symbolic Execution, Pattern Classification, and Machine Learning to automate reverse engineering.

SOLA SECURITY (PRODUCT LAUNCH)

Sola Security has built an AI-powered no-code security platform that can design, customize, and deploy security tools in minutes.

DALEC

Dalec provides a declarative format for building system packages and containers from those packages. It is designed for building containers for Azure and supports Azure Linux 2 and 3 and Windows containers.

AI-POWERED CELEBRITY IMPERSONATION SCAMS: A THREAT INTELLIGENCE REPORT BY REDHUNT LABS

RedHunt Labs discovered a complex AI-driven investment scam targeting Indian users through Facebook and Instagram ads featuring deepfake videos of celebrities like Nirmala Sitharaman, Sadhguru, and Neha Kakkar promoting fake investment platforms. Victims lost an average of over ₹50,000. The scammers use deepfake technology to create convincing fake interviews and endorsements, bypassing Facebook's ad review system through short-lived campaigns and fake Amazon links. They redirect victims to counterfeit news websites impersonating major Indian media outlets like NDTV and India Today. The campaign involves a network of over 1,000 interconnected fraudulent websites and uses multiple payment methods, including UPI transfers and international bank accounts. It has expanded beyond social media to include compromised websites, fake Medium blog posts, and SEO manipulation to reach victims across multiple platforms.

NEPAL SOCIAL MEDIA BAN SPARKS PROTESTS, DOZENS INJURED

At least 14 people were killed and dozens injured in Nepal after police clashed with "Gen Z protesters" demonstrating against the government's ban on 26 major social media platforms, including Facebook, Instagram, WhatsApp, Signal, YouTube, and X. The restrictions were imposed after foreign tech companies failed to register locally under new regulations, citing concerns about cybercriminals spreading disinformation with fake accounts and unregistered platforms. Rights groups condemned both the ban and the police force, calling the restrictions a "dangerous precedent for press freedom" that could harm Nepal's business and tourism sectors, heavily reliant on social media.

TREASURY DEPARTMENT TARGETS SOUTHEAST ASIA SCAM HUBS WITH SANCTIONS

The U.S. Treasury Department sanctioned 19 individuals and organizations operating cyberscam hubs in Burma and Cambodia, responding to Americans losing at least $10 billion to Southeast Asian scam operations in 2024—a 66% increase from the previous year. The sanctions target notorious hubs like Shwe Kokko, Burma, where criminal organizations use debt bondage, violence, and threats of forced prostitution to coerce workers into conducting virtual currency investment scams and other online fraud against victims worldwide. The action aims to disrupt industrial-scale fraud operations that not only threaten Americans' financial security but also subject thousands of people to modern slavery conditions in forced labor compounds.