Over 252 million identity records from seven countries—Turkey, Egypt, Saudi Arabia, UAE, Mexico, South Africa, and Canada—were exposed through three misconfigured servers in Brazil and the UAE. These contained government-level profiles with ID numbers, birth dates, contact details, and addresses. The databases had similar structures, suggesting a single operator, but the source remains unknown. Turkey, Egypt, and South Africa were most affected. Cybernews contacted hosting providers, and the data is no longer publicly accessible as of June.
Chess.com reported that it experienced a data breach after detecting unauthorized data stored in a third-party file transfer application. The incident only impacts an estimated 4.5K users and may have exposed names and other PII.
TP-Link has confirmed the existence of an unpatched zero-day vulnerability impacting multiple routers. The vulnerability was discovered by a security researcher who stated that it is caused by a stack buffer overflow in the CPE WAN Management Protocol (CWMP). An attacker could exploit it by redirecting vulnerable devices to a malicious CWMP server, which could deliver an oversized SOAP payload, leading to remote code execution.
Attackers deployed fake GitHub repositories and npm packages that stored malware download URLs in Ethereum smart contracts rather than directly in the code, making detection significantly harder for security tools. The campaign targeted cryptocurrency developers with fake automated trading bots, using packages like colortoolsv2 and mimelib2 that connected to blockchain addresses to retrieve second-stage payloads. The attackers automated thousands of fake commits daily to inflate repository legitimacy, demonstrating sophisticated supply chain attack techniques that combine social engineering with blockchain-based evasion.
A new vulnerability in popular Electron-based apps like Signal, 1Password, and Slack allows attackers to get around code integrity checks by hiding backdoors in overlooked V8 heap snapshot files. Electron's integrity protections often miss these files, meaning backdoors can be inserted without failing code signatures or integrity checks, especially when apps are installed in user-writable folders. This post shows a proof of concept to demonstrate keylogging and privilege escalation with the exploit, showing that even patched applications may have missed attack surfaces.
Most SOC teams focus on reactive work but aren't actively looking for threat actors that have bypassed their security controls. TryHackMe's THREAT HUNTING SIMULATOR gives analysts a safe, repeatable environment to practice spotting adversary behaviours [12]. Gamified hunts and instant feedback enable teams to sharpen detection rules and response playbooks, without the overhead of building internal labs. Start free
Fraction Loader is an educational malware project that creates a stealthy in-memory loader capable of downloading, reassembling, and executing payload fragments without touching disk. It uses Windows APIs like VirtualAlloc and WinHTTP to handle encrypted payload chunks, parse headers for order, and reassemble them into executable memory with suitable permissions. While meant for penetration testers and security researchers to learn evasion techniques, it functions as a weaponized dropper that can bypass file-based detection and pose a threat to InfoSec professionals monitoring for in-memory attacks.
Tidal Cyber maps tactics, techniques, procedures, and procedural-level insights to MITRE ATT&CK to tailor security strategies around adversary groups and their behavior for threat-led defenses.
Mixeway Flow is a DevSecOps platform that automatically performs four security scans (SAST, SCA, IaC, and secret detection) on Git repositories through webhook integration. It aggregates vulnerabilities from various open-source scanning tools such as Bearer, OWASP Dependency Track, KICS, and Gitleaks into a single dashboard for streamlined security management. The platform simplifies CI/CD pipeline setup and offers thorough application security testing across code, dependencies, infrastructure, and credential exposure.
Egyptian authorities and the Alliance for Creativity and Entertainment (ACE) shut down Streameast, the world's largest illegal sports streaming platform that received 136 million monthly visits across 80 domains, arresting two suspects and seizing assets linked to $6.2 million in laundered advertising revenue.
A California jury found Google liable for collecting user data even after tracking was disabled, resulting in a $425 million penalty. The class action lawsuit covered 98 million users and claimed Google continued to gather app activity despite settings meant to protect privacy.
France's data authority fined Google €325M and SHEIN €150M for using cookies without user consent and breaching privacy laws. Google was also penalized for showing ads in Gmail based on those cookies. Meanwhile, SHEIN's opt-out failed as cookies were still sent even when users clicked “Reject All.”
Texas Attorney General Ken Paxton filed suit against education software provider PowerSchool for a December 2024 data breach that exposed personal information of more than 880,000 Texas students and teachers, alleging the company failed to implement adequate security measures despite knowing about vulnerabilities.
Disney agreed to pay $10 million to settle FTC claims that it mislabeled child-directed YouTube videos as "Not Made for Kids," which enabled unlawful collection of children's personal data and targeted advertising without parental consent in violation of COPPA regulations.
The FreeBSD Project is developing a policy to restrict LLM-generated code contributions due to licensing concerns, though AI may still be allowed for documentation, translations, and code analysis tasks.
Silver Fox APT exploits a Microsoft-signed but vulnerable WatchDog Antimalware driver (amsdk.sys v1.0.600) to disable security processes on Windows 10/11 and deploy ValleyRAT malware, with the driver never being flagged by Microsoft's Vulnerable Driver Blocklist or LOLDrivers database. The attackers bypassed hash-based blocklists even after a patch by changing a byte in the driver's timestamp while keeping its valid Microsoft signature, showing how trusted signed drivers can be weaponized. The campaign exposes gaps in Microsoft's driver blocklist and the need for security teams to use additional verification beyond signature validation, as the malware terminated nearly 200 security processes targeting mainly Asian organizations.
Cybercriminals are exploiting vulnerable and fake WordPress plugins to hijack sites and redirect visitors to malicious destinations. Two major campaigns, ClickFix ("ShadowCaptcha") and Help TDS, have targeted thousands of websites for scams and data theft. Attackers often gain access through stolen credentials or unpatched plugins, making regular updates, strong authentication, and vigilant plugin management critical for site security.
An Iran-linked hacking group executed a broad spear-phishing campaign, compromising over 100 embassy and government accounts worldwide. Masquerading as urgent diplomatic emails, attackers distributed malware using Word documents with malicious macros. The operation, associated with the group Homeland Justice, mainly targeted Europe and Africa.
Agentic AI's autonomous decision-making poses cybersecurity risks, including shadow AI deployments without IT oversight, multi-agent systems spreading sensitive data, and AI chaining actions that mimic multi-stage attacks while evading security controls. CISOs struggle with visibility into these systems, increased attack surfaces via third-party APIs, and distinguishing between emergent AI behavior and security breaches. This calls for new defense models with real-time monitoring, tight governance, and cross-team coordination. Organizations must adopt secure-by-design methods and proactive governance to maximize AI benefits while managing risks from systems that can access data, decide, and adapt without human oversight.
The data breach at DaVita Inc. unfolded due to a combination of weak security controls, persistent vulnerabilities, and a lack of timely action on previous advisories. Attackers exploited leaked credentials, unpatched internet-facing systems, legacy software, and insufficient monitoring, allowing them to compromise sensitive healthcare data. The repercussions were serious: DaVita's stock value plunged over 14%, substantial regulatory fines are expected, and the company's reputation took a significant hit.
Exposing Azure AD credentials in public configuration files (like appsettings.json) gives attackers direct access to cloud resources because with these secrets, attackers can impersonate trusted apps, exfiltrate data, escalate privileges, and persist within an organization. Leaks occur due to misconfiguration, poor secrets management, and insufficient security checks. To prevent this, restrict access, move secrets out of code, rotate exposed keys immediately, use least privilege, and monitor for misuse to prevent severe breaches.
Research shows that 55% of SMBs spend over half their IT staff time on routine security maintenance - squandering vital knowledge on tedious box-ticking. OneTrust's compliance automation guide [11] shows how to eliminate manual processes and redirect resources to what
Sudomy is a subdomain enumeration tool that collects subdomains and analyzes domains, performing advanced automated reconnaissance (framework). This tool can also be used for OSINT (Open-source intelligence) activities.
Russian national Ianis Antropenko, arrested for deploying Zeppelin ransomware against 138 U.S. victims, including critical infrastructure, from 2018 to 2022, remains free on bail in California despite multiple parole violations and $2.8M in seized cryptocurrency—a rare leniency that security experts suggest may indicate cooperation with authorities. His poor operational security, including using personal PayPal accounts linked to ransomware operations and storing cryptocurrency seed phrases in iCloud, enabled FBI investigators to trace over 101 Bitcoins through the seized ChipMixer service and build their case. The case highlights the evolving challenge of prosecuting cybercriminals operating from within U.S. borders, with Antropenko's lenient pretrial conditions (including no ban on internet use) contrasting sharply with the typical detention of ransomware suspects, raising questions about potential cooperation agreements or intelligence value.
Attackers can now use only inline CSS styles—with the help of chained if statements—to steal sensitive data like user IDs directly from web pages, all without external files or selectors. This creative trick works on Chromium browsers and highlights how inline CSS itself can be a security threat if user-controlled content isn't locked down properly.
Cybersecurity firm Sygnia has been tracking a campaign targeting VMware ESXi, vCenter, and network appliances to compromise environments. The attackers compromise the hypervisor by exploiting CVE-2023-34048 to obtain code execution and install an HTTP backdoor on the hypervisors. The attackers then used PowerCLI commands to compromise guests without guest credentials and also ran unregistered VMs with the VMware CLI to bypass registration in vCenter.
Research by Mattermost and the Ponemon Institute found that only 52% of organizations are confident in the privacy and security of their mission-critical workflows. Read _The State of Mission-Critial Work_
Google has refuted recent inaccurate claims about a major Gmail security issue, reaffirming that its protections block over 99.9% of phishing and malware attempts while recommending users adopt passkeys and follow phishing prevention best practices.
Google's September Android security update patches 84 vulnerabilities, including two actively exploited zero-day privilege escalation flaws (CVE-2025-38352 in the kernel and CVE-2025-48543 in Android Runtime) under limited targeted exploitation, plus four critical RCE vulnerabilities affecting System and Qualcomm components.
CISA, NSA, and partners release a vision document to promote global Software Bill of Materials (SBOM) adoption to improve software transparency and mitigate supply chain risks through standardized practices.
Zscaler confirmed that a threat actor compromised OAuth tokens via the Salesloft Drift integration from August 8 to 18, exposing business contacts and Salesforce data. Though core infrastructure remained secure, the breach revealed names, emails, job titles, phone numbers, and licensing info. The attack extended beyond Salesforce, targeting AWS keys and Snowflake tokens across multiple organizations. Zscaler revoked Drift's access and rotated API tokens.
The Go module "golang-random-ip-ssh-bruteforce" mimics an SSH brute-force tool but secretly exfiltrates credentials to a Telegram bot (@sshZXC_bot) controlled by Russian-speaking threat actor IllDieAnyway. It scans random IPv4 addresses on port 22, attempts to log in with default IoT credentials (such as "root"/"admin" with passwords like "toor"), and then stops after the first successful login to avoid detection. Active since June 2022 and still on pkg.go.dev despite removal requests, it exploits trust in security tools, turning them into credential harvesters using ssh.InsecureIgnoreHostKey() and the HTTPS Telegram API are used to evade monitoring.
Palo Alto Networks suffered a data breach due to compromised OAuth tokens from the Salesloft Drift breach. The attacker primarily extracted business content and related account information, internal sales account records, and basic case data from their Salesforce environment. They were searching for secrets, including AWS access keys, Snowflake tokens, VPN and SSO login strings, and generic keywords.
Attackers have been exploiting CVE-2024-36401 in GeoServer to deploy legitimate SDKs and bandwidth-sharing apps that monetize victims' internet connections, operating stealthily with minimal resource consumption while generating passive income through residential proxy networks. The campaign uses Dart-compiled executables distributed via transfer. To maintain persistence, attackers are targeting over 7,000 exposed GeoServer instances globally, while evading detection by shifting their infrastructure with different IP addresses. The exploit leverages JXPath extension functions to achieve remote code execution, allowing attackers to download and execute monetization payloads that masquerade as legitimate passive income services.
2025.09.03·
unit42.paloaltonetworks.com·10 min read·TLDR InfoSec
Long-lived IAM access keys can present risks such as credential exposure, unauthorized sharing, or theft. AWS CLI access can be achieved with CloudShell or via IAM Identity Center to avoid using access keys. Users can work with IDEs without using access keys by leveraging the AWS Toolkit extension for IDEs such as VS Code. IAM roles can be leveraged by CI/CD pipelines, on-premise workloads, or third-party applications instead of access keys.
Tailscale offers a web-based SSH tool called Tailscale SSH that can be used to SSH into connected devices without the need to manage SSH keys. It utilizes an ephemeral authentication key to create an end-to-end encrypted tunnel in a pop-out browser window to allow for one-click access via the admin panel. Tailscale SSH requires users to run the open-source version of Tailscale's Mac client to access Macs and does not work on Synology or QNAP systems.
SAMLSmith is a C# tool designed for creating custom SAML responses and executing Silver SAML and Golden SAML attacks. It offers extensive features suitable for security researchers and penetration testers dealing with SAML-based authentication systems.
`mcp-context-protector` is a security wrapper for LLM apps using MCP that defends against line jumping attacks and prompt injection via tool descriptions and ANSI escape codes. It requires users to review new and modified server descriptions and tool definitions. The tool sanitizes ANSI sequences to prevent prompt injection and is implemented as an MCP. It is unable to evaluate chain-of-thought attacks.
This repository is a maintained fork of the Burp Automator tool, originally at 0x4D31/burpa, which was left abandoned. It provides a high-level CLI and Python interfaces to Burp Suite scanner and can be used to set up Dynamic Application Security Testing (DAST).
Any organization that wishes to retain its ISO 27001 certification must upgrade to the latest 2022 standard by October. This post breaks down the clauses that cover formal certification requirements and are the focus of the audit process and provides examples of how each clause can be applied in practice. The post also highlights which of the Annex A controls were revised or added in the 2022 standard.
Modern infostealers operate through a sophisticated malware-as-a-service model, executing complete credential harvests within minutes using silent entry, stealthy data collection (including session cookies that bypass MFA), and traceless exfiltration before victims realize they've been compromised. These tools have evolved from simple keyloggers into turnkey identity harvesting systems that extract browser credentials, hardware IDs, personal documents, and cryptocurrency wallets, with stolen logs selling for as little as $10 on underground markets and Telegram channels. The harvested credentials serve as the foundation for 90% of corporate breaches, enabling initial access brokers to monetize compromised accounts through ransomware operations, financial fraud, and identity theft in an increasingly specialized cybercrime economy.