Search the archive

THORIUM

Thorium is a scalable file analysis and data generation platform that allows users to orchestrate arbitrary docker/vm/shell tools at scale. It was developed as a partnership between CISA and Sandia Labs.

PROTON LAUNCHES FREE STANDALONE CROSS-PLATFORM AUTHENTICATOR APP

Proton Authenticator is a free standalone 2FA app for Windows, macOS, Linux, Android, and iOS that doesn't require an account and features end-to-end encryption with cross-device syncing. The app supports easy import/export functions for TOTP seeds (including from Google Authenticator), automatic encrypted backups, and biometric/PIN locking.  Unlike competing apps, it operates without ads, trackers, or vendor lock-in. The source code will be released on GitHub within weeks.

CISA SAYS IT WILL RELEASE TELECOM SECURITY REPORT SOUGHT BY SEN. WYDEN TO LIFT HOLD ON PLANKEY NOMINATION

CISA has committed to releasing its suppressed 2022 U.S. Telecommunications Insecurity Report after Sen. Wyden blocked CISA director nominee Sean Plankey's confirmation until the document is made public. Wyden claims the report contains “shocking details” about telecom vulnerabilities that could have prevented the Salt Typhoon espionage campaign if released when written initially. The Senate passed legislation requiring the report's release within 30 days, while CISA provided no timeline beyond saying it needs “proper clearance.”

SHINNYHUNTERS BEHIND SALESFORCE DATA THEFT ATTACKS AT QANTAS, ALLIANZ LIFE, AND LVMH

Google's Threat Intelligence Group has identified a wave of data breaches as being linked to the ShinyHunters group, debunking the belief that it was associated with ScatteredSpider. In these attacks, the attackers impersonated IT support staff in targeted vishing calls to persuade employees into visiting Salesforce's connected app setup page and then entering a “connection code” that linked a malicious version of Salesforce's Data Loader OAuth app.

CAREER LONGEVITY & THE DON'T FIRE ME CHART

A common metric of security program success is how much leadership is prepared to stick with the work over the long term. Security work tends to follow a cycle in which security issues are increasing so the company hires a security engineer to fix them, the engineer begins fixing the low hanging fruit and the number of issues declines, the engineer digs deeper and implements more logging, monitoring, etc and discovers more issues, management wonders why the issues have increased and fires the engineer. This can be mitigated by communicating that the situation will get worse in the short-term before it gets better in the long-term.

Get Duo's _Ultimate Guide to MSP Operations_

A FRESH LOOK FOR THE MICROSOFT AUTHENTICATION BACKGROUND

Microsoft is rolling out a new default background image for all authentication screens (personal accounts in August, Entra work accounts September 29) as part of its Fluent design modernization effort - this requires no admin action and existing company branding overrides will be preserved.

USERS LEFT SCRAMBLING FOR A PLAN B AS DROPBOX DROPS DROPBOX PASSWORDS

Dropbox has announced that it will shut down its password manager in a phased shutdown, with the service becoming read-only at the end of August followed by the mobile app being shutdown in September, and a full shutdown in October.

Watch the webinar now.

NEW LENOVO UEFI FIRMWARE UPDATES FIX SECURE BOOT BYPASS FLAWS

Lenovo is warning users about new high-severity BIOS flaws that could allow attackers to bypass Secure Boot on some IdeaCentre AIO and Yoga AIO models. The vulnerabilities may enable local attackers to execute arbitrary code in System Management Mode (SMM), a CPU mode that operates independently from the OS and hypervisor, allowing them to plant “undetectable” malware that bypasses OS-level defenses.

HACKERS ACTIVELY EXPLOIT CRITICAL RCE IN WORDPRESS ALONE THEME

WordPress security firm Wordfence has reported an actively exploited, critical unauthenticated arbitrary file upload vulnerability in the premium WordPress theme ‘Alone.' The vulnerability stems from the theme's `alone_import_pack_install_plugin()` function, which lacks nonce checks, is exposed via a `wp_ajax_nopriv_hook`, and permits plugin installation via AJAX. Attackers exploit the flaw by sending a POST request with a remote source URL pointing to an attacker-controlled file with webshells or other payloads.

RANSOMWARE GANG SETS DEADLINE TO LEAK 3.5 TB OF INGRAM MICRO DATA

The SafePay ransomware group is threatening to leak 3.5TB of Ingram Micro data on August 1, nearly a month after the attack. Although Ingram Micro claimed containment and restored operations by July 9, the company's appearance on SafePay's leak site suggests that no ransom was paid.

COST OF A DATA BREACH REPORT 2025

IBM's 2025 breach report shows that global breach costs fell to $4.44 million while US breach costs reached a record high of $10.22 million. AI is emerging as both an attack vector and a defense mechanism, with 13% of breaches involving AI models due to inadequate access controls. Phishing has overtaken stolen credentials as the most common initial attack vector.

DREAMWALKERS

Reflectively loading modules is a technique to hide malware payloads injected via shellcode. Traditionally, the call stack cannot be convincingly spoofed due to missing unwind information. This post introduces a technique called DreamWalkers, which parses the PE structure to register unwind information via `RtlAddFunctionTable`, creating clean and convincing call stacks.

Get the Toolkit

Get the Toolkit

SHADE

shade is a system for detecting shadow SaaS and securely recording the credentials involved. It consists of a browser extension that reports SaaS logins to a backend server, enabling security teams to monitor and manage shadow SaaS.

SOCKTAIL

SockTail is a lightweight binary that joins a device to a Tailscale network and exposes a local SOCKS5 proxy.

PROPHET AI (PRODUCT LAUNCH)

Prophet AI for Security Operations filters incoming alerts and, for each one, gathers, correlates, and analyzes data from multiple sources to provide a decision and a detailed investigation summary.

GOOGLE PROJECT ZERO TO PUBLICLY ANNOUNCE BUGS WITHIN A WEEK OF REPORTING THEM

Google's Project Zero vulnerability research team has announced that they will publicly disclose when they have discovered a vulnerability within a week of notifying vendors. This breaks from the longstanding norm of waiting 90 days for a fix and an additional 30 days post-patch before publishing technical details. Project Zero emphasized that it won't release technical details early, only broad information to help downstream dependents prepare for patching.

CYBERARK ACQUIRED BY PALO ALTO NETWORKS FOR $25 BILLION: MORE DETAILS ON THE DEAL, EXPANDED OFFERING

Palo Alto Networks has acquired identity security firm CyberArk for $25 billion to build a next-generation AI-driven security platform. Despite CyberArk's strong 43% revenue growth, Palo Alto's stock dropped 5% as analysts questioned the defensive timing of the large-scale acquisition.

TURNING INCIDENT RESPONSE CHALLENGES INTO SCALABLE SOLUTIONS

Hunt & Hackett uses a cloud-based incident response lab to handle large-scale investigations.

SECURING AGENTIC APPLICATIONS GUIDE (PDF)

OWASP has released comprehensive guidance offering concrete technical recommendations for builders and developers of agentic AI systems.

ENDGAME GEAR MOUSE CONFIG TOOL INFECTED USERS WITH MALWARE

German peripherals maker Endgame Gear is warning users that malware was embedded in its configuration tool for the OP1w 4k v2 mouse between June 26 and July 9. The malicious version of the download included the XRed backdoor, which features keylogging capabilities, the ability to open a remote shell, and data exfiltration. Endgame Gear has announced that, going forward, it will discontinue hosting separate download pages and will add SHA hash verification and digital signing for all hosted files.

LOVENSE SEX TOY APP FLAW LEAKS PRIVATE USER EMAIL ADDRESSES

A group of security researchers discovered two vulnerabilities in the Lovense sex toy app that could allow an attacker to retrieve a user's private email address with just their username and perform an account takeover with just an email address. To exploit the flaw, an attacker sends a POST request to the `/api/wear/genGtoken` API endpoint, then forwards the encrypted payload to another endpoint, which returns a fake ID that the user can add to their contact list to reveal the real email address. Lovense claims that both flaws were fixed. However, researchers report that only the account takeover flaw was fixed.

TELECOM GIANT ORANGE WARNS OF DISRUPTION AMID ONGOING CYBERATTACK

French telecom giant Orange reported a cyberattack on July 25 that disrupted services for business clients and some public sector services in France. The company isolated affected systems and expects full restoration by Wednesday. Orange claims no customer or internal data was compromised and has notified the relevant authorities about the incident.

WIZ RESEARCH UNCOVERS CRITICAL VULNERABILITY IN AI VIBE CODING PLATFORM BASE44 ALLOWING UNAUTHORIZED ACCESS TO PRIVATE APPLICATIONS

Wiz Research discovered a critical vulnerability in Base44, a popular "vibe coding" platform that allows users to build apps through natural language prompts. The flaw allowed attackers to bypass authentication using only non-secret app IDs, potentially granting access to private enterprise applications and sensitive data.

FAKE CAPTCHA LED TO LUMMA

Attackers used a fake CAPTCHA page that employed the ClickFix social engineering technique to trick users into pressing Windows+R and pasting a PowerShell command that downloaded LUMMA stealer malware. The malware targeted browser credential stores (Login Data and Web Data) from Microsoft Edge and Google Chrome, establishing C2 communication within minutes of initial execution. The attack chain leveraged multiple evasion techniques, including heavily obfuscated PowerShell, AutoIt scripts, and mshta.exe proxy execution to bypass security controls.

BUILDING A CLOUD SECURITY ROADMAP: TOOLS BY LAYER AND WHEN YOU NEED THEM

This post provides an overview of the layers in cloud environments, the threats that target each layer, and the tools that are best suited to address them. The cloud infrastructure/control plane layer handles tasks such as resource provisioning, configuration management, and user permissions. The orchestration layer hosts platforms such as Kubernetes and related services live, whereas the platform layer runs more generalized workloads. Finally, the application layer includes software that end-users rely on, such as custom web applications, APIs, and SaaS apps.

Get the Toolkit

FIRECRAWL

Firecrawl is an API service that takes a URL, crawls it, and converts it into clean Markdown or structured data, which can then be processed by an LLM or other tool.

SEAL SECURITY (PRODUCT LAUNCH)

Seal is a supply chain security tool that differentiates itself by providing patches for vulnerable packages instead of pushing for version upgrades.

EBYTE-GO-MORPHER

Ebyte-Go-Morpher is a Go tool that parses, analyzes, and rewrites Go source code to apply multiple layers of obfuscation. It operates directly on the Go Abstract Syntax Tree (AST) and generates obfuscated source files along with runtime decryption logic.

SECURITY PROS ARE DROWNING IN THREAT-INTEL DATA AND IT'S MAKING EVERYTHING MORE DANGEROUS

A Google Cloud and Forrester study of 1,541 tech leaders found that 61% of security professionals are overwhelmed by threat intelligence data, while 60% lack skilled analysts. Top concerns include phishing (46%), ransomware (44%), and AI prompt injection attacks (34%).

PYPI USERS EMAIL PHISHING ATTACK

PyPI users are being targeted by phishing emails from "pypj[.]org" (note the "j"), which request email verification. The fake site mimics PyPI to steal credentials. Users should delete these emails, avoid clicking any links, and change their passwords if compromised.

NEW CHOICEJACKING ATTACK STEALS DATA FROM PHONES VIA PUBLIC CHARGERS

Choicejacking is a new attack that bypasses smartphone security prompts by spoofing USB or Bluetooth input devices to simulate user actions in under 133 milliseconds. The attack tricks phones into enabling data transfer mode without consent, allowing attackers to access photos, messages, and install malware through compromised public charging stations. Unlike traditional juice jacking attacks, Choicejacking exploits device communication protocols to simulate keyboard input and overflow input buffers, affecting both Android and iOS devices.

RTÉ INVESTIGATING POTENTIAL CYBER SECURITY INCIDENT

The UK's National Cyber Security Centre (NCSC) contacted the Irish broadcaster RTÉ regarding a potential cybersecurity threat, based on information that it had received.

MINNESOTA ACTIVATES NATIONAL GUARD AFTER ST. PAUL CYBERATTACK

Minnesota Governor Tim Walz activated the National Guard to provide cyber protection after a cyberattack on Friday crippled the City of Saint Paul's digital services and critical systems.

gathered the top questions (and answers) about GenAI in SecOps

from CISO's and security leaders such as:

AEROFLOT AEROFLOPS OVER 'IT ISSUES' AFTER ATTACKERS CLAIM YEAR-LONG COMPROMISE

Aeroflot canceled 49 flights on Monday due to supposed IT system failures at Moscow's Sheremetyevo Airport. Hacktivist groups Silent Crow and Cyberpartisans BY claimed responsibility, saying they compromised the airline's systems for a year and destroyed 7,000 servers.

NO PATCH FOR FLAW EXPOSING HUNDREDS OF LG CAMERAS TO REMOTE HACKING

The CISA has released an alert regarding a new authentication bypass vulnerability in LG Innotek LNV5110R cameras that could allow remote attackers to gain administrative privileges. The vulnerability allows attackers to upload an HTTP POST request to the device's non-volatile storage, potentially resulting in remote code execution. LG has stated that it will not release a patch for the vulnerability because the device has reached its end of life.

GLOBAL GROUP RANSOMWARE CLAIMS BREACH OF MEDIA GIANT ALBAVISIÓN

GLOBAL GROUP, a ransomware-as-a-service active since June, claims to have breached Spanish media giant Albavisión, stealing 400GB of data and giving 15 days to negotiate. Using AI chatbots, it has targeted 29 victims, mainly media and healthcare firms, with ransom demands of around $1 million. The group also attacked entities like RTE and Rete Toscana Classica, focusing on media companies.