Search the archive

TRASHFORMER

TrashFormer is a 64-bit junk code engine designed to provide code that doesn't affect the program's behavior but allows malware to reprogram itself on each infection.

ELMO'S X ACCOUNT HACKED TO PUBLISH RACIST AND ANTISEMITIC POSTS

Elmo's official X account was hacked on Sunday. It posted racist and antisemitic content before being removed. The compromised account also demanded that Trump release Jeffrey Epstein files and was linked to a crypto scam.

CBI SHUTS DOWN £390K U.K. TECH SUPPORT SCAM, ARRESTS KEY OPERATIVES IN NOIDA CALL CENTER

India's CBI dismantled a transnational tech support scam syndicate that targeted UK and Australian citizens and resulted in losses exceeding £390,000. Operation Chakra V raided three locations in Noida, arresting two suspects from a fraudulent call center, FirstIdea. The scammers impersonated Microsoft support staff, claiming devices were compromised to scam unaware people.

LIBRARIES ARE UNDER-USED, LLMS MAKE THIS PROBLEM WORSE

Libraries are underutilized in favor of custom code. This is due to engineers preferring to write code rather than read documentation, underestimating the problem, and organizations that reward complex internal projects over using libraries. LLMs can further this issue by rapidly generating code that is not as well-tested or understood as the more well-known libraries.

CHINESE HACKERS SUSPECTED IN BREACH OF POWERFUL DC LAW FIRM

Wiley Reid, a DC law firm, informed clients of a suspected data breach potentially linked to Chinese hackers that involved compromised Microsoft 365 accounts of staff, although the full extent of the breach was not disclosed.

RUSSIAN BASKETBALL STAR DANIIL KASATKIN ARRESTED IN RANSOMWARE PROBE

Russian basketball player Daniil Kasatkin was arrested in Paris on June 21 on U.S. charges of computer fraud conspiracy, accused of negotiating for an unnamed ransomware group that attacked about 900 organizations between 2020 and 2022.

MAN GETS SUSPENDED SENTENCE FOR HATE-FUELED UK TRAIN STATIONS WIFI HACK

A man in the UK hacked a train station's WiFi to display hateful messages about Islam - he was caught and arrested, and received a suspended prison sentence, community service, and rehab.

Download the full defender's guide

ROWHAMMER ATTACK DEMONSTRATED AGAINST NVIDIA GPU

A group of researchers from the University of Toronto demonstrated that the Rowhammer attack method can be applied to GPUs in an attack they dubbed GPUHammer. Rowhammer attacks involve repeatedly accessing (“hammering”) a DRAM row, leading to electrical interference that causes bit flips in adjacent memory regions. The researchers have demonstrated that GPUHammer attacks can reduce the accuracy of ML models from 80% to 0.1%.

MCDONALD'S CHATBOT RECRUITMENT PLATFORM EXPOSED 64 MILLION JOB APPLICATIONS

McDonald's chatbot recruitment platform, McHire, exposed the personal data of over 64 million job applicants due to default credentials ('123456' username/password) and an insecure API. Security researchers accessed all applicant information, including names, addresses, phone numbers, and chat messages.

OVER 600 LARAVEL APPS EXPOSED TO REMOTE CODE EXECUTION DUE TO LEAKED APP_KEYS ON GITHUB

Cybersecurity researchers discovered that leaked Laravel APP_KEYs from GitHub can enable remote code execution attacks. Over 260,000 APP_KEYs were extracted from GitHub, with more than 600 vulnerable applications identified. When attackers obtain these encryption keys, they can exploit deserialization flaws to execute arbitrary code on servers, compromising data and infrastructure security.

GROK-4 JAILBREAK WITH ECHO CHAMBER AND CRESCENDO

Researchers have shown that combining two LLM jailbreak techniques, Echo Chamber and Crescendo, enhances the ability to bypass AI safety measures more effectively than using either method separately. Experiments with Grok-4 on harmful tasks, like providing bomb-making instructions, achieved success rates ranging from 30% to 67%.

ROLLING OUT SANTA WITHOUT FREEZING PRODUCTIVITY: TIPS FROM SECURING FIGMA'S FLEET

Figma successfully deployed Santa, an open-source binary authorization tool, across all employee laptops by running it in monitoring mode for months to build a comprehensive allowlist based on actual usage patterns. It minimized user disruption through a custom Slack-based self-service system that allows employees to quickly approve blocked applications after automated security checks, as well as an escape hatch that enables temporary monitoring mode during rollout. The phased deployment began with users having zero unknown binaries and gradually expanded to 100% coverage over three months, utilizing automated package rule generation and group-based policies to handle edge cases, such as developer tools.

HOW I FOUND A BYPASS IN GOOGLE'S BIG ANTI-ADBLOCK UPDATE

The author discovered a Chrome bug that allowed MV3 extensions to bypass Google's removal of webRequestBlocking (which kills adblockers) by exploiting legacy JavaScript bindings and creating fake webRequest events with spoofed WebView IDs. The exploit worked by using the constructor of existing webRequest events to create new events with the opt_webViewInstanceId parameter set, which skipped permission checks for webRequestBlocking since the browser never verified if the extension had WebView permissions. Google patched the vulnerability in Chrome 118 by adding proper permission validation, although it didn't award a bounty since it didn't expose new data to extensions.

TRUSTIFI (PRODUCT LAUNCH)

The cloud-based email security solution leverages AI to scan emails for threats such as impersonation, spoofing, spear-phishing, and business email compromise.

CAMERADAR

Cameradar hacks its way into RTSP video surveillance cameras as it is a tool that scans for RTSP camera streams, identifies device models, performs dictionary attacks to find stream routes and credentials, then generates a comprehensive report.

RECONSNAP (PRODUCT LAUNCH)

The platform enables automated digital change detection, capturing visual and structural changes on selected targets. This helps you track updates, detect anomalies, and react to potential threats before others.

GOOGLE GEMINI FOR WORKSPACE HIJACKS EMAIL SUMMARIES FOR PHISHING

A security researcher discovered an indirect prompt-injection attack on Google's Gemini model. The prompt injection attack involves including invisible instructions for Gemini in emails. When a user then uses Google Gemini for Workspace to summarize the email, Gemini will follow the instructions and may include phishing links or misinformation in its summary.

“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Meta deployed “localhost tracking” that bypassed Android security protections by using its mobile apps to listen on local network ports while tracking scripts in web browsers sent user identifiers via WebRTC, linking anonymous browsing activity to real Facebook/Instagram identities even when users employed VPNs, incognito mode, and deleted cookies. The scheme affected 22% of the world's most visited websites and collected complete browsing histories, purchases, and behavioral patterns without proper consent across billions of users over multiple years. Meta now faces potential fines of €32 billion under GDPR, DSA, and DMA regulations for violating data protection, personalized advertising restrictions, and rules governing the combination of cross-platform data.

SMM CALLOUT VULNERABILITIES IDENTIFIED IN GIGABYTE UEFI FIRMWARE MODULES

Four SMM callout vulnerabilities (CVE-2025-7026 through CVE-2025-7029) were found in Gigabyte UEFI firmware, allowing attackers with admin privileges to execute code in System Management Mode, bypassing OS protections and potentially disabling Secure Boot and Intel BootGuard. These flaws result from improper validation of CPU registers and pointers in SMI handlers, enabling malicious control over SMRAM writes and flash operations. Although they were previously fixed by AMI, these issues reappeared in Gigabyte's firmware, so users should urgently update to the latest UEFI from Gigabyte's support site.

TELEGRAM MESSENGER'S TIES TO RUSSIA'S FSB REVEALED IN NEW REPORT

Russian investigative outlet IStories alleges that Telegram's server infrastructure is maintained by companies with ties to Russia's FSB intelligence service, potentially enabling surveillance of users' communications even when using VPNs and incognito mode, though Telegram denies the claims and maintains that no third parties have access to user data.

DONOT APT HITS EUROPEAN MINISTRY WITH NEW LOPTIKMOD MALWARE

The India-linked DoNot APT group targeted a European foreign affairs ministry by using spear-phishing emails impersonating defense officials to deliver its LoptikMod malware via Google Drive links, marking an expansion of its operations beyond its traditional South Asian focus.

THIRTEEN ROMANIANS ARRESTED FOR PHISHING THE UK'S TAX SERVICE

Thirteen individuals in Romania and one in the UK were apprehended for executing a phishing scam targeting HMRC, which resulted in a theft of £47 million from taxpayers and impacted 100,000 HMRC customers.

🙋♀️ Get a guided tour with an expert

Inbound security reviews don't have to slow you down. SafeBase

helps you automate inbound requests, streamline questionnaires, and share your security posture proactively—all through a centralized Trust Center and AI Questionnaire Assistance.

ATOMIC MACOS INFOSTEALER ADDS BACKDOOR FOR PERSISTENT ATTACKS

Malware analysts discovered a new version of the Atomic macOS (AMOS) infostealer, which includes a backdoor that offers attackers persistent access to compromised systems. The new version of the malware features an embedded backdoor, utilizes LackDaemons to survive reboots, implements ID-based victim tracking, and introduces new C2 infrastructure. The embedded backdoor allows threat actors to execute commands remotely, log keystrokes, introduce additional payloads, or probe for lateral movement opportunities.

MILLIONS OF CARS EXPOSED TO REMOTE HACKING VIA PERFEKTBLUE ATTACK

PCA Cyber Security discovered critical vulnerabilities in OpenSynergy's BlueSDK Bluetooth framework affecting millions of cars from Mercedes-Benz, Skoda, and Volkswagen. The "PerfektBlue" attack enables remote code execution through Bluetooth pairing, allowing attackers to track vehicles, record audio, access phonebook data, and potentially control steering/wipers.

CRITICAL MCP-REMOTE VULNERABILITY ENABLES REMOTE CODE EXECUTION, IMPACTING 437,000+ DOWNLOADS

CVE-2025-6514, a critical vulnerability in mcp-remote (CVSS 9.6), allows arbitrary OS command execution when connecting to untrusted MCP servers. The flaw affects versions 0.0.5-0.1.15 and has been patched in 0.1.16. Other MCP vulnerabilities allowing for remote code execution and sandbox escapes were also discovered in the Inspector tool and Anthropic's Filesystem MCP Server.

HOW I DISCOVERED A LIBPNG VULNERABILITY 11 YEARS AFTER IT WAS PATCHED

While practicing secure code review, the author of this article decided to review the libpng C library. They found that libpng calculated memory allocations based on user-controlled values, such as “depth.” The author was able to trigger a crash using a custom PNG file, but then discovered that the bug was fixed 11 years ago when it was first reported.

TAKING SHELLTER: A COMMERCIAL EVASION FRAMEWORK ABUSED IN- THE- WILD

Elastic Security Labs found threat actors using an illicit version of SHELLTER, a red team evasion framework, since April to deploy infostealers like LUMMA, RHADAMANTHYS, and ARECHCLIENT2. The malware uses advanced evasion techniques such as polymorphic code, API hooking bypasses, indirect syscalls, memory scan evasion, and AMSI bypass, resulting in low detection rates. Elastic issued a dynamic unpacker and YARA rules to help detect SHELLTER samples, which are spread via YouTube comments and phishing campaigns targeting content creators.

ABUSING CHROME REMOTE DESKTOP ON RED TEAM OPERATIONS: A PRACTICAL GUIDE

Red team operators can abuse Chrome Remote Desktop as a legitimate remote access tool by installing the MSI package with admin privileges and using an undocumented `--pin=111111` parameter to bypass GUI PIN setup requirements. The technique leverages Google's infrastructure and HTTPS/WebRTC protocols, making it more difficult to detect than traditional remote access tools, as it appears as legitimate Google traffic. Defenders should implement application allowlisting solutions, such as AppLocker, and monitor for "Chrome Remote Desktop Host" installations to prevent unauthorized remote access deployments.

Register now and discover how to safeguard every M&A stage.

THREAT DESIGNER

Threat Designer is an AI-driven agent designed to automate and streamline the threat modeling process for secure system design.

AIRMDR (PRODUCT LAUNCH)

AirMDR provides automated playbooks to investigate and respond to threats while constantly learning.

OPENCVE

OpenCVE is an open-source platform designed for efficient monitoring and management of CVEs. It consolidates vulnerability data from sources like MITRE, NVD, RedHat, and Vulnrichment, allowing users to filter, track, and organize based on various criteria such as vendor, product, and severity. Users can subscribe to product updates, receive alerts, analyze changes, and collaborate seamlessly through its user-friendly interface.

BROWSER EXTENSIONS TURN NEARLY 1M BROWSERS INTO WEBSITE-SCRAPING BOTS

Browser extensions that use the MellowTel-js library are being used to scrape websites using users' browsers. The library has close ties with Olostep, a company that bills itself as “the world's most reliable and cost-effective Web scraping API,” suggesting that Olostep is using its installed base of extension users to fulfill scraping requests. 245 extensions that implement this library have been discovered across Chrome, Firefox, and Edge, with a total of nearly 1M users.

JACK DORSEY SAYS HIS ‘SECURE' NEW BITCHAT APP HAS NOT BEEN TESTED FOR SECURITY

After launching his new security-focused, Bluetooth chat app, Bitchat, Jack Dorsey added a warning to its GitHub page that it has not received an external security review and should not be used in production. This disclaimer was prompted by a security researcher who discovered a vulnerability that allowed them to impersonate someone else by intercepting their “identity key” and “peer id pair.” Other security researchers have reported concerns over Dorsey's claims that Bitchat has forward secrecy, as well as reported a potential buffer overflow bug.

GMX HALTS TRADING, TOKEN MINTING FOLLOWING $40M EXPLOIT

The GMX protocol halted trading on GMX V1, the first version of the GMX perpetual exchange deployed on the Arbitrum network, after a liquidity pool suffered an exploit that resulted in $40 million in funds being stolen. The attacked pool is a liquidity provider for the GMX protocol with underlying assets that include Bitcoin, Ether, and stablecoins. Blockchain security company SlowMist attributed the exploit to a design flaw that allowed hackers to manipulate the GLP token price.

AMD WARNS OF NEW MELTDOWN, SPECTRE-LIKE BUGS AFFECTING CPUS

AMD has discovered Transient Scheduler Attack (TSA) vulnerabilities affecting EPYC, Ryzen, and other chips that could potentially enable information disclosure through side-channel attacks requiring local access.

SOUTH KOREAN GOVERNMENT IMPOSES PENALTIES ON SK TELECOM FOR BREACH

South Korea fined SK Telecom only $21,890 for a breach that exposed 27 million customer records, but imposed strict regulatory requirements, including quarterly security assessments, mandatory USIM replacements, and organizational changes that the company expects will cost $511 million in lost revenue.

FOUR ARRESTED IN CONNECTION WITH M&S AND CO-OP CYBER-ATTACKS

The National Crime Agency detained four teenagers aged 17-19 for launching cyberattacks involving ransomware and data theft against M&S, Co-op, and Harrods, with charges including computer misuse, blackmail, and organized crime.

* Get a sneak preview of the CCR module + early waitlist access

CimTrak's new Compliance & Configuration Remediation (CCR) module

shows you exactly HOW YOUR SYSTEMS ALIGN WITH CIS BENCHMARKS AND DISA STIGS, then lets you AUTOMATICALLY CONFIGURE THEM TO COMPLIANCE WITH ONE CLICK while maintaining COMPLETE AUDIT TRAILS.

PERSONAL INFORMATION BELONGING TO CUSTOMERS OF PADDY POWER AND BETFAIR COMPROMISED IN DATA BREACH

Personal information of customers at bookmakers Paddy Power and Betfair has been compromised in a data breach. The parent company, Flutter, notified customers via email that usernames, emails, contact details, first lines of addresses, and cities or towns might have been accessed, but no passwords, ID documents, or payment data were affected.

VIRGINIA COUNTY SAYS APRIL RANSOMWARE ATTACK EXPOSED EMPLOYEE SSNS

The county of Gloucester in Virginia notified over 3,500 employees that their personal information was stolen in an April breach. The stolen data includes names, driver's license numbers, bank account information, health insurance numbers, medical information, and SSNs. The BlackSuit ransomware gang took credit for the breach but the county did not confirm this.