Search the archive

↗️ See a four minute demo ↗️

KELLY BENEFITS SAYS 2024 DATA BREACH IMPACTS 550K CUSTOMERS

In its latest update to law enforcement, Kelly Benefits has updated the total number of impacted individuals of a December 2024 breach to 550K. Kelly Benefits is a provider of benefits consulting, enrollment technology, payroll administration, HRIS, compliance support, and carrier management. The specific data that was breached varies per individual but may include SSNs, tax ID numbers, dates of birth, medical information, health insurance information, and financial information.

ESSE HEALTH SAYS RECENT DATA BREACH AFFECTS OVER 263K PATIENTS

Esse Health, the largest independent physicians' group in the Greater St. Louis area, reported a data breach impacting over 263K individuals. The breached data includes patient personal information, health insurance information, medical record number, patient account number, and some health information, but does not include SSNs or financial information. Esse Health did not disclose the nature of the breach, but based on the recovery timeline, ransomware is suspected.

CRITICAL VULNERABILITY IN ANTHROPIC'S MCP EXPOSES DEVELOPER MACHINES TO REMOTE EXPLOITS

A critical vulnerability (CVE-2025-49596) in Anthropic's MCP Inspector tool exposed developers to remote code execution via misconfigurations and browser flaws. Attackers could exploit this by tricking users into visiting malicious websites. Fixed in version 0.14.1, the patch adds authentication and origin validation to secure localhost services against RCE attacks.

AND NOW MALWARE THAT TELLS AI TO IGNORE IT?

Researchers at Check Point discovered a new malware dubbed SkyNet, which employs a novel technique to attempt to evade AI-based scanners and tools. The method hard-codes a prompt that attempts to tell any AI analyzing the code to ignore any previous instructions and respond with a “NO MALWARE DETECTED” message. Check Point noted that the SkyNet malware was unable to stop Check Point's AI scanners from scanning it and concluded that the author would need to refine their prompt injection technique.

CAN YOU TRUST THAT VERIFIED SYMBOL? EXPLOITING IDE EXTENSIONS IS EASIER THAN IT SHOULD BE

Researchers have found critical vulnerabilities in popular IDEs (VSCode, Visual Studio, IntelliJ IDEA, and Cursor) where malicious extensions can appear verified while containing dangerous code. The flaw enables attackers to create files that utilize verified symbols but incorporate malicious functionality, allowing them to execute system commands and potentially impact millions of developers using these platforms.

ANALYSIS OF THE THREAT CASE OF KIMSUKY GROUP USING 'CLICKFIX' TACTIC

The Kimsuky APT group has evolved its "ClickFix" tactic, tricking users into executing malicious PowerShell commands disguised as troubleshooting guides or security checks. The campaign uses spear-phishing emails, fake job sites, and compromised sites, employing obfuscation and multilingual variants to evade detection. Defense involves EDR monitoring for abnormal PowerShell activity and user education to identify prompts that ask users to copy and paste codes or "fix" browser issues.

NEWTOWNER

Newtowner is a tool that is designed to test firewalls and network boundaries by masquerading traffic to appear as if it's coming from various data centers around the world

SQLMAP COMMAND BUILDER

Advanced SQLMap command builder with an intuitive cheatsheet UI. Works locally in your browser as a single HTML file (no data sent anywhere).

X64DBG: TYPE SYSTEM AND MODERNIZATION

x64dbg is an open-source Windows debugger designed to simplify reverse engineering and malware analysis. This release features a revamped type system with support for bitfields, enums, and anonymous types from the Windows SDK, as well as significant performance improvements for complex data analysis. New features include AVX-512, half-float support for modern applications, workflow enhancements such as copying function graphs and arguments, and a modernized build system with cross-platform capabilities.

AT&T ROLLS OUT “WIRELESS LOCK” FEATURE TO BLOCK SIM SWAP ATTACKS

AT&T has announced a new “Wireless Lock” feature to protect users from SIM swap attacks. When the new feature is enabled, customers and employees will be unable to port the phone number to a new SIM card or transfer it to a new provider until the setting is disabled. Wireless Lock also protects certain billing information, authorized users, and phone numbers.

CLOUDFLARE WILL NOW BLOCK AI CRAWLERS BY DEFAULT

US SHUTS DOWN A STRING OF NORTH KOREAN IT WORKER SCAMS

The U.S. disrupted North Korean IT scams involving fake remote workers at over 100 companies that stole data and $1.6M+ in crypto, with eleven suspects facing charges.

MICROSOFT OPEN-SOURCES VS CODE COPILOT CHAT EXTENSION ON GITHUB

Microsoft has made the GitHub Copilot Chat extension for VS Code open-source, allowing everyone to see and use its code.

AT&T DEPLOYS NEW ACCOUNT LOCK FEATURE TO COUNTER SIM SWAPPING

AT&T has introduced a Wireless Account Lock feature that enhances security by preventing unauthorized changes and alerting customers of account updates, with only main account holders able to manage it.

Read the full findings →

OVER 1,200 CITRIX SERVERS UNPATCHED AGAINST CRITICAL AUTH BYPASS FLAW

Over 1,200 Citrix NetScaler ADC and Gateway appliances remain unpatched against CVE-2025-5777 ("Citrix Bleed 2"), a critical authentication bypass vulnerability that allows attackers to hijack user sessions and bypass multi-factor authentication. ReliaQuest reports with medium confidence that the flaw is already being actively exploited, with indicators including hijacked web sessions, suspicious IP address usage, and Active Directory reconnaissance activities. Organizations must immediately patch their NetScaler appliances and terminate all active ICA and PCoIP sessions to prevent session hijacking attacks similar to those seen in previous CitrixBleed ransomware campaigns.

STABLECOIN PROTOCOL RESUPPLY LOSES $9.6M TO PRICE MANIPULATION EXPLOIT

Decentralized finance (DeFi) protocol Resupply confirmed a security breach in its wstUSR market which resulted in $9.6M in losses. The attacker used a price manipulation exploit to inflate the share price which allowed them to borrow $10M reUSD with minimal collateral. Resupply paused the contracts to prevent further damage upon detection.

ZURICH NON-PROFIT HIT BY RANSOMWARE, SWISS FEDERAL DATA AT RISK

Radix, a Zurich-based non-profit health foundation, was hit by a ransomware attack on June 16. The Sarcoma group released 1.3TB of stolen data after ransom demands failed. The breach affected data from Swiss federal offices that trusted Radix, though attackers didn't access Federal Administration systems directly. Swiss authorities are investigating the attack and warned of potential future phishing campaigns using the stolen data.

HACKER CONVERSATIONS: RACHEL TOBAC AND THE ART OF SOCIAL ENGINEERING

Rachel Tobac, CEO of SocialProof Security, demonstrates how social engineers exploit psychological principles, such as the principles of urgency, authority, and scarcity, to trick targets into revealing sensitive information or credentials. Her methods involve OSINT research, AI-generated voice clones, background audio effects, and caller ID spoofing to craft convincing stories that bypass human verification. Organizations should enhance identity checks beyond simple data, such as birthdates and addresses, as attackers can easily obtain this information from data brokers to impersonate real customers.

USING AI TO IDENTIFY CYBERCRIME MASTERMINDS

Sophos researchers created an AI framework that analyzes 11,558 posts from 4,441 individuals across 124 dark web forums, mapping discussions to CVE exploits and MITRE CAPEC patterns. It clusters threat actors by skill, commitment, and activity, identifying 14 "professional" actors (3.9%) with high expertise and a focused approach. This automated method helps threat teams prioritize investigations and reduce manual analysis when spotting key criminals.

COMPARING SEMGREP PRO AND COMMUNITY WHITEPAPER

Static Application Security Testing (SAST) is crucial for modern application security. Semgrep has become popular due to its accessible Community Edition. This research compares Semgrep's free and commercial versions, showing that Semgrep Code identifies more findings and achieves better true positive rates than the Community Edition.

ZERORISC (PRODUCT LAUNCH)

ZeroRISC offers cloud security solutions aimed at ensuring transparency and reliability for data centers, ICS, other OT systems, and IoT devices.

PWN

PWN is an open security automation framework that aims to stand on the shoulders of security giants, promoting trust and innovation. Build your own custom automation drivers freely and easily using pre-built modules.

PROFESSIONAL PENTESTER TOOLBOX

The TCM Security team has compiled a list of their favorite tools for external pentests, internal pentests, AD tools, reconnaissance, web app testing, and physical pentesting.

NORDIC'S LARGEST APPLE PREMIUM PARTNER BREACHED, HACKERS CLAIM

The Kraken ransomware group claims to have breached Humac, the Nordic region's largest Apple Premium Partner, stealing financial information, customer data, and employee details. Cybernews verified that the leaked data appears legitimate. The data includes employee records, internal files, and database samples from the retailer, which has over 120 stores across Europe. The breach poses risks - stolen employee data could enable phishing to access Apple support platforms, and customer info could aid fraud.

CANADA GIVES HIKVISION THE BOOT ON NATIONAL SECURITY GROUNDS

Canada ordered Chinese surveillance company Hikvision to cease operations on national security grounds. The partly state-owned firm is banned from government use, with existing equipment under review. Hikvision called the decision unfounded and said it was geopolitically motivated.

SINALOA DRUG CARTEL HIRED A CYBERSNOOP TO IDENTIFY AND KILL FBI INFORMANTS

A Sinaloa cartel informant told the FBI in 2018 that the drug gang was paying hackers to spy on federal agents and people working with law enforcement. The hackers could break into phones, hack into Mexico City's security cameras, and track where people went. The cartel used this information to threaten and kill witnesses.

SQUAREX REVEALS THAT EMPLOYEES ARE NO LONGER THE WEAKEST LINK, BROWSER AI AGENTS ARE

SquareX's research indicates that Browser AI Agents are now more vulnerable to cyberattacks than employees due to their limited security awareness and inability to recognize warning signs, such as suspicious links.

JOINT STATEMENT FROM CISA, FBI, DC3, AND NSA ON POTENTIAL TARGETED CYBER ACTIVITY AGAINST U.S. CRITICAL INFRASTRUCTURE BY IRAN

Iranian hackers might target US systems with weak passwords and outdated software, so agencies advise vigilance.

EUROPOL DISMANTLES $540 MILLION CRYPTOCURRENCY FRAUD NETWORK, ARRESTS FIVE SUSPECTS

Europol dismantled a crypto scam operation involving 'pig butchering' schemes that defrauded over 5,000 victims worldwide of €460 million, leading to five arrests in Spain.

need for safe, productive AI adoption across your organization.

Our platform lets you rapidly prototype, deploy, and manage AI agents that transform workflows - all with built-in security and governance. No more choosing between innovation and data protection.

now.

HACKERS STOLE DATA ON 2.2 MILLION PEOPLE IN CYBERATTACK AFFECTING AMERICAN GROCERY CHAINS

Dutch conglomerate Ahold Delhaize disclosed that over 2.2 million people had personal data stolen in a November cyberattack. The breach exposed Social Security numbers, financial information, and health data. The INC ransomware gang has claimed responsibility, allegedly stealing six terabytes of data.

ALOHA, YOU'VE BEEN PWNED: HAWAIIAN AIRLINES DISCLOSES ‘CYBERSECURITY EVENT'

Hawaiian Airlines disclosed a cybersecurity incident on June 23 affecting IT systems, though flights continue operating normally. Security experts suspect the Scattered Spider gang, known for targeting retail and insurance sectors, was involved. The airline immediately engaged authorities and cybersecurity experts.

BLUETOOTH FLAWS COULD LET HACKERS SPY THROUGH YOUR MICROPHONE

Three vulnerabilities in Airoha Bluetooth chipsets affect 29 audio devices from major brands like Bose, Sony, and JBL, allowing attackers within Bluetooth range to eavesdrop on conversations and hijack phone connections. The flaws enable the extraction of call history and contacts and the ability to initiate calls to arbitrary numbers by exploiting missing authentication in Bluetooth protocols. While technically serious, practical attacks require physical proximity and high technical skills, limiting the threat to high-value targets in sensitive industries.

DISSECTING RDP ACTIVITY

This blog post examines RDP activity using Windows event logs for cybersecurity forensics. It identifies important event IDs for successful logins (1149 and 4624), failed attempts (4625), and session changes to detect brute-force attacks. The author demonstrates how correlating these events helps create timelines to reconstruct attacker behavior.

LEVERAGING GOOGLE ADK FOR CYBER INTELLIGENCE

This blog explains how to set up a multi-agent system for threat intelligence gathering and analysis. It uses Kafka, DSPy, and Neo4j to coordinate specialized agents that discover, collect, and process security feeds. The system extracts IOCs, maps threats to MITRE ATT&CK, and builds comprehensive threat intelligence graphs with natural language querying capabilities.

WHAT SHOULD I WORK ON NEXT? A FRAMEWORK FOR HIGH-IMPACT SECURITY WORK

To drive maximal efficiency on teams, security managers should optimize the work they assign based on business goals, implicit interest, and personal growth. Security managers should seek out projects that allow them to establish a strong connection between business goals and the engineering roadmap. Given multiple projects with similar levels of business impact, managers should then consider assigning work that fits best with engineers' interests and personal growth objectives.

REVENG AI (PRODUCT LAUNCH)

RevEng AI enables security engineers and malware analysts to identify malicious components and verify the integrity of software supply chains without requiring access to source code.

SBT-SBOM

The sbt-sbom plugin creates CycloneDX-compatible Software Bill of Materials (SBOM) files from sbt projects for security tools. You can customize the BOM and choose dependencies. It supports both XML and JSON formats.

CLOUDFLARE OPEN-SOURCES ORANGE MEETS WITH END-TO-END ENCRYPTION

Cloudflare has added end-to-end encryption to its open-source video app, Orange Meets, making video calls more secure. The app utilizes a robust group encryption protocol and allows users to verify their safety number to prevent potential attacks. Orange Meets is a demo for developers and privacy fans, not a full-featured video chat tool like Zoom or Google Meet.

IDENTITY THEFT HITS 1.1M REPORTS — AND AUTHENTICATION FATIGUE IS ONLY GETTING WORSE

This article discusses the balance between security and user convenience in authentication. With fraud increasing, businesses must offer multiple authentication options (passwords, passkeys, 2FA, and MFA) since customer preferences vary. Future authentication will use continuous risk-based signals rather than one-time logins, while AI complicates bot detection.

TRY THIS ONE WEIRD TRICK RUSSIAN HACKERS HATE

Installing a Russian or Ukrainian virtual keyboard can block many ransomware strains that check the system language to avoid infecting their home countries. Microsoft's June 2021 patches fix six actively exploited zero-day vulnerabilities that attackers use for privilege escalation and ransomware deployment. Security researchers have identified connections between the DarkSide and REvil ransomware groups, with both sharing exclusion lists and operational patterns.

SCHREMS' PRIVACY NGO FILES COMPLAINT AGAINST DATING APP BUMBLE'S AI FEATURE

Privacy group Noyb has filed a complaint with the Austrian authorities against the dating app Bumble's use of generative AI in its “AI Icebreaker” feature. Noyb is concerned about how data is being sent to OpenAI's servers while only displaying a pop-up, which Noyb considers “fake” consent. Bumble has responded that it takes precautions with its users' data and does not send any special category data.

THE FBI WARNS THAT SCATTERED SPIDER IS NOW TARGETING THE AIRLINE SECTOR

The FBI has issued a warning that the cybercrime group Scattered Spider is now targeting the airline industry by deceiving employees and IT help desks to steal data and bypass security measures.

LET'S ENCRYPT ENDS CERTIFICATE EXPIRY EMAILS TO CUT COSTS, BOOST PRIVACY

Let's Encrypt discontinued its certificate expiration email notifications as of June 4, citing high costs, privacy concerns, and the widespread adoption of automated certificate renewal tools that make manual notifications unnecessary.