Cisco Talos is warning potential crypto job seekers in India of a malware campaign by the North Korean Famous Chollima group. Fake employers are approaching software engineers, marketing employees, and designers with skill-testing pages to apply for positions at cryptocurrency companies like Coinbase, Archblock, and Robinhood. These pages feature ClickFix attacks, which prompt victims to run malicious code to fix errors. The code eventually downloads infostealer malware to steal browser credentials and session tokens.
The China-linked hacking group Salt Typhoon breached the satellite company Viasat and other global telecom providers. They exploited security flaws in network devices to conduct espionage across multiple countries. Officials confirmed that customer data remained secure and the vulnerabilities were addressed.
The `pull_request_target` event is infamous because it opens up room for abuse by running in the context of the base repo with full secrets access and write permissions to the GITHUB_TOKEN. Sysdig found repositories belonging to MITRE, Splunk, and a popular open-source Spotify client that could be hijacked via `pull_request_target` abuse. Sysdig recommends using the `pull_request` event instead, along with workflow splitting and restricting GITHUB_TOKEN permissions to avoid these issues.
Cloudflared is a popular tunneling service offered by Cloudflare that legitimate organizations or adversaries can utilize to establish persistence. Cloudflared authenticates using tokens that contain the account ID, tunnel ID, and a secret. Ransomware groups often do not vary their Cloudflare accounts, so detecting anomalous tokens or renamed processes can be effective for threat hunting.
Sponsored
As your business evolves, so do risk & compliance challenges. Drata's [11] AI-Native Trust Management platform simplifies oversight, keeps you ahead of regulations, and ensures you never miss a requirement. Scale faster. Stay compliant. Sleep better. Get a personalized demo of
Loris is a stateful fuzz testing framework designed to explore and analyze baseband firmware.
Frida is a dynamic toolkit for reverse engineering, security research, and runtime analysis across various platforms and languages. Version 17.2.0 focuses on simplifying package discovery with the `frida-pm` CLI tool. The release features a streamlined package manager for easily searching and installing Frida-specific packages using `frida-pm search` and `frida-pm install`, even without Node.js.
This is an MCP (Model Context Protocol) server for pycti that provides a front-end interface to OpenCTI threat intelligence data. The server condenses and normalizes OpenCTI data into JSON format for LLMs, making field names more verbose and resolving GraphQL-linked entities to provide better response context. It includes three main tools for looking up observables, adversaries, and reports in OpenCTI, and can run either as a TCP server or STDIO server.
Ryan Cox shares lessons from leading the incident response for a high-stakes incident that stretched about a month. Cox stresses the importance of proactively establishing interdepartmental relationships so that during an incident, you have SMEs that you can rely upon. Cox also reminds incident commanders to avoid diving too deeply into tasks and losing the big picture. Lastly, Cox stresses the importance of having scalable processes around documentation and other often forgotten topics and conducting post-mortem root-cause analysis.
A hacker group called Banana Squad hid malware in fake GitHub projects that looked like real tools. Their attacks stole sensitive data from thousands of computers before being discovered. Even though malware in open-source software dropped in 2024, attacks are getting smarter, so users need to be careful.
2025.06.20·hackread.com·2 min read·GitHub repository·TLDR InfoSec A huge leak of 16 billion credentials was reported, but it is just a collection of old stolen data, not a new breach. These credentials were taken by malware or past hacks and have been shared online for years.
Meta has announced plans to roll out passkey support to its Facebook apps “soon” with Messenger and other apps to follow.
Hackers linked to Israel's Predatory Sparrow group stole and destroyed over $90 million in cryptocurrency from Iran's largest exchange, Nobitex.
Scammers are placing fraudulent customer support numbers on legitimate websites such as Apple, Netflix, and PayPal, using deceptive web addresses to make them look like they're part of the official help pages.
Sponsored
🚨53% of organizations faced multiple severe security incidents last year — and now, companies must not only prevent attacks, but endure, respond, and build trust through disruption. The ones investing in trust are pulling ahead.
2025.06.19·d2swt604.na1.hs-sales-engage.com·Sponsor·TLDR InfoSec The Anubis ransomware-as-a-service operation added a new wiper module to its malware that destroys targeted files, making recovery impossible even if the ransom is paid. The new /WIPEMODE command requires key-based authentication and then erases all file contents, reducing the file size to 0 KB. This functionality presumably increased Anubis' pressure on victims during negotiations.
Check Point Research discovered a campaign conducted by the Stargazers Ghost Network that leverages approximately 500 different GitHub repositories to target Minecraft players with trojanized and malicious mods. The mods contain a JAR loader which downloads the Java-based stealer from Pastebin. The stealer attempts to steal Minecraft account tokens, data from popular third-party launchers, and Discord and Telegram account tokens before acting as a loader for a traditional info stealer which attempts to steal information from web browsers, VPN account data, cryptocurrency wallets, etc.
Noma Security researchers discovered the "AgentSmith" vulnerability (CVE score 8.8) in LangChain's LangSmith platform, allowing malicious AI agents in the public Prompt Hub to steal sensitive user data, including OpenAI API keys, through hidden proxy configurations. When users adopted and ran these compromised agents, all their communications and private data would be secretly intercepted through the attacker's server in a man-in-the-middle attack, potentially leading to unauthorized account access, data theft, and financial losses. LangChain fixed the vulnerability on November 6, 2024, after responsible disclosure and implemented new safety measures, including warning messages and banners for agents with custom proxy settings.
A 3-part guide to implementing SIEM and SOAR platforms for security professionals and executives. The first part is designed for executives and introduces the concept of SIEM and SOAR, explains how they function, provides guidance for choosing a SIEM, and cautions organizations on attempting to implement a SOAR before properly implementing and testing a SIEM. The second and third parts are for implementers.
Researchers from Zimperium zLabs unveiled a new variant of the GodFather Android malware that uses on-device virtualization to deploy real banking and cryptocurrency apps in a controlled sandbox. This method allows attackers to monitor and steal user credentials stealthily, as the malware disguises itself by installing a hidden host app that redirects users to virtualized versions of these applications. Primarily targeting 12 Turkish financial institutions, the malware affects 484 applications globally and employs overlays and Android accessibility services to enhance control over devices.
At ShowMeCon 2025 in St. Charles, cybersecurity experts noted that while compliance frameworks like PCI DSS provide necessary structure, they are often treated as mere formalities rather than integral to operational security. They stressed the importance of human oversight in AI-driven policy creation and threat detection, acknowledging that adversaries also use AI for more sophisticated attacks. The key takeaway was that compliance should be a foundational step.
Sponsored
Hybrid teams and remote workers have completely blurred the lines of the security perimeter, creating ample room for human error and misuses of credentials (which together cause 85% of data breaches). Learn how to protect your hybrid workforce while keeping everyone productive - read the free ebook [11] or request a demo [12].
Tracecat is an open-source automation platform built for security and IT engineers that uses YAML-based templates for integrations with a no-code UI for workflows. It is designed to be a free, open-source alternative to tools like Tines or Splunk SOAR.
This repository provides Terraform code that demonstrates how multi-cloud federated user and workload authentication can be utilized.
A user-mode code and its rootkit that will kill EDR processes permanently by leveraging the power of Process Creation Blocking Kernel Callback Routine registering and ZwTerminateProcess.
Turkish intelligence announced that it caught seven suspects who belonged to a Chinese espionage ring eavesdropping on Uyghurs and Turkish officials. The attackers used IMSI-catcher devices to mimic legitimate mobile phone tower signals to collect data, phone logs, conversations, and other information from nearby phones. The attackers funded their operations by hacking into and draining the bank accounts of Turkish civilians.
Jordan Whitehead delves into reversing the Anzu in-game ad client's usage in the Trackmania racing game. First, Whitehead built a DLL harness to enumerate the functions that Trackmania called from the anzu.dll and iterated on it to uncover further debug information and arguments. He then used mitmproxy to intercept network traffic and was able to utilize this to view the JavaScript functionality that managed targeted ads and replace ad campaigns with his own custom campaigns, serving images from localhost.
Tenable researchers discovered a misconfiguration in Google's Gerrit code collaboration platform that could have allowed attackers to inject malicious code into popular Google projects like ChromiumOS, Bazel, and Dart through supply chain attacks. The vulnerability, dubbed "GerriScary" (CVE-2025-1568), exploited improper permissions for the addPatchSet feature and a race condition in the automated merge process, allowing attackers to modify approved code changes without triggering new reviews. Google fixed the issue across all Chrome/ChromeOS-related projects after Tenable's October 2024 report, awarded a $5,000 bug bounty, and found no evidence of prior exploitation.
Thai police raided the Antai Holiday Hotel in Pattaya, arresting at least 20 foreigners, including six Chinese nationals involved in a ransomware operation targeting Chinese companies, and apprehending around 20 individuals running an illegal gambling ring while seizing laptops, mobile devices, and gambling equipment.
Qualys disclosed two new Linux vulnerabilities (CVE-2025-6018 and CVE-2025-6019) that can be chained together to allow unprivileged attackers to gain full root access, while CISA separately warned that an older Linux kernel flaw (CVE-2023-0386) is being actively exploited in the wild.
Sponsored
⚰️ Windows 10 is being laid to rest, and it's taking free security updates with it.
Cybersecurity researchers at SafetyDetectives reported that they discovered a post selling a breached database from VirtualMacOSX.com. VirtualMacOSX.com offers cloud-based Mac server plans from their server farms in Canada. The breached data includes full names, financial data, contact info, and passwords.
Researchers from c/side are reporting on a new attack vector that abuses Google OAuth links to bypass detection. The attack begins in a compromised Magento e-commerce portal, which includes an OAuth logout with a callback parameter containing an obfuscated JavaScript payload. The code will only activate under certain conditions, such as if the URL includes the word “checkout.”
TaxOff threat actors exploited a Google Chrome zero-day vulnerability (CVE-2025-2783) in March to deploy the Trinper backdoor through phishing emails disguised as forum invitations. The backdoor, written in C++, uses multithreading to steal files, capture keystrokes, and maintain command-and-control communications with remote servers. Google patched the vulnerability after Kaspersky reported the exploitation. Researchers suspect TaxOff may be connected to another hacking group called Team46 based on similar attack patterns.
This post provides a roadmap for growing a new or existing program through four phases of maturity. The first phase focuses on establishing the basics by appointing a Head of Security, establishing a governance process, conducting a breach assessment, and acting on the most critical results. The second phase focuses on comparing the organization's current state with established frameworks, developing a plan to close gaps, hiring MSSPs, and building a team. Phases 3 and 4 focus on furthering organizational maturity by establishing program management and aligning with business objectives, establishing continuous monitoring and guardrails, increasing resiliency, and training the team.
This post demonstrates how to exploit vulnerable Windows Secure Enclaves (VBS) by leveraging read-write primitives to achieve VTL1 code execution through ROP chaining and function table manipulation. It shows how CVE-2023-36880 and CVE-2024-21423 can be exploited in Microsoft Edge's preferences enclave to patch the VertValidTargetTable, enabling arbitrary function calls within the secure environment. The research resulted in practical sleep masking techniques for malware that hide implant memory from EDR detection by storing code in VTL1 while the implant sleeps, which has been integrated into the Outflank C2 and Beacon Booster tools.
Sponsored
With heightened geopolitical instability, now's the time to prepare your workforce for threats to industry and physical infrastructure.
A collection of AI red teaming labs that were used in the BlackHat 2024 AI Red Teaming in Practice course.
CRADLE is a powerful tool for Cyber Threat Intelligence (CTI) analysts that combines collaborative note-taking, automated data linking, and dynamic visualizations for easy capture, analysis, and sharing of threat intelligence. It centralizes everything securely for incident investigation and report generation.
MICROSANDBOX is a self-hosted platform that securely runs untrusted user or AI-generated code using microVMs. It provides fast startup times (200ms) and strong isolation. It supports MCP and works with standard container images and OCI format containers.
Meta is adding targeted ads to WhatsApp's Updates feature. Despite the company reassuring users that the ads will only use data such as location and language and that messages remain end-to-end encrypted, many privacy experts expressed concern due to previous privacy issues with Meta's apps.
Cyberattacks often target community groups like hospitals and schools that lack the resources to defend themselves. Experts say stronger support from the government, private companies, and volunteers is needed to protect them. A new report calls for expanding cyber volunteer networks and creating shared security services.
Mobile wallets like Apple Pay are safer than cards, but they can still be hacked. Thieves can use features like Express Transit mode to steal money, even from locked phones. Users should turn off risky features and use strong security settings to stay safe.
2025.06.18·paymentvillage.substack.com·2 min read·TLDR InfoSec Hackers exploit a black market known as Hacklink to embed deceptive links in reputable websites, manipulating Google to elevate malicious or fraudulent sites in search rankings.
Paddle will pay $5 million to settle charges that it helped scammers trick people into buying fake tech support.
Sponsored
Attackers used stolen domain admin credentials to infiltrate a hospital network - aiming to deploy remote access tools, steal sensitive data, and unleash ransomware.