Search the archive

Watch the video (03:13 minutes)

TREND MICRO FIXES CRITICAL VULNERABILITIES IN MULTIPLE PRODUCTS

Trend Micro has released security updates to fix multiple critical-severity remote code execution (RCE) and authentication bypass vulnerabilities in its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. Trend Micro Endpoint Encryption PolicyServer is a central management server for TMEE, providing full disk and removable media encryption for Windows endpoints. The vulnerabilities include three pre-auth RCEs that stem from insecure deserializations and an auth bypass due to a broken auth implementation.

OVER 8M EXPOSED AFTER MAJOR CAR-SHARING APP BREACH

India's largest ride-sharing app, Zoomcar, has notified the SEC that it suffered a data breach that exposed the data of 8.4M individuals. Zoomcar was notified of this breach when the threat actor contacted certain employees about their unauthorized access. The breached data includes names, phone numbers, car registration numbers, personal addresses, and email addresses, but does not include financial information or plaintext passwords.

RANSOMWARE GANG EXPLOITS SIMPLEHELP RMM TO COMPROMISE UTILITY BILLING FIRM

The CISA has released an advisory that a path traversal vulnerability in the SimpleHelp Remote Management and Monitoring (RMM) tool is actively exploited. Sophos reported that the DragonForce ransomware gang is chaining this vulnerability with two other vulnerabilities to deploy ransomware across client networks. Following encryption, the threat actors employ a double extortion strategy, demanding a ransom for the data and threatening to leak the stolen data.

CALL STACKS: NO MORE FREE PASSES FOR MALWARE

Elastic's Windows endpoint telemetry analyzes call stacks to identify both the activity and the performer, enhancing malware detection. The call stacks, or "return address stacks," can be manipulated by malware using return address spoofing and stack frame crafting to conceal malicious actions. Elastic enriches these stacks with module information, applies behavioral tagging, and detects sophisticated evasion tactics like SilentMoonwalk call stack spoofing.

INSIDE THE LOCKBIT'S ADMIN PANEL LEAK: AFFILIATES, VICTIMS AND MILLIONS IN CRYPTO

On May 7, an anonymous hacker named "xoxo from Prague" breached LockBit's admin panel and leaked an SQL database containing operational data from December 2024 to April 2025. The leak revealed that LockBit earned approximately $2.3 million from ransom payments during this period, primarily targeting China and the manufacturing sector, while its registration fee claims were grossly inflated at only $10,000 to $11,000. Additionally, the leak disclosed details about 75 affiliates and their connections to other ransomware groups like RansomHUB, HellCat, and Evil Corp, with affiliates adjusting ransom demands to match company revenues and specific geographic targets.

DECEPTION FUNDAMENTALS: THE MISSING PIECE IN YOUR SECURITY STRATEGY

Current deception technologies fail against skilled attackers due to obvious fake assets that don't align with real infrastructure patterns. Attackers exploit legitimate services and trusted channels, like GitHub OAuth flows, for their own deception. Effective deception involves analyzing real asset patterns and deploying fake assets through trusted communication channels, following the formula: Deception Assets + Communication Channels = Desired Effect. The key principle is congruence—attackers engage with deceptions only when found through expected channels, and the assets match their experience, leading to methodical validation that increases their dwell time.

SHARPEYE

SharpEye is an advanced Linux intrusion detection and system security monitoring framework. It utilizes advanced analytics, machine learning, and behavior-based detections.

ZIP_SMUGGLING

zip_smuggling is a Python utility that creates zip files that contain additional data embedded within the file structure that is not displayed when the zip is examined or decompressed, but can be retrieved via PowerShell via an LNK within the zip file.

IAM-LENS

Get visibility into the IAM permissions in your AWS organizations and accounts. Use your AWS IAM policies (downloaded via iam-collect) and evaluate the effective permissions.

THE META AI APP IS A PRIVACY DISASTER

The standalone Meta AI app has a share button that shows users a preview of their posts and then publishes their conversations within the app. However, many users seem unaware of this sharing. Researchers have discovered conversations that include sensitive PII, users requesting aid with committing tax evasion, and other sensitive information. Notably, Meta does not indicate users' privacy settings when they post.

270K WEBSITES INJECTED WITH ‘JSF-CK' OBFUSCATED CODE

Nearly 270K websites have been compromised with malicious JavaScript Injectors that are obfuscated using the ‘JSF-ck method.' This method uses six ASCII characters to produce working JavaScript code by relying on JavaScript's type coercion to encode numbers and letters using crafted combinations of the characters. It leads to very long and easy-to-detect code, but is challenging to unobfuscate without specialized tools.

MACOS TAHOE BRINGS A NEW DISK IMAGE FORMAT

macOS Tahoe introduces ASIF (Apple Sparse Image Format), a new disk image format that achieves near-native speeds of 4.8-6.6 GB/s, compared to traditional encrypted sparse images that only reach 100 MB/s on Apple silicon Macs. ASIF images, being intrinsically sparse files in APFS, maintain efficient sizes regardless of the host file system, ideal for virtual machines and high-performance storage. This format can be created exclusively with Tahoe's Disk Utility or diskutil command and is designed to work with macOS Sequoia for mounting. It significantly outperforms existing disk image formats, including sparse bundles, by utilizing a single file for storage.

HACKERS SWITCH TO TARGETING U.S. INSURANCE COMPANIES

Hackers from the Scattered Spider group are targeting U.S. insurance companies by employing social engineering tactics such as phishing and fraudulent calls to deceive employees and infiltrate systems.

U.S. SEIZES $7.74M IN CRYPTO TIED TO NORTH KOREA'S GLOBAL FAKE IT WORKER NETWORK

The U.S. confiscated $7.74 million in cryptocurrency connected to North Korean IT workers who used fake identities to gain employment at American companies and funneled money back to North Korea to aid its weapons programs.

REPORT LINKS LOS POLLOS AND RICHADS TO MALWARE TRAFFIC OPERATIONS

Researchers found that some ad companies, like Los Pollos and RichAds, were secretly helping cybercrime groups spread malware.

Get started for $7.99/user/month with 1 TB per user

Time to switch to Proton Drive.

✅ Unlike Google and Microsoft, Proton uses END-TO-END ENCRYPTION, which means nobody—no tech company, no governments, not even Proton—can access your files. No scanning, no sharing, no AI training.

PALO ALTO NETWORKS FIXED MULTIPLE PRIVILEGE ESCALATION FLAWS

Palo Alto Networks fixed seven privilege escalation vulnerabilities in its products, the most severe of which was CVE-2025-4232 (CVSS 7.1), which allows non-administrative macOS users to escalate privileges to root through a wildcard vulnerability in GlobalProtect's log collection feature. The company also patched two authenticated admin command injection flaws in PAN-OS (CVE-2025-4231 and CVE-2025-4230) that enabled authenticated administrators to execute commands as root users. Palo Alto also integrated 11 Chrome security patches and addressed a cache vulnerability in Prisma Access Browser. There were no known active exploits of these vulnerabilities.

DISCORD INVITE LINK HIJACKING DELIVERS ASYNCRAT AND SKULD STEALER TARGETING CRYPTO WALLETS

Attackers are exploiting Discord's invite system by hijacking expired vanity links to redirect users from trusted sources to malicious servers distributing AsyncRAT and Skuld Stealer malware targeting cryptocurrency wallets. The attack, designed to harvest credentials from Exodus and Atomic wallets via injection techniques, employs ClickFix social engineering to trick users into running PowerShell commands that download multi-stage payloads, followed by Skuld Stealer. The campaign targets users in the US, Vietnam, France, Germany, and other countries using trusted cloud services like GitHub, Bitbucket, and Pastebin to blend malicious traffic with legitimate communications.

PARAGUAY SUFFERED DATA BREACH: 7.4 MILLION CITIZEN RECORDS LEAKED ON DARK WEB

Hackers leaked the personal data of 7.4 million people in Paraguay on the dark web. A cybercriminal group called "Cyber PMC" demanded $7.4 million, blaming government corruption and poor security.

HUNTING THROUGH APIS

This blog compares three Microsoft security APIs for threat hunting: Azure Monitor API, which queries Sentinel data only; Graph API, which queries both Defender XDR and Sentinel data, and Defender ATP API, which is limited to Defender for Endpoint data. The Graph API is recommended as it offers unified access to both platforms and supports more data types, while the Defender ATP API has notable limitations, such as a 30-day query timeframe restriction. Each API needs specific permissions and has different rate limits, with the Graph API allowing over 45 calls per minute based on tenant size.

BUILDING UBER'S MULTI-CLOUD SECRETS MANAGEMENT PLATFORM TO ENHANCE SECURITY

Uber initially employed various secrets management practices and vaults for different teams and clouds, which it consolidated into six vaults under the purview of its Secrets team. The Secrets team created scanners to perform real-time scanning and scheduled scanning to identify secrets usage in chat apps and code, as well as built APIs for automated secrets rotation from the centralized secrets vaults. The team also developed a secrets exchange system to distribute secrets to third-party vendors.

WHY IS NO ONE TALKING ABOUT MAINTENANCE IN DETECTION ENGINEERING?

With the movement of detection engineering towards a detection-as-code model, detection engineers must also embrace software maintenance requirements. Maintenance can be broken down into four categories: corrective maintenance, which directly fixes an issue that is occurring; adaptive maintenance, which adapts the detection to changing requirements such as a new API; perfective maintenance, which focuses on improving the query, documentation, or adding new features; and preventative maintenance, which proactively seeks to address issues before clients identify them. Although all detection engineering teams must perform maintenance, there is a dearth of information and posts discussing it.

PRIVADO

Privado is an open-source static scanning tool that detects data flows in your code, identifies data security vulnerabilities, and generates Play Store Data Safety Reports. It identifies over 110 personal data elements and maps their flow from collection points to "sinks" like external third parties, databases, logs, and internal APIs.

CLOUDPEASS

The Cloud Privilege Escalation Awesome Script Suite (CloudPEASS) is a one-stop solution for enumerating permissions, sensitive data, and privilege escalation vectors across AWS, GCP, and Azure.

AWESOME CYBERSECURITY AGENTIC AI

Awesome Cybersecurity Agentic AI is a collection of resources and tools for learning and using agentic AI.

UNUSUAL TOOLSET USED IN RECENT FOG RANSOMWARE ATTACK

Fog ransomware operators attacked an Asian financial firm in May using Syteca monitoring and pentesting tools GC2, Adaptix, and Stowaway. They stayed in the network for two weeks before deploying ransomware. The attackers maintained persistence post-attack and utilized tools often linked to espionage, suggesting intelligence-gathering motives with ransomware as a secondary goal. Since May 2024, Fog ransomware has evolved from targeting US schools through compromised VPNs to exploiting Veeam vulnerabilities and shifted to email infections featuring provocative ransom notes mocking Elon Musk's DOGE agency.

COMING TO APPLE OSES: A SEAMLESS WAY TO IMPORT AND EXPORT PASSKEYS

Apple previewed a new import/export feature for passkeys at the most recent WWDC. The new mechanism will fundamentally differ from current credentials exports that utilize JSONs or CSVs, as it happens directly between participating credentials manager apps without creating insecure files. Data miners have discovered artifacts in newer releases of the Google Authenticator app, suggesting that Google is working on similar functionality for the Android ecosystem, but Google has not announced the feature yet.

MENSTRUAL TRACKING APP DATA IS A ‘GOLD MINE' FOR ADVERTISERS THAT RISKS WOMEN'S SAFETY

Researchers from the University of Cambridge highlight the risks associated with cycle tracking apps (CTAs) and broad data collection practices. CTAs regularly collect and sell sensitive data on women's cycles to advertisers and tech giants without user consent. The researchers are calling on governments to create non-profit, public CTAs or at least require CTAs to offer fine-grained data collection approvals.

WESTJET INVESTIGATES CYBERATTACK DISRUPTING INTERNAL SYSTEMS

WestJet is probing a cyberattack that temporarily hindered its internal systems and app, impacting user login, although access has since been restored.

DUTCH POLICE IDENTIFY USERS AS YOUNG AS 11-YEAR-OLD ON CRACKED.IO HACKING FORUM

Dutch police found children as young as 11 using a hacking forum called Cracked.io.

MICROSOFT CONFIRMS AUTH ISSUES AFFECTING MICROSOFT 365 USERS

Microsoft 365 users are experiencing sign-in and password reset issues due to recent multi-factor authentication (MFA) enhancements, but Microsoft is addressing the problem and has already implemented some improvements.

GITLAB PATCHES HIGH SEVERITY ACCOUNT TAKEOVER AND MISSING AUTH ISSUES

GitLab has released patches that fix critical security issues for its Community and Enterprise versions. It fixed an HTML injection vulnerability that could allow remote attackers to take over accounts by injecting malicious code into the search page. GitLab also patched a missing authorization issue that could allow remote threat actors to inject malicious CI/CD jobs into any project's future CI/CD pipelines in GitLab Ultimate EE servers.

PASSWORD-SPRAYING ATTACKS TARGET 80K MICROSOFT ENTRA ID ACCOUNTS

Researchers at Proofpoint are warning of a password-spraying attack targeting Microsoft Entra ID accounts by a threat actor called UNK_SneakyStrike. The researchers said the peak of the activity occurred on January 8, when 16.5K accounts were targeted in a single day, but the attacks have continued in short bursts since then. Proofpoint identified that the attackers were using the TeamFiltration pentesting framework based on a unique user agent that it uses and other artifacts.

'MAJOR COMPROMISE' AT NHS TEMPING ARM EXPOSED GAPING SECURITY HOLES

NHS Professionals, which provides temporary staff to NHS trusts, suffered a cyberattack in May 2024 when criminals stole its Active Directory database containing user credentials. Despite claiming no data was compromised, internal reports confirm the theft. The organization lacked proper security measures like multi-factor authentication and endpoint detection systems.

THREAT MODELLING CLOUD SERVICE PROVIDERS IN 2025

This post examines the threats posed by government pressure on cloud service providers. The simplest attack vector is for the government to force a cloud provider to deplatform an organization, resulting in a denial of service. Another vector involves the government violating confidentiality by compelling the provider to release sensitive information. This risk can be mitigated by storing critical data on-premises or using confidential computing architecture.

MISBEHAVING MODALITIES: DETECTING TOOLS, NOT TECHNIQUES

Execution Modality is a detection engineering technique that describes how a malicious behavior is executed rather than what the malicious behavior does. Detecting Execution Modality shifts detection closer to the operating system source of truth to create a technique-agnostic detection while preserving necessary context. Given this, Kernel Event Tracing for Windows (ETW) should be considered superior to user-mode ntdll hooking.

“LOCALHOST TRACKING” EXPLAINED. IT COULD COST META 32 BILLION

Meta developed "localhost tracking" to bypass Android's security protections and identify users despite VPNs, incognito mode, and deleted cookies. This post dives into how it works. Meta now faces potential record fines under GDPR, DSA, and DMA regulations totaling up to €32 billion (20% of its €164 billion revenue), as penalties can be applied cumulatively across different violated regulations.

TRIAGEMCP

TriageMCP provides an MCP server to enable an LLM to perform static analysis of a PE file and basic static triage of a PE file.

HIRUNDO (PRODUCT LAUNCH)

Hirundo's Machine Unlearning platform, which also tackles jailbreaks, aims to address issues in the AI core without retraining the model while boosting the accuracy of non-generative applications.

SECOND ORDER

This tool scans web applications for second-order subdomain takeover by crawling apps, collecting URLs (and other data) that match specific rules, or responding in a certain way.

WITH RETAIL CYBERATTACKS ON THE RISE, CUSTOMERS FIND ORDERS BLOCKED AND SHELVES EMPTY

Recent cyberattacks on major retailers are disrupting shopping experiences. United Natural Foods' breach affected Whole Foods' supply chains, while UK retailers like Marks & Spencer and Co-op faced weeks-long outages and empty shelves. These attacks expose customer data and highlight rising ransomware threats targeting consumer-facing businesses for maximum impact.

ECHOLEAK ZERO-CLICK AI ATTACK IN MICROSOFT COPILOT EXPOSES COMPANY DATA

A new security vulnerability named EchoLeak enables hackers to extract company data from Microsoft 365 Copilot using just one email. This attack deceives the AI into violating its own protocols and divulging confidential information, all without requiring any action from the user. Experts caution that this highlights more significant risks associated with designing and using AI tools.

GOOGLE CLOUD AND CLOUDFLARE HIT BY WIDESPREAD SERVICE OUTAGES

Google Cloud and Cloudflare experienced significant outages, disrupting access to various services, including websites and apps, while other platforms such as Spotify and Discord also faced connectivity problems.

K-POP TICKETING PLATFORM YES24 FORCED OFFLINE IN MAJOR RANSOMWARE ATTACK

Yes24, South Korea's K-pop ticketing platform with 20 million users, was attacked by ransomware on June 9th, taking the site offline for four days and disrupting the industry, causing canceled fan events and postponed ticket sales for major artists.

PHISHING SITES POSING AS DEEPSEEK DOWNLOADS DROP A PROXY BACKDOOR

Hackers are deceiving individuals into downloading counterfeit DeepSeek software, which installs a virus named BrowserVenom that covertly alters browser settings to exfiltrate web data via a hacker-controlled proxy.