Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Commit Stomping is a way to change Git commit timestamps to hide when changes were made. This can make it hard to track who did what and when, especially during audits or code reviews. To protect against it, use signed commits, log events, and watch for unusual patterns.
GitGuardian's analysis of 15 million DockerHub images revealed 100,000 valid secrets exposing databases, AWS infrastructures, GitHub Enterprise instances, and Artifactory repositories. 97% were found in image layers, with 60% created before 2024 and over 2,000 dating back to 2020, showing secrets often go unrotated for years. Docker images leak secrets due to build issues like persistent layers and build argument leaks, making regular security audits essential, as prevention is cheaper than responding to breaches.
A PowerShell script that provides an AMSI Bypass via RPC Hijack, which exploits the COM-level mechanics that AMSI uses when delegating scan requests to antivirus providers.
A set of exercises and resources to learn about malware development.
KEVIntel displays known exploited vulnerabilities (KEVs) cataloged from over 50 public sources, including CISA, and our private sensors (once we get some hits). Each entry links to a CVE identifier, enriched with EPSS scores, online mentions, scanner inclusion, exploitation, and other metadata. The goal is to serve as an early warning system, even before CISA publishes it.
Documentation is important for detections to explain to SOC analysts what the rule detects, how to investigate the alert, any necessary enrichments, how to identify a false positive, and any necessary steps if it is a true positive. This post compares documentation with rules generated by LLMs to those written by humans using examples from Elastic's open-source rule sets. The evaluation found that roughly 60% of investigative steps provided by the LLM matched human-created ones, but also noted that humans tended to provide a larger number of detailed investigative steps.
An iOS app called "My Book List" leaked personal data from 42,000 users due to poor security. Hackers could use this data for phishing and targeted attacks. Experts found that many iOS apps make the same mistake by exposing secret information in their code.
Emails impersonating IT or HR departments trick the most users. Over 60% of deceptive emails reference internal teams, with nearly 50% mentioning HR. The highest click rates were for subject lines like “zoom clips” from managers and HR training reports, and warnings.
Chris Hadnagy lost his defamation lawsuit against DEFCON after being banned from the conference for sexual misconduct.
At Pwn2Own Berlin 2025, hackers earned $260,000 on the first day by exploiting zero-day vulnerabilities in Windows 11, Red Hat Linux, and Oracle VirtualBox.
Police from five countries shut down a fake online trading platform that stole over €3 million from victims.
Sponsored
Intel, AMD, and Arm have released security advisories on CPU vulnerabilities, including a branch privilege injection issue (CVE-2024-45332) that revives Spectre-BTI attacks on Intel processors. Intel is issuing microcode updates for this vulnerability and others identified by ETH Zurich and VU Amsterdam, which found three new Spectre v2 attacks that undermine domain isolation. In total, Intel patched 25 additional advisories for various high and medium-severity vulnerabilities, while AMD addressed several high-severity flaws in its Manageability Tools and CPU Libraries.
The website of iClicker, which provides a student engagement platform, was compromised in a ClickFix attack. The attack prompted users to click on a fake CAPTCHA, which copied a PowerShell command to users' clipboards and then instructed them to run it. The PowerShell script downloaded a legitimate Microsoft Visual C++ Redistributable if the script detected that it was in a malware sandbox or an unknown malware that is possibly an infostealer if it was running on a regular machine.
Luxury brand Dior experienced a customer data breach in China that exposed an undisclosed number of users' data. The stolen data included customers' names, genders, phone numbers, email addresses, mailing addresses, purchase amounts, and shopping preferences, but not financial data. Chinese users have expressed an erosion of brand trust on the Chinese social media site RedNote.
Passkeys employ public-key cryptography for authentication. The user's device creates a digital signature with a private key, while the website verifies it using a public key, reducing password vulnerabilities. WebAuthn provides vital anti-phishing protections through origin binding, ensuring passkeys are functional only with their respective websites. Different authenticator types balance security and convenience. The passkey ecosystem supports cryptographic extensions for functionalities such as key derivation and secure storage. However, developers must implement account recovery mechanisms, as lost passkeys cannot be reconstructed.
Modern C2 implants will use sleep obfuscation where the implant encrypts itself and stays dormant for a period of time before decrypting itself, fetching and performing operations, and then repeating the cycle by encrypting itself again. This makes detection difficult because it is unlikely that an EDR will scan the system while the implant is decrypted. This author explores how to utilize Time Travel Debugging to detect when an implant decrypts itself and makes network calls. They note that this method is very successful but can be bypassed by malware authors by extending the sleep period to make the manual analysis untenable or by unloading the attached debugging DLL.
Attackers leveraged a leaked AWS access key from an organization management account to establish multiple persistence mechanisms, including a "persistence-as-a-service" Lambda function triggered by API Gateway that creates new IAM users on demand. Previously unreported tactics included disabling trusted access for organization-level services, manipulating AWS Identity Center (SSO) to create backdoor users without MFA requirements, and operating from Telegram IP addresses. The attackers implemented comprehensive persistence strategies to survive credential revocation, demonstrating sophisticated knowledge of AWS services and security mechanisms.
EntraFalcon is a PowerShell-based tool for pentesters, security analysts, and sysadmins to evaluate the security of a Microsoft Entra ID environment.
oneiromancer is a reverse engineering assistant that uses a locally running LLM fine-tuned for Hex-Rays pseudo-code to aid with code analysis. It can analyze a function or a smaller code snippet to return a high-level description of the code's actions, recommended function names, and variable renaming suggestions.
An AI wrapper for SQLMap that simplifies SQL injection testing. It features automated result analysis, step suggestions, and adaptive testing with DBMS optimizations for MySQL, MSSQL, Oracle, and PostgreSQL. It also includes adaptive WAF Bypass, which dynamically selects tamper scripts based on WAF detection.
This blog post provides an in-depth discussion of the new Microsoft Resilient File System (ReFS) and details how it differs from NTFS from a forensics perspective. It highlights the challenges during the transitional period, such as a gap in tooling maturity, no Master File Table, a lack of undo logs in ReFS' logging, changes in the Change Journal, and various removed NTFS features. However, ReFS also offers new forensics opportunities, including the ReFS Log and “First Events,” the potential for carving opportunities in superblocks and checkpoints, the potential for deleted data to persist if shared with another file, integrity streams traces, and other metadata.
Hardware wallet provider Ledger notified users that it has secured its Discord server following an attacker's compromise of a moderator's account. The moderator's account was used to notify Discord members of a bogus vulnerability that required users to verify their recovery phrases with a scam link. Ledger reported that after some delays in reporting the issue due to the compromised account muting and banning other Ledger moderators, the compromised account was removed, and the bot was deleted.
The author found a serious security flaw in ASUS's DriverHub software that could let hackers run code with admin rights. They explained how the system could be tricked using subdomains and a silent install trick. ASUS fixed the problem after it was reported, but credited someone else.
In August 2024, a Windows update disrupted Linux booting on dual-boot systems due to a Secure Boot modification, which Microsoft fixed by May 2025, advising users to install the latest updates.
Google Chrome is set to discontinue running with admin rights to enhance security by restricting harmful files from gaining full system access, similar to a recent update in Edge.
North Korean hackers stole $88 million by using fake identities for remote tech jobs in the U.S., creating fake companies, resumes, and job references to deceive employers.
Sponsored
You can't control what users click on. When they're distracted or in a rush, they might give attackers red carpet access that bypasses every well-crafted control in your Microsoft 365 environment.
Hackers can exploit a vulnerability in VMware Tools to tamper with virtual machines. Broadcom has released patches to fix the issue, which affects Windows and Linux versions 12.x.x and 11.x.x. Users are urged to apply the fixed version 12.5.2 to secure their virtual machines.
Security company Andy Frain Services reported a data breach affecting over 100,000 people. Discovered in October 2024, the Black Basta ransomware group claimed responsibility, allegedly stealing 750GB of sensitive files. Impacted individuals are being offered credit monitoring and identity restoration services.
Charter airline GlobalX reported unauthorized network access on May 5, prompting incident response protocols and cybersecurity expert involvement. As a government deportation contractor, the breach potentially exposed flight records and passenger manifests.
The APT37 threat actor from North Korea launched a March 2025 spear phishing campaign, posing as a South Korean national security think tank, which delivered malicious LNK files via Dropbox that ultimately installed the RoKRAT backdoor. Dubbed "Operation: ToyBox Story," the attack employed fileless malware techniques to evade detection, with the RoKRAT backdoor capturing screenshots and system info before encrypting and exfiltrating data to cloud-based command servers. The attackers utilized legitimate cloud services (Dropbox, pCloud, and Yandex) as C2 infrastructure and Russian Yandex email addresses, specifically targeting activists focused on North Korea.
Attackers use PyInstaller to package malicious Python code into standalone Mach-O executables for macOS, eliminating the need for Python installation. This attack involves bundling obfuscated infostealer code (string reversal, base85 encoding, XOR encryption, and zlib compression) that extracts credentials from password prompts, executes malicious AppleScript, steals from the keychain, and targets cryptocurrency wallets. Upon execution, these binaries create temporary directories with the extracted Python libraries and malicious code, which exist only during the malware's runtime.
This blog post examines a sophisticated card-stealing malware that exploited a vulnerability in an outdated Magento eCommerce site. The first stage of the malware injects obfuscated JS onto every page that loads a PHP script, which masquerades as a GIF and sets up a reverse proxy to intercept all requests before modifying the responses to hide its activity and planting a trigger in the user's User Agent. A second tampered file, onestepcheckout[.]phtml, loads the payload out of the User Agent into sessionStorage, and if the trigger is detected, the onestepcheckout injection detonates on the checkout page.
PowerDodder is a post-exploitation persistence utility designed to stealthily embed execution commands into existing script files on the host. By leveraging frequently accessed but rarely modified files, it targets high-likelihood execution vectors with minimal detection risk.
MottaHunter is an advanced email reconnaissance tool designed for security professionals. It allows users to search for emails on Google, Twitter, and LinkedIn, validate them through SMTP, and create intelligent permutations. Features include rate limiting, catch-all detection, and permutation splitting for discrete operations.
Cynomi offers virtual CISO agents that can assess a network, plan a set of security policies, make remediation plans, track progress, run analytics to find vulnerabilities in a network, recommend system optimizations, and produce reports on the network's status and health.
During a recent cyberattack, Marks & Spencer confirmed that hackers stole customer data, including names, dates of birth, addresses, phone numbers, and order histories. The retailer is resetting passwords while experiencing ongoing store and online disruptions. DragonForce allegedly claimed responsibility for this and other UK retail hacks.
Patrick Opet, CISO of JPMorgan Chase, penned an open letter addressing the increasing prevalence of SaaS as the preferred or exclusive method of distributing third-party software. Opet highlighted issues where third-party suppliers prioritize new features to compete with their competitors over security and where authentication and authorization are blurring together, leading to architectural vulnerabilities and hidden dependencies that the vendors themselves use. He calls on third parties to prioritize security and calls upon practitioners to push back against solutions that do not do so.
Amazon Cognito has announced the release of a new feature that allows customers on the Essentials or Plus tiers to configure automatic refresh token rotation for user pool clients. Before this feature, customers had to choose between long-lived tokens to reduce user friction at the cost of reduced security or short-lived tokens that were more secure but required users to reauthenticate more frequently.
A member of the DoppelPaymer ransomware group was arrested in Moldova for ransomware attacks and money laundering targeting organizations in the Netherlands.
Android 16 enhances security with AI tools to combat scams, malware, and theft, blocking fake messages and warning users during risky calls.
The EU has introduced a vulnerability database (EUVD) to complement the U.S.-based CVE system by tracking security flaws pertinent to Europe and aiding new cybersecurity regulations.
Sponsored
Based on 8,306 interviews with security professionals, the new 2025 Cost of Insider Risks [5] report highlights the scope of the insider threat problem, and the cost vs opportunity of insider risk management.
Berkeley Research Group (BRG), a financial advisory firm working on multiple church bankruptcy cases, has disclosed a data breach. BRG was involved in at least ten bankruptcy cases involving dioceses and archdioceses nationwide.
Pearson has reported that an attacker breached its systems and stole “legacy” data. Other sources revealed that the stolen data was obtained via an exposed .git/config file containing a GitLab Personal Access Token (PAT), which was used to obtain hardcoded secrets for cloud platforms and data stores from source code. The stolen data allegedly contains customer information, financials, support tickets, and source code.