The Mad Hacker

Falco – Real-Time Threat Detection for Linux and Containers

(Monday May 19, 2025)

Falco is an open-source Linux runtime security tool for containers and Kubernetes. Detect suspicious syscalls, container exploits, and cloud-native threats in real time.

O2 VoLTE: locating any customer with a phone call

(Sunday May 18, 2025)

Privacy is dead: For multiple months, any O2 customer has had their location exposed to call initiators without their knowledge.

Frida 17 is out

(Sunday May 18, 2025)

Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX

Stateful Connection With Spoofed Source IP — NetImpostor

(Saturday May 17, 2025)

This blog reviews the technique for establishing a full stateful TCP connection with a spoofed source IP address from the same subnet using ARP poisoning. The tool introduced in this blog…

[Webinar] From Code to Cloud to SOC: Learn a Smarter Way to Defend Modern Applications

(Saturday May 17, 2025)

Modern apps move fast—faster than most security teams can keep up. As businesses rush to build in the cloud, security often lags behind. Teams scan code in isolation, react late to cloud threats, and monitor SOC alerts only after damage is done. Attackers don’t wait. They exploit vulnerabilities within hours. Yet most organizations take days to respond to critical cloud alerts. That delay isn’t

Beware! A threat actor could steal the titles of your private (and draft) WordPress posts!

(Friday May 16, 2025)

As of today, almost a billion sites have been built using WordPress, powering businesses and organizations of all sizes. That makes any newly discovered vulnerability especially concerning—like the one recently found and reported by Imperva researchers, which could affect any WordPress site. In this blog post, we’ll explain the attack itself, the conditions that made […] The post .

Living-off-the-COM-Type-Coercion-Abuse

(Friday May 16, 2025)

Weekly Update 452

(Friday May 16, 2025)

Funny how excited people can get about something as simple as a sticker. Theyre always in hot demand and occupy an increasingly large portion of my luggage as we travel around. Charlotte reckoned it would be the same for other merch too, so, while Ive been

Skitnet(Bossnet) Malware Analysis

(Friday May 16, 2025)

You need to enable JavaScript to run this app.

Announcing the Official Parity Release of Volatility 3!

(Friday May 16, 2025)

The Volatility Team is very proud and excited to announce the first official release of Volatility 3! This release not only replaces Volatility 2 for modern investigations, but it also introduces many new and exciting features! In this blog post we document many of these new features, give a quick tour of Volatility 3 itself, and provide links to many resources that will help analysts get up to speed on bleeding-edge memory forensics techniques and capabilities. With this official release of Volatility 3, Volatility 2 is now deprecated, and the GitHub repository has been archived.

The Future is Coming Faster than You Think

(Friday May 16, 2025)

At Cisco, we are building the core infrastructure of the AI era. As new solutions like Codex exemplify, the future of AI will be agentic. We envision a future where billions of AI agents are working together harmoniously on our behalf.

New HTTPBot Botnet Launches 200+ Precision DDoS Attacks on Gaming and Tech Sectors

(Friday May 16, 2025)

Cybersecurity researchers are calling attention to a new botnet malware called HTTPBot that has been used to primarily single out the gaming industry, as well as technology companies and educational institutions in China. "Over the past few months, it has expanded aggressively, continuously leveraging infected devices to launch external attacks," NSFOCUS said in a report published this week. "By

Prescription for disaster: Sensitive patient data leaked in Ascension breach

(Friday May 16, 2025)

Ascension, one of the largest private healthcare companies in the United States, has confirmed that the personal data of some 437,329 patients has been exposed following an attack by cybercriminals. Read more in my article on the Fortra blog.

Top 10 Best Practices for Effective Data Protection

(Friday May 16, 2025)

Data is the lifeblood of productivity, and protecting sensitive data is more critical than ever. With cyber threats evolving rapidly and data privacy regulations tightening, organizations must stay vigilant and proactive to safeguard their most valuable assets. But how do you build an effective data protection framework? In this article, we'll explore data protection best practices from meeting

Salt Security Partners With Wiz, Combines Cloud and API Security

(Friday May 16, 2025)

API security orgnanisation Salt Security has announced its expanded partnership and new integration with Wiz, the leader in cloud security. The integration between Salt Security and Wiz enables organisations to detect, comprehend, and respond to both API security posture gaps and critical risks directly within their cloud security infrastructure. The complexity and size of modern […] The post .

Researchers Expose New Intel CPU Flaws Enabling Memory Leaks and Spectre v2 Attacks

(Friday May 16, 2025)

Researchers at ETH Zürich have discovered yet another security flaw that they say impacts all modern Intel CPUs and causes them to leak sensitive data from memory, showing that the vulnerability known as Spectre continues to haunt computer systems after more than seven years. The vulnerability, referred to as Branch Privilege Injection (BPI), "can be exploited to misuse the prediction

Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks

(Friday May 16, 2025)

Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys security researcher Akshay Thorve said in a technical report. "The attack chain leverages mshta.exe for

Wazuh – Open Source Security Platform for Threat Detection, Visibility & Compliance

(Friday May 16, 2025)

Wazuh is a free, open-source security platform for Linux, Windows, and cloud environments. Detect threats, monitor compliance, and analyze logs at scale.

Commit Stomping - Manipulating Git Histories to Obscure the Truth

(Thursday May 15, 2025)

Manipulating Git Histories to Obscure the Truth

Breachforums Boss to Pay $700k in Healthcare Breach

(Thursday May 15, 2025)

In what experts are calling a novel legal outcome, the 22-year-old former administrator of the cybercrime community Breachforums will forfeit nearly $700,000 to settle a civil lawsuit from a health insurance company whose customer data was posted for sale on the forum in 2023. Conor Brian Fitzpatrick, a.k.a. "Pompompurin," is slated for resentencing next month after pleading guilty to access device fraud and possession of child sexual abuse material (CSAM).

Welcoming the Malaysian Government to Have I Been Pwned

(Thursday May 15, 2025)

(National Cyber Coordination and Command Centre of the National Cyber Security Agency) in Malaysia now has full access to query all their government domains via API, and monitor them

Meta to Train AI on E.U. User Data From May 27 Without Consent; Noyb Threatens Lawsuit

(Thursday May 15, 2025)

Austrian privacy non-profit noyb (none of your business) has sent Meta's Irish headquarters a cease-and-desist letter, threatening the company with a class action lawsuit if it proceeds with its plans to train users' data for training its artificial intelligence (AI) models without an explicit opt-in. The move comes weeks after the social media behemoth announced its plans to train its AI models

How the Microsoft Secure Future Initiative brings Zero Trust to life

(Thursday May 15, 2025)

Read how you can improve your security posture by applying Zero Trust framework and principles based on learnings from the April 2025 Secure Future Initiative progress report. The post .

Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428) - watchTowr Labs

(Thursday May 15, 2025)

[Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428)] Keeping your ears to the ground and eyes wide open for the latest vulnerability news at watchTowr is a given. Despite rummaging through enterprise code looking for 0days on a daily basis, our interest was piqued this week when news of fresh vulnerabilities was announced in a close friend - Ivanti, and their Endpoint Manager Mobile (Ivanti EPMM) solution. For those out of the loop, don’t...

Coinbase Agents Bribed, Data of ~1% Users Leaked; $20M Extortion Attempt Fails

(Thursday May 15, 2025)

Cryptocurrency exchange Coinbase has disclosed that unknown cyber actors broke into its systems and stole account data for a small subset of its customers. "Criminals targeted our customer support agents overseas," the company said in a statement. "They used cash offers to convince a small group of insiders to copy data in our customer support tools for less than 1% of Coinbase monthly

Pen Testing for Compliance Only? It's Time to Change Your Approach

(Thursday May 15, 2025)

Imagine this: Your organization completed its annual penetration test in January, earning high marks for security compliance. In February, your development team deployed a routine software update. By April, attackers had already exploited a vulnerability introduced in that February update, gaining access to customer data weeks before being finally detected. This situation isn't theoretical: it

New Chrome Vulnerability Enables Cross-Origin Data Leak via Loader Referrer Policy

(Thursday May 15, 2025)

Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the wild. The high-severity vulnerability, tracked as CVE-2025-4664 (CVSS score: 4.3), has been characterized as a case of insufficient policy enforcement in a component called Loader. "Insufficient policy enforcement in Loader in Google

5 BCDR Essentials for Effective Ransomware Defense

(Thursday May 15, 2025)

Ransomware has evolved into a deceptive, highly coordinated and dangerously sophisticated threat capable of crippling organizations of any size. Cybercriminals now exploit even legitimate IT tools to infiltrate networks and launch ransomware attacks. In a chilling example, Microsoft recently disclosed how threat actors misused its Quick Assist remote assistance tool to deploy the destructive

Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers

(Thursday May 15, 2025)

A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting (XSS) vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET. The activity, which commenced in 2023, has been codenamed Operation RoundPress by the Slovak cybersecurity company. It has

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

(Thursday May 15, 2025)

Cybersecurity researchers have discovered a malicious package named "os-info-checker-es6" that disguises itself as an operating system information utility to stealthily drop a next-stage payload onto compromised systems. "This campaign employs clever Unicode-based steganography to hide its initial malicious code and utilizes a Google Calendar event short link as a dynamic dropper for its final

Smashing Security podcast #417: Hello, Pervert! – Sextortion scams and Discord disasters

(Wednesday May 14, 2025)

Don't get duped, doxxed, or drained! In this episode of "Smashing Security" we dive into the creepy world of sextortion scams, and investigate how crypto wallet firm Ledger's Discord server was hijacked in an attempt to phish for cryptocurrency recovery phrases. All this and more is discussed in the latest edition of the award-winning "Smashing Security" podcast by computer security veterans Graham Cluley and Carole Theriault. Plus! Don't miss our featured interview with Drata's Matt Hillary.

Updates to Cisco’s Executive Leadership Team

(Wednesday May 14, 2025)

With the announcement of Scott Herren's retirement, Mark Patterson will step into the role as Cisco’s Chief Financial Officer on day one of fiscal year 2026. Jeetu Patel has also been promoted to President and Chief Product Officer.

Samsung Patches CVE-2025-4632 Used to Deploy Mirai Botnet via MagicINFO 9 Exploit

(Wednesday May 14, 2025)

Samsung has released software updates to address a critical security flaw in MagicINFO 9 Server that has been actively exploited in the wild. The vulnerability, tracked as CVE-2025-4632 (CVSS score: 9.8), has been described as a path traversal flaw. "Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to

BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan

(Wednesday May 14, 2025)

At least two different cybercrime groups BianLian and RansomExx are said to have exploited a recently disclosed security flaw in SAP NetWeaver tracked as CVE-2025-31324, indicating that multiple threat actors are taking advantage of the bug. Cybersecurity firm ReliaQuest, in a new update published today, said it uncovered evidence suggesting involvement from the BianLian data extortion crew and

Xinbi Telegram Market Tied to $8.4B in Crypto Crime, Romance Scams, North Korea Laundering

(Wednesday May 14, 2025)

A Chinese-language, Telegram-based marketplace called Xinbi Guarantee has facilitated no less than $8.4 billion in transactions since 2022, making it the second major black market to be exposed after HuiOne Guarantee. According to a report published by blockchain analytics firm Elliptic, merchants on the marketplace have been found to peddle technology, personal data, and money laundering

Integrate LDAP into Keycloak to modernize rather than delete it

(Wednesday May 14, 2025)

Learn how to extend your existing LDAP infrastructure using Keycloak—without replatforming. This guide covers integration strategies, SSO, MFA, and identity federation best practices.

CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users

(Wednesday May 14, 2025)

A new global phishing threat called "Meta Mirage" has been uncovered, targeting businesses using Meta's Business Suite. This campaign specifically aims at hijacking high-value accounts, including those managing advertising and official brand pages. Cybersecurity researchers at CTM360 revealed that attackers behind Meta Mirage impersonate official Meta communications, tricking users into handing

[CVE-2025-47916] Invision Community <= 5.0.6 (customCss) Remote Code Execution

(Wednesday May 14, 2025)

This is the personal website of Egidio Romano, a very curious guy from Sicily, Italy. He's a computer security enthusiast, particularly addicted to webapp security.

Patch Tuesday, May 2025 Edition

(Wednesday May 14, 2025)

Microsoft on Tuesday released software updates to fix at least 70 vulnerabilities in Windows and related products, including five zero-day flaws that are already seeing active exploitation. Adding to the sense of urgency with this month's patch batch from Redmond are fixes for two other weaknesses that now have public proof-of-concept exploits available.

Earth Ammit Breached Drone Supply Chains via ERP in VENOM, TIDRONE Campaigns

(Wednesday May 14, 2025)

A cyber espionage group known as Earth Ammit has been linked to two related but distinct campaigns from 2023 to 2024 targeting various entities in Taiwan and South Korea, including military, satellite, heavy industry, media, technology, software services, and healthcare sectors. Cybersecurity firm Trend Micro said the first wave, codenamed VENOM, mainly targeted software service providers, while

ENISA Launches European Vulnerability Database to Bolster EU Cyber Resilience

(Wednesday May 14, 2025)

The European Union Agency for Cybersecurity (ENISA) has unveiled the European Vulnerability Database (EUVD), a strategic move designed to enhance digital security across the bloc and reduce reliance on U.S.-centric cybersecurity infrastructure. The EUVD, now live for consultation, aggregates vulnerability data from a wide range of sources, including national Computer Security Incident Response Teams (CSIRTs), […] The post .

Learning How to Hack: Why Offensive Security Training Benefits Your Entire Security Team

(Wednesday May 14, 2025)

Organizations across industries are experiencing significant escalations in cyberattacks, particularly targeting critical infrastructure providers and cloud-based enterprises. Verizon’s recently released 2025 Data Breach Investigations Report found an 18% YoY increase in confirmed breaches, with the exploitation of vulnerabilities as an initial access step growing by 34%. As attacks rise

Horabot Malware Targets 6 Latin American Nations Using Invoice-Themed Phishing Emails

(Wednesday May 14, 2025)

Cybersecurity researchers have discovered a new phishing campaign that's being used to distribute malware called Horabot targeting Windows users in Latin American countries like Mexico, Guatemala, Colombia, Peru, Chile, and Argentina. The campaign is "using crafted emails that impersonate invoices or financial documents to trick victims into opening malicious attachments and can steal email

Microsoft Fixes 78 Flaws, 5 Zero-Days Exploited; CVSS 10 Bug Impacts Azure DevOps Server

(Wednesday May 14, 2025)

Microsoft on Tuesday shipped fixes to address a total of 78 security flaws across its software lineup, including a set of five zero-days that have come under active exploitation in the wild. Of the 78 flaws resolved by the tech giant, 11 are rated Critical, 66 are rated Important, and one is rated Low in severity. Twenty-eight of these vulnerabilities lead to remote code execution, 21 of them

Fortinet Patches CVE-2025-32756 Zero-Day RCE Flaw Exploited in FortiVoice Systems

(Wednesday May 14, 2025)

Fortinet has patched a critical security flaw that it said has been exploited as a zero-day in attacks targeting FortiVoice enterprise phone systems. The vulnerability, tracked as CVE-2025-32756, carries a CVSS score of 9.6 out of 10.0. "A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera may allow a remote unauthenticated attacker to

Ivanti Patches EPMM Vulnerabilities Exploited for Remote Code Execution in Limited Attacks

(Wednesday May 14, 2025)

Ivanti has released security updates to address two security flaws in Endpoint Manager Mobile (EPMM) software that have been chained in attacks to gain remote code execution. The vulnerabilities in question are listed below - CVE-2025-4427 (CVSS score: 5.3) - An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials

Best Open Source HIDS Tools for Linux in 2025 (Compared & Ranked)

(Wednesday May 14, 2025)

Explore the top open-source Host-based Intrusion Detection Systems (HIDS) for Linux in 2025. Compare features, use cases, and see which tools are worth deploying.

The AI Fix #50: AI brings dead man back for killer’s trial, and the judge loves it

(Tuesday May 13, 2025)

In episode 50 of The AI Fix, AI brings a slain man back from the dead so he can appear at his killer's trial, Mark gets a mysterious phone call, Trump uses AI to become Pope Donald the First, Zuck ponders the nature of friendship, Apple says the quiet part out loud, xAI springs a leak, and a philosophy professor says "so long weather forecasters!" Graham explains why researchers in Oxford have made a digital twin of your grandmother, and Mark looks at the bizarre case of road rage victim Chris Pelkey. All this and much more is discussed in the latest edition of "The AI Fix" podcast by Graham...

China-Linked APTs Exploit SAP CVE-2025-31324 to Breach 581 Critical Systems Worldwide

(Tuesday May 13, 2025)

A recently disclosed critical security flaw impacting SAP NetWeaver is being exploited by multiple China-nexus nation-state actors to target critical infrastructure networks. "Actors leveraged CVE-2025-31324, an unauthenticated file upload vulnerability that enables remote code execution (RCE)," EclecticIQ researcher Arda Büyükkaya said in an analysis published today. Targets of the campaign

Malicious PyPI Package Posing as Solana Tool Stole Source Code in 761 Downloads

(Tuesday May 13, 2025)

Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that purports to be an application related to the Solana blockchain, but contains malicious functionality to steal source code and developer secrets. The package, named solana-token, is no longer available for download from PyPI, but not before it was downloaded 761 times. It was first

AI Agents: Transformative or Turbulent?

(Tuesday May 13, 2025)

Described as revolutionary and disruptive, AI agents are the new cornerstone of innovation in 2025. But as with any technology standing on the cutting edge, this evolution isn’t without its trade-offs. Will this new blend of intelligence and autonomy really introduce a new era of efficiency? Or does the ability for AI Agents to act […] The post .

Two years’ jail for down-on-his-luck man who sold ransomware online

(Tuesday May 13, 2025)

A man has been jailed in Ireland for two years after pleading guilty to offences related to his illegal online business that sold ransomware and other malware, as well as stolen credit card details, and false bank accounts. Read more in my article on the Hot for Security blog.

Deepfake Defense in the Age of AI

(Tuesday May 13, 2025)

The cybersecurity landscape has been dramatically reshaped by the advent of generative AI. Attackers now leverage large language models (LLMs) to impersonate trusted individuals and automate these social engineering tactics at scale. Let’s review the status of these rising attacks, what’s fueling them, and how to actually prevent, not detect, them. The Most Powerful Person on the

North Korean Konni APT Targets Ukraine with Malware to track Russian Invasion Progress

(Tuesday May 13, 2025)

The North Korea-linked threat actor known as Konni APT has been attributed to a phishing campaign targeting government entities in Ukraine, indicating the threat actor's targeting beyond Russia. Enterprise security firm Proofpoint said the end goal of the campaign is to collect intelligence on the "trajectory of the Russian invasion." "The group's interest in Ukraine follows historical targeting

Exploring CNAPP Options for Cloud Security in 2025

(Tuesday May 13, 2025)

Cloud adoption continues to rise, and with it comes increased complexity. Organizations use multiple cloud platforms, creating challenges that traditional security tools struggle to handle. Cloud-Native Application Protection Platforms (CNAPPs) have emerged as vital solutions. CNAPPs offer integrated security across cloud-native environments, from applications and workloads to data and infrastructure. As organizations look to optimize […] The post .

How Compliance Training Software Protects Your Business from Risk

(Tuesday May 13, 2025)

The modern business environment exposes organizations to a range of challenges that affect business operations, hence the need for robust regulations. Ignoring standards and guidelines can lead to costly fines, operational disruptions, and reputational damage. Last year, a US court asked a bank to pay USD$3 billion in fines—the biggest in history—for having weak monitoring […] The post .

Moldovan Police Arrest Suspect in €4.5M Ransomware Attack on Dutch Research Agency

(Tuesday May 13, 2025)

Moldovan law enforcement authorities have arrested a 45-year-old foreign man suspected of involvement in a series of ransomware attacks targeting Dutch companies in 2021. "He is wanted internationally for committing several cybercrimes (ransomware attacks, blackmail, and money laundering) against companies based in the Netherlands," officials said in a statement Monday. In conjunction with the

Türkiye Hackers Exploited Output Messenger Zero-Day to Drop Golang Backdoors on Kurdish Servers

(Tuesday May 13, 2025)

A Türkiye-affiliated threat actor exploited a zero-day security flaw in an Indian enterprise communication platform called Output Messenger as part of a cyber espionage attack campaign since April 2024. "These exploits have resulted in a collection of related user data from targets in Iraq," the Microsoft Threat Intelligence team said. "The targets of the attack are associated with the Kurdish

High Court to decide if information from encrypted app legally obtained

(Monday May 12, 2025)

The High Court will today consider whether information gathered from encrypted messaging on an app known as AN0M, which was secretly controlled by the FBI and the Australian Federal Police, was legally obtained.

Marbled Dust leverages zero-day in Output Messenger for regional espionage

(Monday May 12, 2025)

Since April 2024, the threat actor that Microsoft Threat Intelligence tracks as Marbled Dust has been observed exploiting user accounts that have not applied fixes to a zero-day vulnerability (CVE-2025-27920) in the messaging app Output Messenger, a multiplatform chat software. These exploits have resulted in collection of related user data from targets in Iraq. Microsoft […] The post .

Statistical Analysis to Detect Uncommon Code

(Monday May 12, 2025)

26 Jan 2023 - Tim Blazytko Statistical analysis is a set of methods which analyze and organize data to discover its underlying structure. One of the most common use cases in computer science is machine learning the mathematical foundation. However, often, even the simplest analysis techniques are powerful enough to significantly simplify day-to-day tasks. In this blog post, I will show you how such a be used to identify uncommon instruction sequences in binary code. It is not only fun to see...

ASUS Patches DriverHub RCE Flaws Exploitable via HTTP and Crafted .ini Files

(Monday May 12, 2025)

ASUS has released updates to address two security flaws impacting ASUS DriverHub that, if successfully exploited, could enable an attacker to leverage the software in order to achieve remote code execution. DriverHub is a tool that's designed to automatically detect the motherboard model of a computer and display necessary driver updates for subsequent installation by communicating with a

⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI-Powered Scams

(Monday May 12, 2025)

What do a source code editor, a smart billboard, and a web server have in common? They’ve all become launchpads for attacks—because cybercriminals are rethinking what counts as “infrastructure.” Instead of chasing high-value targets directly, threat actors are now quietly taking over the overlooked: outdated software, unpatched IoT devices, and open-source packages. It's not just clever—it’s

How I ruined my vacation by reverse engineering WSC

(Monday May 12, 2025)

Posted at — May 8, 2025 In this post I will briefly describe the journey I went through while implementing defendnot, a tool that disables Windows Defender by using the Windows Security Center (WSC) service API directly. Even though this is most likely not what you expected to see here, but rather than going into full technical details on how everything works, I will describe what rabbitholes I went through and how painful everything was due to my ✨special✨ environment. Beware, most...

SUDO_KILLER – Auditing Sudo Configurations for Privilege Escalation Paths

(Monday May 12, 2025)

SUDO_KILLER is a Bash script that audits sudo configurations on Unix-like systems, identifying misconfigurations and vulnerabilities for potential privilege escalation.

The Persistence Problem: Why Exposed Credentials Remain Unfixed—and How to Change That

(Monday May 12, 2025)

Detecting leaked credentials is only half the battle. The real challenge—and often the neglected half of the equation—is what happens after detection. New research from GitGuardian's State of Secrets Sprawl 2025 report reveals a disturbing trend: the vast majority of exposed company secrets discovered in public repositories remain valid for years after detection, creating an expanding attack

Fake AI Tools Used to Spread Noodlophile Malware, Targeting 62,000+ via Facebook Lures

(Monday May 12, 2025)

Threat actors have been observed leveraging fake artificial intelligence (AI)-powered tools as a lure to entice users into downloading an information stealer malware dubbed Noodlophile. "Instead of relying on traditional phishing or cracked software sites, they build convincing AI-themed platforms – often advertised via legitimate-looking Facebook groups and viral social media campaigns,"

One-Click RCE in ASUS’s Preinstalled Driver Software

(Sunday May 11, 2025)

One-Click RCE in ASUS’s Preinstalled Driver Software Part Two of this series on ASUS will be dropping within a week, yes it somehow manages to get worse Introduction This story begins with a conversation about new PC parts. After ignoring the advice from my friend, I bought a new ASUS motherboard for my PC. I was a little concerned about having a BIOS that would by default silently install software into my OS in the background.

Weekly Update 451

(Saturday May 10, 2025)

The Have I Been Pwned Alpine Grand Tour is upon us! Ive often joked that work is always either sitting at my desk at home in isolation or on the other side of the world, and so it is with this trip. As weve done with

Exploiting DLL Search Order Hijacking in Microsoft Edge’s Trusted Directory: A Red Team Tactic

(Saturday May 10, 2025)

Google Pays $1.375 Billion to Texas Over Unauthorized Tracking and Biometric Data Collection

(Saturday May 10, 2025)

Google has agreed to pay the U.S. state of Texas nearly $1.4 billion to settle two lawsuits that accused the company of tracking users' personal location and maintaining their facial recognition data without consent. The $1.375 billion payment dwarfs the fines the tech giant has paid to settle similar lawsuits brought by other U.S. states. In November 2022, it paid $391 million to a group of 40

Germany Shuts Down eXch Over $1.9B Laundering, Seizes €34M in Crypto and 8TB of Data

(Saturday May 10, 2025)

Germany's Federal Criminal Police Office (aka Bundeskriminalamt or BKA) has seized the online infrastructure and shutdown linked to the eXch cryptocurrency exchange over allegations of money laundering and operating a criminal trading platform. The operation was carried out on April 30, 2025, authorities said, adding they also confiscated 8 terabytes worth of data and cryptocurrency assets

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources

(Friday May 09, 2025)

Unit 42 details a new malware obfuscation technique where threat actors hide malware in bitmap resources within .NET applications. These deliver payloads like Agent Tesla or XLoader. Unit 42 details a new malware obfuscation technique where threat actors hide malware in bitmap resources within .NET applications. These deliver payloads like Agent Tesla or XLoader.

BREAKING: 7,000-Device Proxy Botnet Using IoT, EoL Systems Dismantled in U.S. - Dutch Operation

(Friday May 09, 2025)

A joint law enforcement operation undertaken by Dutch and U.S. authorities has dismantled a criminal proxy network that's powered by thousands of infected Internet of Things (IoT) and end-of-life (EoL) devices, enlisting them into a botnet for providing anonymity to malicious actors. In conjunction with the domain seizure, Russian nationals, Alexey Viktorovich Chertkov, 37, Kirill Vladimirovich

OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities

(Friday May 09, 2025)

The North Korean threat actors behind the Contagious Interview campaign have been observed using updated versions of a cross-platform malware called OtterCookie with capabilities to steal credentials from web browsers and other files. NTT Security Holdings, which detailed the new findings, said the attackers have "actively and continuously" updated the malware, introducing versions v3 and v4 in

WatchGuard transitions new CEO

(Friday May 09, 2025)

WatchGuard® Technologies, a provider of unified cybersecurity for managed service providers (MSPs), today announced a planned leadership transition. After a decade of impactful leadership, Chief Executive Officer (CEO) Prakash Panjwani will transition out of his operational role, continuing to serve on the Board of Directors and as a strategic advisor to the company. Vats Srivatsan, […] The post .

Initial Access Brokers Target Brazil Execs via NF-e Spam and Legit RMM Trials

(Friday May 09, 2025)

Cybersecurity researchers are warning of a new campaign that's targeting Portuguese-speaking users in Brazil with trial versions of commercial remote monitoring and management (RMM) software since January 2025. "The spam message uses the Brazilian electronic invoice system, NF-e, as a lure to entice users into clicking hyperlinks and accessing malicious content hosted in Dropbox," Cisco Talos

LockBit ransomware gang breached, secrets exposed

(Friday May 09, 2025)

Oh dear, what a shame, never mind. Read more in my article on the Tripwire State of Security blog.

Deploying AI Agents? Learn to Secure Them Before Hackers Strike Your Business

(Friday May 09, 2025)

AI agents are changing the way businesses work. They can answer questions, automate tasks, and create better user experiences. But with this power comes new risks — like data leaks, identity theft, and malicious misuse. If your company is exploring or already using AI agents, you need to ask: Are they secure? AI agents work with sensitive data and make real-time decisions. If they’re not

Beyond Vulnerability Management – Can You CVE What I CVE?

(Friday May 09, 2025)

The Vulnerability Treadmill The reactive nature of vulnerability management, combined with delays from policy and process, strains security teams. Capacity is limited and patching everything immediately is a struggle. Our Vulnerability Operation Center (VOC) dataset analysis identified 1,337,797 unique findings (security issues) across 68,500 unique customer assets. 32,585 of them were distinct

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

(Friday May 09, 2025)

Cybersecurity researchers have flagged three malicious npm packages that are designed to target the Apple macOS version of Cursor, a popular artificial intelligence (AI)-powered source code editor. "Disguised as developer tools offering 'the cheapest Cursor API,' these packages steal user credentials, fetch an encrypted payload from threat actor-controlled infrastructure, overwrite Cursor's

What Should You Consider When Choosing an AI Penetration Testing Company?

(Friday May 09, 2025)

AI is truly making its way into every aspect of business operations, and rightly so. When we proactively test systems and applications to uncover weaknesses before attackers do, we’re carrying out penetration testing, often called “ethical hacking.” By staging these controlled attacks that mimic real-world threats, we expose gaps in processes and controls. AI penetration […] The post .

Hackers hit deportation airline GlobalX, leak flight manifests, and leave an unsubtle message for “Donnie” Trump

(Friday May 09, 2025)

GlobalX Airlines, a charter airline being used by the US government for deportation flights, has been attacked by hacktivists who have made off with what they claim are detailed flight records and passenger manifests. Read more in my article for the Hot for Security blog.

] The Mad Hacker [

Collecting all the news about Cybersecurity, computer security, cracking, hacking, infosec, netsec, & security vunerabilities in one convenient place