The Mad Hacker

What the NULL?! Wing FTP Server RCE (CVE-2025-47812)

(Monday June 30, 2025)

June 30, 2025 | Uncategorized While performing a penetration test for one of our Continuous Penetration Testing customers, we’ve found a Wing FTP server instance that allowed anonymous connections. It was almost the only interesting thing exposed, but we still wanted to get a foothold into their perimeter and provide the customer with an impactful finding. So we unboxed our Binary Ninja and started digging. Spoiler: We ended up getting remote code execution as root. GOOD OLD ANONYMOUS! So...

Senator Chides FBI for Weak Advice on Mobile Security

(Monday June 30, 2025)

Agents with the Federal Bureau of Investigation (FBI) briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff Susie Wiles was reportedly used to fuel a series of text messages and phone calls impersonating her to U.S. lawmakers. But in a letter this week to the FBI, one of the Senate's most tech-savvy lawmakers says the feds aren't doing enough to recommend more appropriate security protections that are already built into most consumer mobile devices.

C4 Bomb: Blowing Up Chrome’s AppBound Cookie Encryption

(Monday June 30, 2025)

In July 2024, Google introduced a new feature to better protect cookies in Chrome: AppBound Cookie Encryption. This new feature was able to disrupt the world of infostealers, forcing the malware...

Flipper Blackhat June Roundup

(Monday June 30, 2025)

U.S. Agencies Warn of Rising Iranian Cyberattacks on Defense, OT Networks, and Critical Infrastructure

(Monday June 30, 2025)

U.S. cybersecurity and intelligence agencies have issued a joint advisory warning of potential cyber-attacks from Iranian state-sponsored or affiliated threat actors. "Over the past several months, there has been increasing activity from hacktivists and Iranian government-affiliated actors, which is expected to escalate due to recent events," the agencies said. "These cyber actors often

Europol Dismantles $540 Million Cryptocurrency Fraud Network, Arrests Five Suspects

(Monday June 30, 2025)

Europol on Monday announced the takedown of a cryptocurrency investment fraud ring that laundered €460 million ($540 million) from more than 5,000 victims across the world. The operation, the agency said, was carried out by the Spanish Guardia Civil, along with support from law enforcement authorities from Estonia, France, and the United States. Europol said the investigation into the syndicate

État de l’art sur le phishing Azure en 2025 (partie 1) – Device code flow

(Monday June 30, 2025)

Découvrez comment le device code flow peut être détourné pour du phishing sur Azure Entra ID et comment s’en protéger avec une Conditional Access Policy.

Blind Eagle Uses Proton66 Hosting for Phishing, RAT Deployment on Colombian Banks

(Monday June 30, 2025)

The threat actor known as Blind Eagle has been attributed with high confidence to the use of the Russian bulletproof hosting service Proton66. Trustwave SpiderLabs, in a report published last week, said it was able to make this connection by pivoting from Proton66-linked digital assets, leading to the discovery of an active threat cluster that leverages Visual Basic Script (VBS) files as its

New free 7h OpenSecurityTraining2 class: "Fuzzing 1001: Introductory white-box fuzzing with AFL++" by Francesco Pollicino is now released

(Monday June 30, 2025)

Leveraging Credentials As Unique Identifiers: A Pragmatic Approach To NHI Inventories

(Monday June 30, 2025)

Identity-based attacks are on the rise. Attacks in which malicious actors assume the identity of an entity to easily gain access to resources and sensitive data have been increasing in number and frequency over the last few years. Some recent reports estimate that 83% of attacks involve compromised secrets. According to reports such as the Verizon DBIR, attackers are more commonly using stolen

⚡ Weekly Recap: Airline Hacks, Citrix 0-Day, Outlook Malware, Banking Trojans and more

(Monday June 30, 2025)

Ever wonder what happens when attackers don’t break the rules—they just follow them better than we do? When systems work exactly as they’re built to, but that “by design” behavior quietly opens the door to risk? This week brings stories that make you stop and rethink what’s truly under control. It’s not always about a broken firewall or missed patch—it’s about the small choices, default settings

Comparing Semgrep Community and Code for Static Analysis

(Monday June 30, 2025)

PDF Document

OnionC2 – Tor Powered Rust Command and Control Framework

(Monday June 30, 2025)

OnionC2 is a Tor-powered C2 framework with a Rust agent and Go server, designed for secure, anonymized red team operations with Windows persistence and stealth.

Leveraging Google's Agent Development Kit for Automated Threat Analysis

(Sunday June 29, 2025)

Over the past month, I’ve been working on a project for the Google ADK agent hackathon. This post provides an overview of my current multi-agent system, used for threat intelligence gathering, processing, and analysis.

FBI Warns of Scattered Spider's Expanding Attacks on Airlines Using Social Engineering

(Saturday June 28, 2025)

The U.S. Federal Bureau of Investigation (FBI) has revealed that it has observed the notorious cybercrime group Scattered Spider broadening its targeting footprint to strike the airline sector. To that end, the agency said it's actively working with aviation and industry partners to combat the activity and help victims. "These actors rely on social engineering techniques, often impersonating

BreachForums broken up? French police arrest five members of notorious cybercrime site

(Saturday June 28, 2025)

Suspected high-ranking members of one of the world's largest online marketplaces for leaked data have been arrested by French police. Read more in my article on the Hot for Security blog.

GIFTEDCROOK Malware Evolves: From Browser Stealer to Intelligence-Gathering Tool

(Saturday June 28, 2025)

The threat actor behind the GIFTEDCROOK malware has made significant updates to turn the malicious program from a basic browser data stealer to a potent intelligence-gathering tool. "Recent campaigns in June 2025 demonstrate GIFTEDCROOK's enhanced ability to exfiltrate a broad range of sensitive documents from the devices of targeted individuals, including potentially proprietary files and

Facebook’s New AI Tool Asks to Upload Your Photos for Story Ideas, Sparking Privacy Concerns

(Saturday June 28, 2025)

Facebook, the social network platform owned by Meta, is asking for users to upload pictures from their phones to suggest collages, recaps, and other ideas using artificial intelligence (AI), including those that have not been directly uploaded to the service. According to TechCrunch, which first reported the feature, users are being served a new pop-up message asking for permission to "allow

When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365"

(Friday June 27, 2025)

June 27, 2025 — by Leonid Hartmann TL;DR We discovered a leaked credential that allowed anyone unauthorized access to all Microsoft tenants of organizations that use Synology’s “Active Backup for Microsoft 365” (ABM). This flaw could be leveraged by malicious actors to obtain potentially sensitive information — such as all messages in Microsoft Teams channels. It was reported to Synology and tracked as This blog post contains the full technical walk-through and discovery of the...

Unveiling RIFT: Enhancing Rust malware analysis through pattern matching

(Friday June 27, 2025)

As threat actors are adopting Rust for malware development, RIFT, an open-source tool, helps reverse engineers analyze Rust malware, solving challenges in the security industry. The post .

Over 1,000 SOHO Devices Hacked in China-linked LapDogs Cyber Espionage Campaign

(Friday June 27, 2025)

Threat hunters have discovered a network of more than 1,000 compromised small office and home office (SOHO) devices that have been used to facilitate a prolonged cyber espionage infrastructure campaign for China-nexus hacking groups. The Operational Relay Box (ORB) network has been codenamed LapDogs by SecurityScorecard's STRIKE team. "The LapDogs network has a high concentration of victims

How Betting Sites Keep Your Information Safe (Without You Even Noticing)

(Friday June 27, 2025)

Ever wondered what’s going on behind the scenes when you place a bet online? No, not the odds or the algorithms that somehow know your team’s about to blow a 2–0 lead again – we’re talking about the security side of things. Because let’s face it: if you’re logging in, placing wagers, and moving money […] The post .

End-to-End Encryption: Architecturally Necessary

(Friday June 27, 2025)

Good intentions don’t always result in good outcomes. This is especially the case with recent suggestions regarding end-to-end-encryption adaptability requirements for number independent communication services. Not only is security an issue, the suggestions themselves go against the design of the I…

PUBLOAD and Pubshell Malware Used in Mustang Panda's Tibet-Specific Attack

(Friday June 27, 2025)

A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community. The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians' Convention on Tibet (WPCT), China's education policy in the Tibet Autonomous Region (TAR), and a recently published book by the 14th Dalai Lama,

Business Case for Agentic AI SOC Analysts

(Friday June 27, 2025)

Security operations centers (SOCs) are under pressure from both sides: threats are growing more complex and frequent, while security budgets are no longer keeping pace. Today’s security leaders are expected to reduce risk and deliver results without relying on larger teams or increased spending. At the same time, SOC inefficiencies are draining resources. Studies show that up to half of all

SafePay ransomware: What you need to know

(Friday June 27, 2025)

SafePay is a relatively new ransomware that is making a big impact. Find out how it is different from other ransomware, and read more in my article on the Fortra blog.

Chinese Group Silver Fox Uses Fake Websites to Deliver Sainbox RAT and Hidden Rootkit

(Friday June 27, 2025)

A new campaign has been observed leveraging fake websites advertising popular software such as WPS Office, Sogou, and DeepSeek to deliver Sainbox RAT and the open-source Hidden rootkit. The activity has been attributed with medium confidence to a Chinese hacking group called Silver Fox (aka Void Arachne), citing similarities in tradecraft with previous campaigns attributed to the threat actor.

Defining Cyber Resilience: Industry Leaders Meet in London as AI Threats Accelerate

(Friday June 27, 2025)

Last week, Check Point hosted its annual Cyber Leader Summit at Landing Forty-Two in London’s iconic Leadenhall Building. The summit convened influential figures from the cybersecurity, law enforcement, and enterprise communities to explore the rapidly evolving threat landscape and the transformative role of artificial intelligence. Key discussions focused on the urgent need for proactive, resilience-focused […] The post .

MOVEit Transfer Faces Increased Threats as Scanning Surges and CVE Flaws Are Targeted

(Friday June 27, 2025)

Threat intelligence firm GreyNoise is warning of a "notable surge" in scanning activity targeting Progress MOVEit Transfer systems starting May 27, 2025—suggesting that attackers may be preparing for another mass exploitation campaign or probing for unpatched systems.MOVEit Transfer is a popular managed file transfer solution used by businesses and government agencies to share sensitive data

OneClik Malware Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors

(Friday June 27, 2025)

Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with Chinese-affiliated threat actors, though attribution remains cautious," Trellix researchers Nico Paulo

Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails

(Friday June 27, 2025)

Varonis Threat Labs uncovered a phishing campaign with M365's Direct Send feature that spoofs internal users without ever needing to compromise an account.

Sububy – A Modular Ruby Suite for Subdomain Enumeration

(Friday June 27, 2025)

Sububy is a modular Ruby-based subdomain enumeration tool for OSINT, red teaming, and bug bounty reconnaissance. Includes cert, brute, API, and screenshot modules.

Building Critical Infrastructure for the AI Era

(Thursday June 26, 2025)

This is a new era for networking, and a significant opportunity for our customers, enabling them to navigate the complexities of building AI Infrastructure with confidence and unparalleled security. The innovations showcased at Cisco Live represent a fundamental leap forward in how we think about, build, and operate networks.

Critical Open VSX Registry Flaw Exposes Millions of Developers to Supply Chain Attacks

(Thursday June 26, 2025)

Cybersecurity researchers have disclosed a critical vulnerability in the Open VSX Registry ("open-vsx[.]org") that, if successfully exploited, could have enabled attackers to take control of the entire Visual Studio Code extensions marketplace, posing a severe supply chain risk. "This vulnerability provides attackers full control over the entire extensions marketplace, and in turn, full control

When Your Login Page Becomes the Frontline: Lessons from a Real-World DDoS Attack

(Thursday June 26, 2025)

As an IAM SaaS company, our work often remains in the shadows—until something goes wrong. Today, I want to shed light on how we handle security at the very first layer all IAM systems have: the login page. Specifically, I’ll walk you through an incident we managed at Cloud-IAM, where we provide a managed Keycloak solution, and share some insights on securing authentication systems against evolving DDoS threats.

Building security that lasts: Microsoft’s journey towards durability at scale

(Thursday June 26, 2025)

In late 2023, Microsoft launched its most ambitious security transformation to date, the Microsoft Secure Future Initiative (SFI). An initiative with the equivalent of 34,000 engineers working across 14 product divisions, supporting more than 20,000 cloud services on 1.2 million Azure subscriptions, the scope is massive. These services operate on 21 million compute nodes, protected by 46.7 million certificates, and developed across 134,000 code repositories. The post .

Scanning Beyond the Patch: A Public-Interest Hunt for Hidden Shells

(Thursday June 26, 2025)

Even after patching, many edge devices remain compromised. This post explores how to ethically scan for backdoors left behind.

Critical RCE Flaws in Cisco ISE and ISE-PIC Allow Unauthenticated Attackers to Gain Root Access

(Thursday June 26, 2025)

Cisco has released updates to address two maximum-severity security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that could permit an unauthenticated attacker to execute arbitrary commands as the root user. The vulnerabilities, assigned the CVE identifiers CVE-2025-20281 and CVE-2025-20282, carry a CVSS score of 10.0 each. A description of the defects is

New FileFix Method Emerges as a Threat Following 517% Rise in ClickFix Attacks

(Thursday June 26, 2025)

The ClickFix social engineering tactic as an initial access vector using fake CAPTCHA verifications increased by 517% between the second half of 2024 and the first half of this year, according to data from ESET. "The list of threats that ClickFix attacks lead to is growing by the day, including infostealers, ransomware, remote access trojans, cryptominers, post-exploitation tools, and even

Marketplace Takeover: How We Could’ve Taken Over Every Developer Using a VSCode Fork - Putting Millions at Risk

(Thursday June 26, 2025)

TL;DR: We discovered a critical vulnerability in open-vsx.org, the open-source VS Code extensions marketplace powering popular VSCode forks like Cursor, Windsurf and VSCodium, used by over 8,000,000…

The Hidden Risks of SaaS: Why Built-In Protections Aren't Enough for Modern Data Resilience

(Thursday June 26, 2025)

SaaS Adoption is Skyrocketing, Resilience Hasn’t Kept Pace SaaS platforms have revolutionized how businesses operate. They simplify collaboration, accelerate deployment, and reduce the overhead of managing infrastructure. But with their rise comes a subtle, dangerous assumption: that the convenience of SaaS extends to resilience. It doesn’t. These platforms weren’t built with full-scale data

Iranian APT35 Hackers Targeting Israeli Tech Experts with AI-Powered Phishing Attacks

(Thursday June 26, 2025)

An Iranian state-sponsored hacking group associated with the Islamic Revolutionary Guard Corps (IRGC) has been linked to a spear-phishing campaign targeting journalists, high-profile cyber security experts, and computer science professors in Israel. "In some of those campaigns, Israeli technology and cyber security professionals were approached by attackers who posed as fictitious assistants to

Cyber Criminals Exploit Open-Source Tools to Compromise Financial Institutions Across Africa

(Thursday June 26, 2025)

Cybersecurity researchers are calling attention to a series of cyber attacks targeting financial organizations across Africa since at least July 2023 using a mix of open-source and publicly available tools to maintain access. Palo Alto Networks Unit 42 is tracking the activity under the moniker CL-CRI-1014, where "CL" refers to "cluster" and "CRI" stands for "criminal motivation." It's suspected

CISA Adds 3 Flaws to KEV Catalog, Impacting AMI MegaRAC, D-Link, Fortinet

(Thursday June 26, 2025)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three security flaws, each impacting AMI MegaRAC, D-Link DIR-859 router, and Fortinet FortiOS, to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2024-54085 (CVSS score: 10.0) - An authentication bypass by spoofing

We built a smart, searchable infosec library indexing 20+ years of resources

(Thursday June 26, 2025)

Talkback is a smart infosec resource aggregator, designed to help security enthusiasts, practitioners and researchers be more productive.

WhatsApp Adds AI-Powered Message Summaries for Faster Chat Previews

(Thursday June 26, 2025)

Popular messaging platform WhatsApp has added a new artificial intelligence (AI)-powered feature that leverages its in-house solution Meta AI to summarize unread messages in chats. The feature, called Message Summaries, is currently rolling out in the English language to users in the United States, with plans to bring it to other regions and languages later this year. It "uses Meta AI to

Police say uni hacker has 'very high level of technical skill'

(Thursday June 26, 2025)

Police believe a former Western Sydney University student allegedly escalated from hacking into the uni's servers for free parking to threatening the sale of her peers' data on the dark web.

Smashing Security podcast #423: Operation Endgame, deepfakes, and dead slugs

(Wednesday June 25, 2025)

In this episode of the "Smashing Security" podcast, Graham unravels Operation Endgame - the surprisingly stylish police crackdown that is seizing botnets, mocking malware authors with anime videos, and taunting cybercriminals via Telegram. And BBC cyber correspondent Joe Tidy joins us to talk about "Ctrl-Alt-Chaos", his new book diving into the murky world of teenage hackers, ransomware gangs, and the strange motivations that lie behind digital mayhem.

Microsoft Named a Leader in the 2025 IDC CNAPP MarketScape: Key Takeaways for Security Buyers

(Wednesday June 25, 2025)

The cloud-native application protection platform (CNAPP) market continues to evolve rapidly as organizations look to secure increasingly complex cloud environments. In the recently published 2025 IDC MarketScape for Worldwide CNAPP, Microsoft has been recognized as a Leader, reaffirming its commitment to delivering comprehensive, AI-powered, and integrated security solutions for multicloud environments. A diagram of a […] The post .

nOAuth Vulnerability Still Affects 9% of Microsoft Entra SaaS Apps Two Years After Discovery

(Wednesday June 25, 2025)

New research has uncovered continued risk from a known security weakness in Microsoft's Entra ID, potentially enabling malicious actors to achieve account takeovers in susceptible software-as-a-service (SaaS) applications. Identity security company Semperis, in an analysis of 104 SaaS applications, found nine of them to be vulnerable to Entra ID cross-tenant nOAuth abuse. First disclosed by

Closing the Loop on API Security: How Imperva Helps You Expose, Contain, and Mitigate Business Logic Threats

(Wednesday June 25, 2025)

In a world powered by APIs, waiting for an attack is waiting too long. Business logic risks like Broken Object Level Authorization (BOLA) don’t announce themselves with obvious signatures or malware. They hide in plain sight within normal-looking traffic and by the time a BOLA exploit turns into a breach, the damage is done. Imperva’s […] The post .

Citrix Releases Emergency Patches for Actively Exploited CVE-2025-6543 in NetScaler ADC

(Wednesday June 25, 2025)

Citrix has released security updates to address a critical flaw affecting NetScaler ADC that it said has been exploited in the wild. The vulnerability, tracked as CVE-2025-6543, carries a CVSS score of 9.2 out of a maximum of 10.0. It has been described as a case of memory overflow that could result in unintended control flow and denial-of-service. However, successful exploitation requires the

Citrix Bleed 2 Flaw Enables Token Theft; SAP GUI Flaws Risk Sensitive Data Exposure

(Wednesday June 25, 2025)

Cybersecurity researchers have detailed two now-patched security flaws in SAP Graphical User Interface (GUI) for Windows and Java that, if successfully exploited, could have enabled attackers to access sensitive information under certain conditions. The vulnerabilities, tracked as CVE-2025-0055 and CVE-2025-0056 (CVSS scores: 6.0), were patched by SAP as part of its monthly updates for January

Pro-Iranian Hacktivist Group Leaks Personal Records from the 2024 Saudi Games

(Wednesday June 25, 2025)

Thousands of personal records allegedly linked to athletes and visitors of the Saudi Games have been published online by a pro-Iranian hacktivist group called Cyber Fattah. Cybersecurity company Resecurity said the breach was announced on Telegram on June 22, 2025, in the form of SQL database dumps, characterizing it as an information operation "carried out by Iran and its proxies." "The actors

Beware the Hidden Risk in Your Entra Environment

(Wednesday June 25, 2025)

If you invite guest users into your Entra ID tenant, you may be opening yourself up to a surprising risk. A gap in access control in Microsoft Entra’s subscription handling is allowing guest users to create and transfer subscriptions into the tenant they are invited into, while maintaining full ownership of them. All the guest user needs are the permissions to create subscriptions in

Deleting a file in Wire doesn’t remove it from servers — and other findings

(Wednesday June 25, 2025)

Overall, Wire’s asset-sharing system is well-designed and aligns with strong security principles. The issues identified are edge cases that do not compromise the core encryption model but could benefit from clearer user-facing behavior and documentation and minor access control adjustments. We identified five such cases where behavior diverges from user expectations or best practices: DELETION IS INCOMPLETE: Deleting a file in the Wire web app removes only local references and keys on...

Cybercrime is surging across Africa

(Wednesday June 25, 2025)

A new INTERPOL report has sounded the alarm over a dramatic increase in cybercrime across Africa, with digital crime now accounting for a significant proportional of all criminal activity across the continent. Read more in my article on the Hot for Security blog.

Security Benchmarking Authorization Policy Engines

(Wednesday June 25, 2025)

Explore how the Security Policy Evaluation Framework (SPEF) enables automated, dynamic security benchmarking of leading authorization engines—Rego, Cedar, OpenFGA, and Teleport ACD. Developed by Doyensec with support from Teleport, SPEF tests for vulnerabilities, correctness, and performance under real-world access control scenarios.

Bridewell report indicates rise in lone wolf ransomware actors

(Wednesday June 25, 2025)

Bridewell, a UK-based cybersecurity services company, has released its latest CTI Annual Report – a comprehensive deep dive into ransomware trends. It highlighted a significant shift in attack strategies, payment dynamics and threat actor behaviours, revealing that data theft and extortion have overtaken traditional encryption-only ransomware as the most successful approach for attackers. While encryption-based […] The post .

SonicWall NetExtender Trojan and ConnectWise Exploits Used in Remote Access Attacks

(Wednesday June 25, 2025)

Unknown threat actors have been distributing a trojanized version of SonicWall's SSL VPN NetExtender application to steal credentials from unsuspecting users who may have installed it. "NetExtender enables remote users to securely connect and run applications on the company network," SonicWall researcher Sravan Ganachari said. "Users can upload and download files, access network drives, and use

North Korea-linked Supply Chain Attack Targets Developers with 35 Malicious npm Packages

(Wednesday June 25, 2025)

Cybersecurity researchers have uncovered a fresh batch of malicious npm packages linked to the ongoing Contagious Interview operation originating from North Korea. According to Socket, the ongoing supply chain attack involves 35 malicious packages that were uploaded from 24 npm accounts. These packages have been collectively downloaded over 4,000 times. The complete list of the JavaScript

RedirectionGuard: Mitigating unsafe junction traversal in Windows

(Wednesday June 25, 2025)

As attackers continue to evolve, Microsoft is committed to staying ahead by not only responding to vulnerabilities, but also by anticipating and mitigating entire classes of threats. One such threat, filesystem redirection attacks, has been a persistent vector for privilege escalation. In response, we’ve developed and deployed a new mitigation in Windows 11 called RedirectionGuard.

Microsoft Extends Windows 10 Security Updates for One Year with New Enrollment Options

(Wednesday June 25, 2025)

Microsoft on Tuesday announced that it's extending Windows 10 Extended Security Updates (ESU) for an extra year by letting users either pay a small fee of $30 or by sync their PC settings to the cloud. The development comes ahead of the tech giant's upcoming October 14, 2025, deadline, when it plans to officially end support and stop providing security updates for devices running Windows 10. The

Post-Quantum Cryptography Implementation Enterprise-Readiness Analysis

(Wednesday June 25, 2025)

Explore how enterprises are adopting post-quantum cryptography (PQC) using OpenSSL 3.5, hybrid TLS, and NIST-approved algorithms like Kyber and Dilithium. Learn about PQC implementation strategies, compliance timelines, tooling, and real-world deployments by Microsoft, Meta, Red Hat, and others preparing for quantum-safe encryption.

Digital drivers licence anti-fraud technology only a 'cheap coding trick'

(Tuesday June 24, 2025)

Cybersecurity specialists warn a "very cheap coding trick" is being spruiked as a high-tech anti-fraud measure on digital drivers licences.

New U.S. Visa Rule Requires Applicants to Set Social Media Account Privacy to Public

(Tuesday June 24, 2025)

The United States Embassy in India has announced that applicants for F, M, and J nonimmigrant visas should make their social media accounts public. The new guideline seeks to help officials verify the identity and eligibility of applicants under U.S. law. The U.S. Embassy said every visa application review is a "national security decision." "Effective immediately, all individuals applying for an

New Kerio Control Advisory!

(Tuesday June 24, 2025)

SUMMARY An analysis primarily of Kerio Control revealed a design flaw in the implementation of the communication with GFI AppManager, leading to an authentication bypass vulnerability in the product under audit. Once the authentication bypass is achieved, the attacker can cause the execution of arbitrary code and commands. CREDIT An independent security researcher, z3er01 of zeronvll, working with SSD Secure Disclosure. VENDOR RESPONSE The vendor has been notified of the vulnerability...

Cryptominers’ Anatomy: Shutting Down Mining Botnets

(Tuesday June 24, 2025)

Hy-Vee Hacked: Infostealers Enable Stormous Group's 53GB Atlassian Data Heist

(Tuesday June 24, 2025)

Keeper Security Achieves SOC 3 Compliance

(Tuesday June 24, 2025)

Keeper Security has achieved System and Organisation Controls (SOC) 3® compliance, demonstrating the company’s commitment to the highest standards of security for all users. The SOC 3 report, governed by the American Institute of Certified Public Accountants (AICPA), is a public-facing certification that validates the security, availability and confidentiality of Keeper’s systems. As part of […] The post .

Microsoft is named a Leader in The Forrester Wave™: Security Analytics Platforms, 2025

(Tuesday June 24, 2025)

Microsoft is proud to be named a Leader in The Forrester Wave™: Security Analytics Platforms, Q2 2025—which we believe reflects our deep investment in innovation and commitment to support SOC’s critical mission. The post .

The AI Fix #56: ChatGPT traps man in a cult of one, and AI is actually stupid

(Tuesday June 24, 2025)

In episode 56 of The AI Fix, Anthropic and Apple have a bar fight, a woman describes her husband falling in love with ChatGPT as “not ideal”, WhatsApp's AI helper isn't helpful, Graham serenades a pack of headless robot dogs with his rendition of “Don't stop me know”, and our hosts debate whether AI turning our brains to porridge is actually a bad thing. Graham tells the harrowing story of how chatbots are convincing ordinary people they were chosen, manipulated their minds, and in some cases, pushed them to the edge, and Mark stumps the world's best AIs with an easy question.

FileFix – New Alternative to ClickFix Attack

(Tuesday June 24, 2025)

A new browser attack vectors just dropped, and it’s called FileFix — an alternative to the well-known ClickFix attack. This method, discovered and shared by mrd0x, shows how attackers can to execute commands right from browser, without requesting target to open cmd dialog. Quick Recap: What’s the ClickFix Attack? First, let's quickly recap ClickFix, the

Researchers Find Way to Shut Down Cryptominer Campaigns Using Bad Shares and XMRogue

(Tuesday June 24, 2025)

Cybersecurity researchers have detailed two novel methods that can be used to disrupt cryptocurrency mining botnets. The methods take advantage of the design of various common mining topologies in order to shut down the mining process, Akamai said in a new report published today. "We developed two techniques by leveraging the mining topologies and pool policies that enable us to reduce a

Remote code execution in CentOS Web Panel - CVE-2025-48703

(Tuesday June 24, 2025)

Fenrisk

Hackers Target Over 70 Microsoft Exchange Servers to Steal Credentials via Keyloggers

(Tuesday June 24, 2025)

Unidentified threat actors have been observed targeting publicly exposed Microsoft Exchange servers to inject malicious code into the login pages that harvest their credentials. Positive Technologies, in a new analysis published last week, said it identified two different kinds of keylogger code written in JavaScript on the Outlook login page - Those that save collected data to a local file

Black Duck Teams with Arm to Boost EU Cyber Resilience Act Compliance

(Tuesday June 24, 2025)

Software security company Black Duck is ramping up efforts to help organizations comply with the European Cyber Resilience Act (CRA), building on a 20-year partnership with British chip design giant Arm. The collaboration focuses on securing software running on Arm64-based systems, now widely used in hyperscaler and enterprise environments. Since 2005, Black Duck has played […] The post .

Aflac, one of the USA’s largest insurers, is the latest to fall “under siege” to hackers

(Tuesday June 24, 2025)

The Wall Street Journal reports that Aflac is investigating a breach that may have exposed claims information, health details, Social Security numbers, and other personal data.

Between Buzz and Reality: The CTEM Conversation We All Need

(Tuesday June 24, 2025)

I had the honor of hosting the first episode of the Xposure Podcast live from Xposure Summit 2025. And I couldn’t have asked for a better kickoff panel: three cybersecurity leaders who don’t just talk security, they live it. Let me introduce them. Alex Delay, CISO at IDB Bank, knows what it means to defend a highly regulated environment. Ben Mead, Director of Cybersecurity at Avidity

Hackers Exploit Misconfigured Docker APIs to Mine Cryptocurrency via Tor Network

(Tuesday June 24, 2025)

Misconfigured Docker instances are the target of a campaign that employs the Tor anonymity network to stealthily mine cryptocurrency in susceptible environments. "Attackers are exploiting misconfigured Docker APIs to gain access to containerized environments, then using Tor to mask their activities while deploying crypto miners," Trend Micro researchers Sunil Bharti and Shubham Singh said in an

U.S. House Bans WhatsApp on Official Devices Over Security and Data Protection Issues

(Tuesday June 24, 2025)

The U.S. House of Representatives has formally banned congressional staff members from using WhatsApp on government-issued devices, citing security concerns. The development was first reported by Axios. The decision, according to the House Chief Administrative Officer (CAO), was motivated by worries about the app's security. "The Office of Cybersecurity has deemed WhatsApp a high-risk to users

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

(Tuesday June 24, 2025)

The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new cyber attack campaign by the Russia-linked APT28 (aka UAC-0001) threat actors using Signal chat messages to deliver two previously undocumented malware families dubbedd BEARDSHELL and COVENANT. BEARDSHELL, per CERT-UA, is written in C++ and offers the ability to download and execute PowerShell scripts, as well as

China-linked Salt Typhoon Exploits Critical Cisco Vulnerability to Target Canadian Telecom

(Tuesday June 24, 2025)

The Canadian Centre for Cyber Security and the U.S. Federal Bureau of Investigation (FBI) have issued an advisory warning of cyber attacks mounted by the China-linked Salt Typhoon actors to breach major global telecommunications providers as part of a cyber espionage campaign. The attackers exploited a critical Cisco IOS XE software (CVE-2023-20198, CVSS score: 10.0) to access configuration

Iran's Internet: A Censys Perspective

(Monday June 23, 2025)

Author Mark Ellzey Senior Security Researcher Mark Ellzey is a Senior Security Researcher at Censys. Before his current role, Mark has worked as both a network security engineer and software developer for several internet service providers and financial institutions for over 22 years. EXECUTIVE SUMMARY blackout. June 21 marks the lowest point in host visibility, after which we see signs of recovery that continue as of this post. such as AS25124 (DATAK) and AS1756 (HAMYAR-AS), continue...

Marks & Spencer ransomware attack was good news for other retailers

(Monday June 23, 2025)

When Marks & Spencer paused online orders after it was hit by ransomware, it was bad news for them... but GOOD news for other big online retailers. Fashion rivals like Next, John Lewis, and Zara saw a nice little bump while M&S sales floundered.

Remote Code Execution on 40,000 WiFi alarm clocks

(Monday June 23, 2025)

While looking for an API to use with Home Assistant, I found a remote code execution vulnerability in a popular WiFi-connected alarm clock.

Threat Hunting Introduction: Cobalt Strike

(Monday June 23, 2025)

An introduction to Threat Hunting and Cobalt Strike

Navigating cyber risks with Microsoft Security Exposure Management eBook

(Monday June 23, 2025)

Microsoft Security Exposure Management's eBook helps educate teams on how to anticipate threats across hybrid environments, transforming risk into resilience. The post .

haveibeenpwned.watch - Open-source, no-fluff charts showcasing haveibeenpwned.com's pwned account data

(Monday June 23, 2025)

BREACHES PER YEAR: PWNED ACCOUNTS PER YEAR: MEAN PWNED ACCOUNTS PER BREACH PER YEAR: PWNED ACCOUNTS PER DATA TYPES PER YEAR: PWNED ACCOUNTS PER INDUSTRY PER YEAR: DAYS SINCE BREACH DATE TO PUBLISH IN HIBP: LATEST 10 BREACHES: MOST IMPACTFUL 10 BREACHES: APPS WITH TWO OR MORE BREACHES:

Echo Chamber Jailbreak Tricks LLMs Like OpenAI and Google into Generating Harmful Content

(Monday June 23, 2025)

Cybersecurity researchers are calling attention to a new jailbreaking method called Echo Chamber that could be leveraged to trick popular large language models (LLMs) into generating undesirable responses, irrespective of the safeguards put in place. "Unlike traditional jailbreaks that rely on adversarial phrasing or character obfuscation, Echo Chamber weaponizes indirect references, semantic

DHS Warns Pro-Iranian Hackers Likely to Target U.S. Networks After Iranian Nuclear Strikes

(Monday June 23, 2025)

The United States government has warned of cyber attacks mounted by pro-Iranian groups after it launched airstrikes on Iranian nuclear sites as part of the Iran–Israel war that commenced on June 13, 2025. Stating that the ongoing conflict has created a "heightened threat environment" in the country, the Department of Homeland Security (DHS) said in a bulletin that cyber actors are likely to

What secures LLMs calling APIs via MCP? A stack of OAuth specs—here’s how they fit together

(Monday June 23, 2025)

Behind every secure MCP integration is a stack of OAuth standards working in harmony. Learn how they combine to deliver seamless authorization for LLMs.

] The Mad Hacker [

Collecting all the news about Cybersecurity, computer security, cracking, hacking, infosec, netsec, & security vunerabilities in one convenient place