DOGE Denizen Marko Elez Leaked API Key for xAI
Marko Elez, a 25-year-old employee at Elon Musk’s Department of Government Efficiency (DOGE), has been granted access to sensitive databases at the U.S. Social Security Administration, the Treasury...
ictsec.pl
Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader
The Socket Threat Research Team has uncovered a new North Korean software supply chain attack involving a previously unreported malware loader we call XORIndex. This activity is an expansion of the...
Behind the Clouds Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication
Since late 2024, Unit 42 researchers have been tracking a cluster of suspicious activity as CL-STA-1020, targeting governmental entities in Southeast Asia. The threat actors behind this cluster of ...
Nvidia warns its GPUs – even Blackwells – need protection against Rowhammer attacks
Nvidia last week advised customers to ensure they employ mitigations against Rowhammer attacks, after researchers found one of its workstation-grade GPUs is susceptible to the exploit. Rowhammer i...
Chasing Ghosts Over RDP Lateral Movement in Tiny Bitmaps
Introduction Picture this: you’re an incident responder hot on the trail of an intruder who’s hopping between servers using Remote Desktop Protocol (RDP). They think they’re sneaky, hiding behind ...
OCTALYN STEALER UNMASKED
The Octalyn Forensic Toolkit, publicly hosted on GitHub, presents itself as a research-oriented tool for digital forensics and red teaming. It consists of a C++-based payload module supported by a ...
2025-07-12 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2013-3307 Linksys - E1000Linksys ...
Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257)
This time, we’re looking at Fortinet’s FortiWeb Fabric Connector. “What is that?” we hear you say. That’s a great question; no one knows. For the uninitiated, or unjaded: Fortinet’s FortiWeb Fabri...
GAO finds progress in cyber information sharing, warns of rising attacks on critical infrastructure
A new report from the U.S. GAO detailed that policies and actions implemented under the Cybersecurity Information Sharing Act of 2015 have positively contributed to the sharing of cyber threat info...
2025-07-11 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2025-27889 wftpserver - Wing FTP ...
macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App
First noted by a Chinese blogger in July 2021, macOS.ZuRu is a backdoor that was initially delivered through poisoned web results on Baidu. Users searching for the popular Terminal emulator iTerm2 ...
Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild
TL;DR: Huntress saw active exploitation of Wing FTP Server remote code execution (CVE-2025-47812) on a customer on July 1, 2025. Organizations running Wing FTP Server should update to the fixed ver...
Where Everybody Knows Your Name Observing Malice-Complicit Nameservers
🎵 Sometimes you wanna go Where everybody knows your name And they’re always glad you came 🎵 ~Theme from Cheers Everyone should have a place to go where they’re comfortable, can pull up a comfy inf...
Rendershock Weaponizing Trust in File Rendering Pipelines
RenderShock is a comprehensive zero-click attack strategy that targets passive file preview, indexing, and automation behaviours in modern operating systems and enterprise environments. It leverage...
Ransomware Delivered Through GitHub A PowerShell-Powered Attack
Overview Recently, the SonicWall Capture Labs threat research team identified a PowerShell-based ransomware variant that is abusing GitHub for its distribution. The malware authors are misusing ra...
Malware of the Day – Multi-Modal C2 Communication – Numinon C2
Background In our “Malware of the Day” series, we have explored a variety of C2 network communication profiles, covering protocols like HTTP, HTTPS, DNS, ICMP, and NTP. Most of these simulations we...
July Patch Tuesday offers 127 fixes
Microsoft on Tuesday released 127 patches affecting 14 product families. Nine of the addressed issues — four involving Windows, two involving 365 and Office, and one each involving SharePoint, SQL,...
Fix the Click Preventing the ClickFix Attack Vector
Executive Summary In this article, we share hunting tips and mitigation strategies for ClickFix campaigns and provide an inside view of some of the most prominent ClickFix campaigns we have seen so...
Dark Web Profile Arkana Ransomware
Arkana Ransomware emerged in early 2025, making its debut with a bold attack on WideOpenWest (WOW!), a U.S. internet provider, in late March 2025. The group claimed to have stolen two databases (ar...
Code highlighting with Cursor AI for $500,000
Attacks that leverage malicious open-source packages are becoming a major and growing threat. This type of attack currently seems commonplace, with reports of infected packages in repositories like...