The TokenBreak Attack
Summary Do you know which model is protecting each LLM you have in production? HiddenLayer’s security research team has discovered a novel way to bypass models built to detect malicious text input...
ictsec.pl
Sweden says it is under cyber attack
Swedish Prime Minister Ulf Kristersson says his country is under attack, after days of hard-hitting DDoS attacks against SVT, Sweden’s public TV broadcaster, government websites, and other key orga...
Ransomware scum disrupted utility services with SimpleHelp attacks
Ransomware criminals infected a utility billing software providers’ customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and manage...
Ransomware Scum Disrupted Utility Services with SimpleHelp Attacks
Ransomware criminals infected a utility billing software providers’ customers, and in some cases disrupted services, after exploiting unpatched versions of SimpleHelp’s remote monitoring and manage...
New ‘SmartAttack’ Steals Air-Gapped Data Using Smartwatches
Designed to protect sensitive information, air-gapped systems are disconnected from the network, thus preventing data exfiltration through methods that require internet connectivity. However, vari...
NAT and Packet Capture
The shortage of IPv4 addresses has forced us to use smart techniques to reallocate address blocks, speed up adoption of IPv6, and reduce the number of addresses we use. We’re going to focus on this...
JSFireTruck Exploring Malicious JavaScript Using JSF*ck as an Obfuscation Technique
Executive Summary We recently discovered a large-scale campaign that has been compromising legitimate websites with injected, obfuscated JavaScript code. Threat actors commonly use this type of ca...
Inside a Dark Adtech Empire Fed by Fake CAPTCHAs
Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious adverti...
Inside FluxPanel How Phishing Enables Real-Time Ecommerce Checkout Hijacks
While online shoppers think they’re safely completing purchases on legitimate ecommerce sites, cybercriminals are watching every keystroke, capturing credit cards and personal data in real time thr...
Graphite Caught, First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted
Introduction On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists that consented for the techni...
GitHub Device Code Phishing
What if all it took to compromise a GitHub organization – and thus, the organization’s supply chain – was an eight-digit code and a phone call? Introducing: GitHub Device Code Phishing. While sec...
From Trust to Threat Hijacked Discord Invites Used for Multi-Stage Malware Delivery
Key Takeaways Check Point Research uncovered an active malware campaign exploiting expired and released Discord invite links. Attackers hijacked the links through vanity link registration, allowin...
Fog Ransomware Unusual Toolset Used in Recent Attack
A May 2025 attack on a financial institution in Asia saw the Fog ransomware deployed, alongside an unusual toolset, including some dual-use and open-source pentesting tools we have not observed bei...
EchoLeak Zero-Click AI Attack in Microsoft Copilot Exposes Company Data
Cybersecurity firm Aim Labs has uncovered a serious new security problem, named EchoLeak, affecting Microsoft 365 (M365) Copilot, a popular AI assistant. This flaw is a zero-click vulnerability, me...
Don't Get Caught in the Headlights - DeerStealer Analysis
Throughout May 2025, eSentire’s Threat Response Unit (TRU) detected several attempts by threat actors to download and execute HijackLoader. Many of these attempts involved the attempted deployment ...
2025-06-12 Daily Vulns
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2023-44000 n/a - n/a An iss...
Toxic trend Another malware threat targets DeepSeek
DeepSeek-R1 is one of the most popular LLMs right now. Users of all experience levels look for chatbot websites on search engines, and threat actors have started abusing the popularity of LLMs. We ...
Researcher Finds Five Zero-Days and 20+ Misconfigurations in Salesforce Cloud
A cybersecurity researcher has uncovered five zero-day vulnerabilities and over 20 configuration risks in Salesforce’s cloud components. On June 10, Aaron Costello, Chief of SaaS Security Research...
Over 80,000 servers hit as Roundcube RCE bug gets rapidly exploited
Threat actors exploited a critical remote code execution (RCE) flaw in Roundcube, tracked as CVE-2025-49113, just days after the patch was released, targeting over 80,000 servers. Roundcube is a p...
NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073
NTLM reflection is dead, long live NTLM reflection! Source: Synacktiv Date Published: June 11, 2025 Excerpt: “Introduction NTLM reflection is a special case of NTLM authentication relay in which ...