T retweeted
It's confirmed! Ken Gannon / 伊藤 剣 (@yogehi) of Mobile Hacking Lab, and Dimitrios Valsamaras (@Ch0pin) of Summoning Team (@SummoningTeam) used five different bugs to exploit the #Samsung Galaxy S25. They earn $50,000 and 5 Master of Pwn points. #Pwn2Own
T retweeted
We just posted our AttackerKB @rapid7 Analysis for the recent Cisco ASA 0day chain; CVE-2025-20362 and CVE-2025-20333. The auth bypass appears to be a patch bypass of an older 2018 vuln. The buffer overflow is in a Lua endpoint, but unsafe native code operations allow a buffer to be overflowed and memory corruption to occur. Full technical root cause analysis here: attackerkb.com/topics/Szq5u0…
T retweeted
Emails claim Oracle data theft in new Clop-linked extortion campaign - @LawrenceAbrams
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
T retweeted
Lateral movement getting blocked by traditional methods?
@werdhaihai just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG
T retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
T retweeted
🚨 #Salty2FA is a new #phishkit linked to #Storm1575.
Active since June, it bypasses 2FA to gain access beyond stolen creds. Using a unique domain pattern and multi-stage chain, it targets finance, energy, telecom and more.
Read analysis: any.run/cybersecurity-blog/s…
T retweeted
🚨 We identified a ViewState deserialization attack affecting Sitecore deployments. The attacker leveraged an exposed ASP[.]NET machine key to perform remote code execution.
Get the full details, indicators of compromise, and defensive recommendations: goo.gle/47oNWll
T retweeted
The surge to 30,000 AiTM infrastructure detections on Wednesday this week was very much driven by pages[.]dev and workers[.]dev use. Rather than playing whack-a-mole we've been blocking those domains and so far have only blocked AiTM nothing legit!! YMMV #AiTM #Cloudflare
T retweeted
If you want to block ShadowCaptcha campaigns blocking these three domains will help:
- cloudshielders[.]com
- analytiwave[.]com
- analyticanoden[.]com
There is heavy geo/user-agent/os detection going on, so you may not see click-fix but your users might #clickFix #shadowCaptcha
T retweeted
WOW!!! temp43487580.github.io/intun… @TEMP43487580 such a good post!!! it is so well written, interesting research and great results! Thank you! 🤩
T retweeted
🕷️🚨 Scattered Spider threat actors are using social engineering techniques like phishing, push bombing & SIM swap attacks to target #CriticalInfrastructure orgs & commercial facilities. Check out our updated joint advisory for recommended mitigations. 👉go.dhs.gov/ioX
T retweeted
Technical deep dive into some current AiTM infrastructure using Azure Front Door and some other rather clever techniques.
aitm-feed.com/blog/azure-fro…
#AiTM
T retweeted
On July 19, Microsoft issued guidance on CVE-2025-53770, a variant of CVE-2025-49706. At the time of posting, a patch is not available. Learn more about Microsoft’s customer guidance as the situation evolves: msrc.microsoft.com/blog/2025…
We are observing active global exploitation of critical Microsoft SharePoint vulns CVE-2025-49704 and CVE-2025-49706.
Orgs worldwide are being targeted. Patch immediately. The exploits are real, in-the-wild and pose a serious threat.
IoCs we've seen: bit.ly/4kQZS2e
T retweeted
We're Hiring! Looking for an experienced Red Teamer.
To plan and deliver intelligence-led operations against some of the most complex enterprise environments in the UK and beyond.
Full info here ➡️jumpsec.com/position-red-cyb…
#cybercareer #redteam @JumpsecLabs
T retweeted
New Defender detection "Suspicious Cloudflared Tunnel" 🔎 This detection will alert on Cloudflare tunnels that don't belong to your organization by parsing the --token parameter and checking it against your Cloudflare account ID.
github.com/lawndoc/AdvancedH…