Kroll is revealing a new AMOS infostealer delivery vector where malicious instructions appeared inside a legitimate ChatGPT session. Basically ClickFix-style malware delivery, but presented through a real LLM chat URL. www.kroll.com/en/publicati...

New AMOS Infection Vector Highlights Risks around AI Adoption

During a recent investigation into AMOS InfoStealer, Kroll Threat Intelligence has discovered a troubling new delivery vector that leverages the growing trust users place in AI tools. In this case, at...

kroll.com

React2Shell exploitation frequency in GreyNoise dec 5-dec 6

The amount of times today I've typed React2j or React4Shell....

Censys identifies ~2.15M exposed web services running Next.js or other RSC-based frameworks, predominantly in the U.S. and China. Not all are vulnerable, but given the scale, “spray-and-prey” seems more accurate than "spray-and-pray." censys.com/advisory/cve...

December 5 Advisory: Unauthenticated RCE Flaw in React Server Components [CVE-2025-55182]

CVE-2025-55182 is a critical unauthenticated RCE flaw in React Server Components with a CVSS score of 10.

censys.com

Comparing the IOCs released by Gainsight and Salesloft, there is one overlapping IP: 185.220.101[.]185 communities.gainsight.com/community-ne... trust.salesloft.com?uid=Drift%2F...

Annoying as hell when a security vendor (and CNA) with a global PSIRT doesn't update its CSAF with a CVE once it's assigned. Like what is even the point.

Some of the LLM skepticism in security looks more like backlash to hype than analysis. AlphaFold showed how experts can underestimate capability jumps. Dismissing early signals from Anthropic/Google assumes the future stays static, but AI capability and adoption curves may not behave that way.

This is a popular tactic. Google recently said that Chinese hackers got vulnerability information from Gemini by posing as capture-the-flag participants. cloud.google.com/blog/topics/...

404 Media is suing ICE for documents relating to its $2 million contract with Paragon Solutions. These are the journalists you should be supporting with your subscription money because they are meeting the moment. www.404media.co/were-suing-i...

We’re Suing ICE for Its $2 Million Spyware Contract

404 Media has filed a lawsuit against ICE for access to its contract with Paragon, a company that sells powerful spyware for breaking into phones and accessing encrypted messaging apps.

404media.co

The critical RCE Vulnerability in Microsoft #SharePoint was disclosed at #Pwn2Own in May. Because of Trend @thezdi.bsky.social, our customers have been protected since May. Stay up to date on the latest with this vulnerability here: https//www.trendmi...

Proactive Security for CVE-2025-53770 and CVE-2025-53771 SharePoint Attacks

CVE-2025-53770 and CVE-2025-53771 are vulnerabilities in on-premise Microsoft SharePoint Servers that evolved from previously patched flaws, allowing unauthenticated remote code execution through adva...

trendmicro.com

Iran's APT42 (Charming Kitten) hacker team is now conducting targeted spearphishing attacks on high-profile Israeli national security journalists and cybersecurity researchers, according to Check Point. blog.checkpoint.com/security/edu...

Supposed experts and mainstream media have spent the past few days hyperventilating over reports of a colossal data breach that exposed more than 16 billion credentials. There’s just one inconvenient detail: evidence to support its sensational claim is lacking. cyberscoop.com/colossal-dat...

The ‘16 billion password breach’ story is a farce

Experts told CyberScoop the research 'doesn’t pass a sniff test' and detracts from needed conversations around credential abuse and information stealers.

cyberscoop.com

Iran has demonstrated its capability/intent to keep up cyber operations amid Israeli strikes. On Friday, an IRGC-linked group targeted Albania's capital in retaliation for the country hosting ~3k Iranian dissidents. The intrusion could disrupt services/expose data: www.politico.eu/article/iran...

Iranian hackers target Albania in retaliation for hosting dissidents

A group tied to Iran’s Revolutionary Guard targeted the capital of Tirana in retaliation for Albania hosting around 3,000 Iranian dissidents.

politico.eu

News: The Washington Post has suffered a cyber intrusion that compromised the emails of at least several reporters at the paper, including those on the national security and economic policy teams, according to people familiar with the matter.

Google's @hultquist.bsky.social‬ says his threat intel team expects Iranian hackers to "rededicate themselves to attacks against Israeli targets" following Israel's bombing operation, though he says 🇮🇷-on🇮🇱 hacking "is already persistent and aggressive." US infrastructure could face more hacks too.

The cybercriminal group FIN6 (Skeleton Spider) is phishing recruiters by posing as job seekers on LinkedIn/Indeed and luring them to fake resume sites that deliver the "more_eggs" backdoor via AWS-hosted, CAPTCHA-protected pages. More from DomainTools: dti.domaintools.com/Skeleton-Spi...

Eggs in a Cloudy Basket: Skeleton Spider’s Trusted Cloud Malware Delivery - DomainTools Investigations | DTI

Discover how the FIN6 cybercrime group, also known as Skeleton Spider, leverages trusted cloud services like AWS to deliver stealthy malware through fake job applications and resume-themed phishing ca...

dti.domaintools.com

"This research underscores the persistent threat Chinese cyberespionage actors pose to global industries and public sector organizations, while also highlighting a rarely discussed target they pursue: cybersecurity vendors." www.sentinelone.com/labs/follow-...

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

This report uncovers a set of related threat clusters linked to PurpleHaze and ShadowPad operators targeting organizations, including cybersecurity vendors.

sentinelone.com

🥤& #threat-intel: CISA added Langflow Code Injection CVE-2025-3248 to the KEV on May 5. Recently, it has garnered considerable attention, with South Korea leading the pack. This vuln enables unauthenticated attackers to execute arbitrary code via /api/v1/validate/code viz.greynoise.io/tag...

@npr.org EXCLUSIVE: The Department of Agriculture is demanding states hand over personal data of food assistance recipients — including Social Security numbers, addresses and, in at least one state, citizenship status, according to emails shared with NPR.

USDA, DOGE demand states hand over personal data about food stamp recipients

The Department of Agriculture is demanding sensitive data from states about more than 40 million food stamp recipients, as DOGE is amassing data for immigration enforcement.

npr.org

Deploying realistic honeypots at scale is hard—DECEIVE makes it simple. Join David Bianco at #Honeynet2025 in Prague as he presents an AI-assisted SSH honeypot that enables high-fidelity deception with minimal effort. 📅 June 2–4, 2025 🔗 prague2025.honeynet.org #honeypots #llm #ai

In December, leading EdTech company PowerSchool was hacked, exposing the private information of tens of millions of American kids. PowerSchool paid the ransom to keep the data private. That apparently didn't work: somebody started using that data today to extort public schools in North Carolina.

School districts hit with extortion attempts months after education tech data breach

The attempted extortion has so far targeted schools in Canada and North Carolina.

nbcnews.com

🔥 Dispatch Debrief: April 2025 is live 🔥 Explore star sign-inspired hunting techniques, organizing your hunt squad, and the value of finding "nothing." Discover this month's insights from @thorcollective.bsky.social Dispatch - dispatch.thorcollective.com/p/april-debr...

Dispatch Debrief: April 2025

What We Hunted, Learned, and Loved This Month

dispatch.thorcollective.com

Hm! He argues the CSRB has to evolve + be fully separated from CISA (it was dismantled at start of Trump 2.0), noting that, during the board's Salt Typhoon probe, some telcos got nervous and said they will not share information with the agency b/c CSRB is tied to the DHS office.

Initial probe into cause of power outages in Spain & Portugal today suggests fault rather than cyberattack, according to the European Union Agency for Cybersecurity (ENISA). “For the moment the investigation seems to point out to a technical/cable issue,” a spokesperson for the agency tells me.

When incidents hit, how you communicate shapes the outcome. This week’s @thorcollective.bsky.social Dispatch features @audrastreetman.bsky.social, former journalist turned cyber intel analyst. dispatch.thorcollective.com/p/how-commun...

How Communication Shapes the Outcome of Cybersecurity Incidents

Why the timing and transparency of messaging can make or break your incident response

dispatch.thorcollective.com

News: @thekrebscycle.bsky.social, a target of Trump's wrath last week, is resigning from SentinelOne to focus fully on fighting back against against the White House's campaign to punish dissent. www.wsj.com/politics/pol...

Exclusive | Former Trump Official Targeted With Government Probe Vows to Fight

Chris Krebs, the cybersecurity official from the first Trump administration who was fired after saying the 2020 election wasn’t stolen, vowed to fight back against a White House investigation.

wsj.com

If this contract ends, the damage will be immense. To be clear, that's immense damage to the US' ability to protect its computer systems, both in the commercial and in the public sectors. And yes, this includes critical infrastructure such as power, water, and transportation.

Tib3rius@tib3rius.bsky.social · last yr.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

BREAKING. From a reliable source. MITRE support for the CVE program is due to expire tomorrow. The attached letter was sent out to CVE Board Members.

Infosec must not remain silent while Trump goes after Chris Krebs: www.eff.org/deeplinks/20...

Cybersecurity Community Must Not Remain Silent On Executive Order Attacking Former CISA Director

Cybersecurity professionals and the infosec community have essential roles to play in protecting our democracy, securing our elections, and building, testing, and safeguarding government infrastructur...

eff.org

THREAD: When @thekrebscycle.bsky.social and his workplace, @sentinelone.com, were singled out by Donald Trump on Wednesday, I thought it was an opportunity to weigh the cybersecurity industry's rhetoric against their real world actions.