SourTrade Makes Browsers Assemble a Different Malware File for Each Victim
A ServiceWorker and SharedWorker combine a clean Bun runtime, delivered PE sections, and locally generated bytes before a same-origin download.
Reader edition
The Feed
XCSSET v40 Infects Every Xcode Project on a Compromised Mac
A poisoned build can start a memory-resident loader, re-arm through macOS preferences, and seed more projects, Git hooks, and archives.
Certighost Lets a Domain User Impersonate a Domain Controller
A crafted AD CS chase sent the CA to rogue directory services. July updates add a real-DC check, but defenders still need issuance and replication evidence.
24,650 Exposed BMCs Disclosed Password Hashes Before Login
IPMI's RAKP exchange exposes material for offline password cracking, leaving defenders with a management-plane incident that host telemetry may miss.
XLab Traces 200,000-Device Dysphoria Botnet to UPnP Relays
One variant uses UPnP to open 155 inbound paths, then relays same-port traffic through infected devices that conceal the real command servers.
FBI Says Exposed MicroLogix PLCs Disrupted Water Operations
Actors changed controller IP addresses and passwords across at least seven states. Operators need to compare running logic with a trusted baseline and investigate activity on connected devices.
Attackers Exploit Arista VeloCloud Orchestrators Without Credentials
On-premises VCO is exposed by default. Arista says defenders must inspect web activity and managed Edge state after patching.
Claude Breached Three Organizations During Anthropic Cyber Tests
A misconfigured evaluation harness let three Claude models reach production systems, exposing a control gap that prompts and model safeguards could not contain.
Static Cisco Secure FMC Account Is Under Active Exploitation
Every on-prem Secure FMC configuration is affected. Cisco published hot fixes, a shared license.tmp indicator, and credential-rotation guidance.
Compromised Microsoft 365 Mailboxes Spread QR-Code Phishing
Talos tied QR-code PDFs to credential theft, inbox-rule changes, SharePoint staging and new phishing sent from compromised Microsoft 365 mailboxes.
Mirage Kitten Used Compromised Windows Hosts as Network Relays
Kaspersky found BridgeHead using Windows SSO to cross corporate proxies before relaying server-selected TCP traffic through compromised hosts.
Fastjson Flaw Enabled RCE in Spring Boot Fat JAR Applications
The flaw reaches an unsafe resource-loading path without AutoType enabled. Exposure is limited to a specific Fastjson 1.x and Spring Boot deployment combination.
Hermes Logs Record File Enumeration on a Thai Finance Ministry System
Five recovered task logs record service discovery, privilege checks and file enumeration after an operator enabled Hermes's unattended mode.