Attacks & Vulnerabilities
|
Shai-Hulud npm Worm Returns, Poisoning Over 1,280 npm Packages (3 minute read)
A new Shai-Hulud worm variant has compromised over 1,280 npm packages, including the well-known Keyv library, by injecting malicious commits via hijacked GitHub Actions pipelines. The worm employs a preinstall hook to download Bun and run an obfuscated payload that aggressively extracts developer and cloud credentials such as AWS, Kubernetes, and Vault, which it then uses to spread further. Organizations that have installed affected versions should assume an immediate breach, requiring them to rotate all secrets immediately and perform manual log reviews, rather than waiting for scheduled vulnerability scans.
|
77 Open VSX extensions found harvesting developer info (3 minute read)
Manifold Security uncovered an "evil twin" campaign on the Open VSX registry involving 77 malicious extensions that impersonated legitimate packages to harvest developer environment data. While claiming to only collect anonymous metrics, the most aggressive variants actively exfiltrated OS usernames, workspace paths, Git commit hashes, and CI/CD infrastructure details to mangorbit[.]com, utilizing DNS TXT lookups for C2 resilience. Although Open VSX removed the packages on August 3, security teams should block the C2 domain and manually audit developer environments for the malicious extension IDs.
|
|
Hardware Hacking: From zero to a Pre-Auth Stack Buffer Overflow on Amazon's best-selling router (16 minute read)
Researcher Rotce rooted the Mercusys MB115-4G, Amazon Spain's best-selling router, via UART and traced a pre-auth path in /usr/bin/httpd where http_gdpr_decrypt copied up to 2048 bytes of AES-decrypted, attacker-controlled data into a 512-byte caller buffer with no bounds check, tracked as CVE-2026-12495. The bug was surfaced through disciplined static analysis rather than a working exploit, following the routing table into the login handler in Ghidra and confirming with Ghidriff that the flaw persisted unpatched from v1.7.0 through v1.9.0. Mercusys' own validation reproduced the crash and shipped a fix in v1.11.0 that added the missing bounds check, moved the login decrypt path from RSA to ECC, and introduced HMAC verification.
|
Phishing service spoofs RingCentral to steal Microsoft 365 accounts (3 minute read)
The Greatness phishing platform recently bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain, despite the lures failing standard SPF, DKIM, and DMARC checks. Once clicked, the attack routed victims through an adversary-in-the-middle (AiTM) flow to steal MFA-approved tokens, allowing attackers to replay them from remote VPNs and stealthily siphon Microsoft 365 data for weeks. To mitigate this threat, defenders must immediately replace broad safe-sender exclusions with strict authentication requirements, hunt for anomalous MFA sign-ins originating from hosting providers, and comprehensively revoke access tokens if a compromise is suspected.
|
Agentic Incident Response Notebooks (6 minute read)
The DNB Cyber Defense Center's incident response team used marimo to build out incident response workflows as modular notebooks. The team developed a custom SDK for cross-platform query translation across Splunk, Defender, and SQL interfaces while utilizing marimo's native cell dependencies and caching capabilities. The marimo-pair agentic interface also allows agents to create and execute the same notebooks as human responders.
|
|
AgentHound (GitHub Repo)
AgentHound is an open-source offensive security framework for AI agent infrastructure that can perform recon, fingerprinting, credential looting, system prompt inventorying, model inversion, tool and instruction poisoning, and config-implant persistence and exports results to a Neo4j graph.
|
|
HEVD: From Stack Overflows to Modern Pool Grooming (1 minute read)
This four-part series traced the arc of Windows kernel exploitation on a deliberately vulnerable driver, moving from classic stack corruption and SMEP-bypassing ROP chains through arbitrary-write primitives into pure Data-Only attacks. The later stages reflected how modern Windows 11 mitigations, which strip kernel pointer leaks and harden execution hijacking, have pushed offensive research toward kernel pool grooming and named-pipe-based heap manipulation instead. The progression illustrated a broader industry shift: privilege escalation research increasingly abandons control-flow hijacking in favor of data-only techniques that sidestep control-flow integrity protections entirely.
|
New Pass-Ta-Key Attacks Let Malware Hijack Google-Synced Passkeys (2 minute read)
Palo Alto Networks' Unit 42 has released details of three new attack techniques, which it calls Pass-ta-key, that an attacker with access to a TPM-equipped Windows device can use to abuse Google Password Manager's synced passkeys to steal passkeys. The first technique allows the attacker to impersonate a trusted device and request a valid authentication response for one of the victim's passkeys. If a site checks the User Verified flag of the response, the authentication can fail. The other two attack techniques go further by allowing the attacker to register their own user-verification key or even obtain the master key, which is used to encrypt all passkeys synced through the victim's Google Password Manager.
|
|
Love TLDR? Tell your friends and get rewards! |
|
Share your referral link below with friends to get free TLDR swag!
|
|
|
|
| Track your referrals here. |
|
|
|
0 Comments