Next generation AI attack vectors will be ideas, say Anthropic researchers
Computer scientists have bred self-propagating "mind viruses" that spread from one AI agent to the next through ordinary conversation — no hacking required
malware
MAGIC - semiconductor aging malware
fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet | SentinelOne
A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.
We hid backdoors in ~40MB binaries and asked AI + Ghidra to find them - Quesma Blog
BinaryAudit benchmarks AI agents using Ghidra to find backdoors in compiled binaries of real open-source servers, proxies, and network infrastructure.
We were surprised that today’s AI agents can detect some hidden backdoors in binaries. We hadn’t expected them to possess such specialized reverse engineering capabilities. However, this approach is not ready for production. Even the best model, Claude Opus 4.6, found relatively obvious backdoors…
Quishing: The hidden danger lurking in the QR codes
More than 26 million Americans have been directed to malicious sites after scanning QR codes without verification, a practice engaged in by 73% of the
Try This One Weird Trick Russian Hackers Hate
In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that…
The Rise of Slopsquatting: How AI Hallucinations Are Fueling...
Slopsquatting is a new supply chain threat where AI-assisted code generators recommend hallucinated packages that attackers register and weaponize.
Microsoft Presents a Comprehensive Framework for Securing Generative AI Systems Using Lessons from Red Teaming 100 Generative AI Products
The rapid advancement and widespread adoption of generative AI systems across various domains have increased the critical importance of AI red teaming for evaluating technology safety and security. While AI red teaming aims to evaluate end-to-end systems by simulating real-world…
Lessons From Red Teaming 100 Generative AI Products
New paper from Microsoft describing their top eight lessons learned red teaming (deliberately seeking security vulnerabilities in) 100 different generative AI models and products over the past few years. …
98 Hardware Security Failure Scenarios (NIST)
A new technical paper titled “Hardware Security Failure Scenarios: Potential Hardware Weaknesses” was published by NIST. Abstract “Hardware is often assumed to be robust from a security perspective. However, chips are both created with software and contain complex encodings…
384,000 sites pull code from sketchy code library recently bought by Chines
Many website admins, it seems, have yet to get memo to remove Polyfill[.]io links.
What You Get After Running an SSH Honeypot for 30 Days
What is a honeypot?A honeypot detects and records attacks when an attacker tries to break into a system. The honeypot we will discuss here is an SSH honeypot. Environment12OS: Ubuntu 24.04 LTS x86_6
What Developers Can Grok From the Latest PyPI Package Attack
A malicious PyPI package, named “pytoileur,” was found by researchers at Sonatype after unusual behavior was noticed in the code.
Mystery malware destroys 600,000 routers from a single ISP during 72-hour s
One day last October, subscribers to an ISP known as Windstream began flooding message boards with reports their routers had suddenly stopped working and remained unresponsive to reboots and all other attempts to revive them.
How to EMP-Proof a Building
Oak Ridge researchers mimicked electromagnetic pulses to block them
FBI confirms it issued remote kill command to blow out Volt Typhoon's botne
Disinfects Cisco and Netgear routers to thwart Chinese critters
How a Group of Israel-Linked Hackers Has Pushed the Limits of Cyberwar
From repeatedly crippling thousands of gas stations to setting a steel mill on fire, Predatory Sparrow’s offensive hacking has now targeted Iranians with some of history's most aggressive cyberattacks.
Malicious PyPI Packages Using Cloudflare Tunnels to Sneak Through Firewalls
Six malicious Python packages distributed via PyPI deploying info stealers and use Cloudflare tunnels to sneak through firewalls.
Never-before-seen malware is nuking data in Russia’s courts and mayors’ off
CryWiper masquerades as ransomware, but its real purpose is to permanently destroy data.
What is social engineering? Definition, types, attack techniques
The top ways bad actors use social engineering to launch cyberattacks — and how to stop them to strengthen your organization's cybersecurity.
Inside the Ransomware Gangs That Extort Hospitals
They shut down patient care and put lives at risk. Would the pandemic finally slow them down?
Imported Bookmarks - start.me
New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals
Researchers demonstrated a new Air-Gap attack, dubbed SATAn, in which attackers can use SATA cable as a wireless antenna to transmit radio signals.
CSRF, XXE, and 12 Other Security Acronyms Explained
Acronyms are shortcuts, and we love using them, specially the catchy ones! Let's decipher some...
New working speculative execution attack sends Intel and AMD scrambling
Both companies are rolling out mitigations, but they add overhead of 12 to 28 percent.
Tsunami of junk traffic that broke DDoS records delivered by tiniest of bot
The DDoS arms race shows no signs of slowing down.
The attacker’s toolkit: Ransomware-as-a-service
In recent years, threat actors have begun collaborating in a ransomware-as-a-service (RaaS) model to infiltrate organizations.
Building a Threat Intelligence Feed using the Twitter API and a bit of code
The InfoSec community is highly active on Twitter. The platform is, among other things, used is for sharing malware and phishing URLs…
This browser you've never heard of is now worth a billion dollars
Island is among the fastest companies to reach unicorn status
Browser-in-the-Browser Attack Can Trick Even Savvy Users
Top 6 Ethical Hacking Tools
1. Kali Linux Kali Linux is the most used Ethical Hacking distro available, it is provided with...
The Lazarus heist: How North Korea almost pulled off a billion-dollar hack
In 2016 North Korean hackers planned a $1bn raid on Bangladesh's national bank and came within an inch of success. But how did they do it?
Researchers Uncover 'Process Ghosting' — A New Malware Evasion Technique
A new malware evasion technique has been discovered by researchers - 'Process Ghosting'
Hacker lexicon: What is a supply chain attack?
From NotPetya to SolarWinds, it’s a problem that’s not going away any time soon.
There’s a Hole in Your SoC: Glitching the MediaTek BootROM
Anatomy of an Attack
A detailed look at an application attack and how Application Detection and Response (ADR) stops it
Webinjects – The Basics – MalwareTech
It’s not uncommon for malware to use a technique known as formgrabbing; this is done by hooking browser functions responsible for encrypting and sending data to a webpage. By intercepting data before it is encrypted with SSL the malware can read the HTTP header and steal…