Microsoft warns of Storm-2657, a financial crime group exploiting MFA flaws to hijack university employee accounts, rerouting salary payments through third-party HR platforms like Workday.

A Critical (CVSS 9.3) flaw (CVE-2025-61928) in Better Auth allows unauthenticated attackers to create/modify API keys for any user, risking full account compromise.

Trend Micro discovered that Axis Communications leaked hardcoded Azure SAS tokens in a signed DLL for its Autodesk Revit plugin, exposing three cloud storage accounts to unauthorized access.

A malware campaign is spoofing Homebrew installer websites to trick macOS developers. The sites use clipboard injection to hide a malicious payload alongside the install command.

GreyNoise warns of a massive, synchronized RDP botnet using 100,000+ IPs from over 100 countries for RDP scanning and enumeration, with US infrastructure as the primary target.

eSentire discovered ChaosBot, a Rust-based malware deployed via DLL sideloading that uses Discord channels as a covert C2 platform to perform reconnaissance and command execution.

DomainTools exposed a Cryptocurrency Drain Conspiracy using a single IP to host scams like MedAI Genesis. Attackers use copied CSS and malicious MobileConfig profiles to drain crypto wallets.

Akira ransomware is actively exploiting the unpatched/misconfigured SonicWall flaw (CVE-2024-40766) and using the rare "UnPAC the Hash" Kerberos technique for lateral movement.

Apple overhauled its Security Bounty program, offering a $2M base reward (up to $5M with bonuses) for zero-click exploits that match mercenary spyware attacks and bypass Lockdown Mode.

The UK's CMA gave Google Strategic Market Status (SMS) over its 90% search dominance. The designation grants the regulator new powers to mandate changes in Google's search and AI services.

Kerberoasting is a way of stealing and cracking service account password hashes offline.

System Administration

When digital trust becomes the most dangerous vulnerability of the twenty-first century

The Twilight of the Invisible Perimeter

The invisible threads of control

Authors: Emmanuel Adetiba, Boladele Akanle, Priscilla Ajayi, Comfort Lawal, Faith O. Sweetwilliams, John Wejin

Part 3 of my LLM safety experiments — bringing context awareness to Inj3ctStop.

From discovery to root using ICMP-based techniques.

In today’s digital world, most companies no longer work inside four walls. Employees log in from home, coffee shops, airports, or anywhere…

Learn about common Windows file systems and forensic artifacts in the file systems.