エピソード

  • Cyber Bites - 27th June 2025

    Cyber Bites - 27th June 2025
    2025/06/26

    Massive 16 Billion Credential Compilation Not a New Data Breach, Experts Clarify

    https://cybernews.com/security/billions-credentials-exposed-infostealers-data-leak/

    Hackers Exploit Gmail App Passwords to Bypass Multi-Factor Authentication

    https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/

    https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia

    China's Military Adopts Generative AI for Intelligence Operations

    https://www.recordedfuture.com/research/artificial-eyes-generative-ai-chinas-military-intelligence

    Hackers Compromise Over 70 Microsoft Exchange Servers with Keylogger Attacks

    https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/exchange-mutations-malicious-code-in-outlook-pages

    US House Bans WhatsApp on Government Devices Over Security Concerns

    https://www.axios.com/2025/06/23/whatsapp-house-congress-staffers-messaging-app



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    11 分
  • Cyber Bites - 20th June 2025

    Cyber Bites - 20th June 2025
    2025/06/19

    * Australian Regulator Orders Superannuation Funds to Strengthen Authentication After Cyber Attacks

    * Researchers Expose Massive Dark Advertising Network Using Fake CAPTCHAs to Spread Disinformation and Malware

    * Apple Patches Zero-Click Messaging Vulnerability Exploited to Target European Journalists with Israeli Spyware

    * Scattered Spider Cybercrime Group Shifts Focus to US Insurance Industry After Retail Attacks

    * Massive JavaScript Malware Campaign Infects Over 269,000 Websites Using Novel Obfuscation Technique



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    10 分
  • Cyber Bites - 13th June 2025

    Cyber Bites - 13th June 2025
    2025/06/12

    * Extortion Group Briefly Resells Old Ticketmaster Data Stolen in 2024 Snowflake Attacks

    * OpenAI Shuts Down 10 Malicious Operations Using ChatGPT for Cyber Attacks and Disinformation

    * Single Threat Actor Behind 100+ Backdoored GitHub Repositories Targeting Cybercriminals

    * Over 84,000 Roundcube Webmail Instances Exposed to Critical Remote Code Execution Flaw

    * Massive Supply Chain Attack Targets npm and PyPI Ecosystems, Affecting Nearly One Million Weekly Downloads



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    13 分
  • Cyber Bites - 6th June 2025

    Cyber Bites - 6th June 2025
    2025/06/05

    Australia Implements Mandatory Ransomware Payment Disclosure Rules Under New Cyber Security Framework

    Phishing Campaign Targets CFOs Globally Using Legitimate NetBird Remote Access Tool

    Critical Vulnerability in GitHub MCP Integration Allows Private Repository Data Theft

    Critical Flaws Discovered in Popular Software Bill of Materials Generation Tools

    Microsoft Authenticator Begins Warning Users to Export Passwords Before July Deadline

    Special thanks to Justin Butterfield and J A Zien for contributing to this week’s articles



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    10 分
  • Cyber Bites - 30th May 2025

    Cyber Bites - 30th May 2025
    2025/05/29

    * Dozens of Malicious NPM Packages Discovered Harvesting System and Network Intelligence

    * TikTok Becomes New Vector for ClickFix Malware Campaign Targeting User Credentials

    * Australian Cyber Agency Warns of Russian GRU Targeting Western Logistics and Tech Companies

    * Apple Blocks Record $9 Billion in Fraudulent Transactions Across Five-Year Security Crackdown

    https://socket.dev/blog/60-malicious-npm-packages-leak-network-and-host-data

    https://www.trendmicro.com/en_us/research/25/e/tiktok-videos-infostealers.html

    https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/russian-gru-targeting-western-logistics-entities-and-technology-companies

    https://www.apple.com/newsroom/2025/05/the-app-store-prevented-more-than-9-billion-usd-in-fraudulent-transactions/



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    11 分
  • Cyber Bites - 23rd May 2025

    Cyber Bites - 23rd May 2025
    2025/05/22

    * Australian Healthcare Sector Leads in Data Breach Notifications as Human Error Remains a Major Threat

    * Verizon DBIR Reveals Alarming Surge in Third-Party Breaches and Vulnerability Exploitation

    * Australian Human Rights Commission Exposes Sensitive Documents Through Search Engine Indexing Blunder

    * Deceptive KeePass Clone Delivers ESXi Ransomware in Sophisticated Supply Chain Attack

    * Printer Manufacturer ProColored Unwittingly Distributed Malware-Infected Drivers for Months

    https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications/notifiable-data-breaches-report-july-to-december-2024

    https://www.verizon.com/business/resources/reports/dbir/

    https://humanrights.gov.au/our-work/commission-general/data-breach-notification

    https://labs.withsecure.com/content/dam/labs/docs/W_Intel_Research_KeePass_Trojanised_Malware_Campaign.pdf

    https://www.bleepingcomputer.com/news/security/printer-maker-procolored-offered-malware-laced-drivers-for-months/



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    10 分
  • Cyber Bites - 16th May 2025

    Cyber Bites - 16th May 2025
    2025/05/15

    Pearson Educational Giant Suffers Major Cyberattack Through Exposed GitLab Token

    https://plc.pearson.com/en-GB/news-and-insights/news/cyber-security-incident

    https://www.bleepingcomputer.com/news/security/education-giant-pearson-hit-by-cyberattack-exposing-customer-data/

    Malicious npm Packages Target Cursor Editor Users, Affecting Over 3,200 Developers

    https://socket.dev/blog/malicious-npm-packages-hijack-cursor-editor-on-macos

    Cyber Scammers Deploy Fake AI Creation Tools to Spread Noodlophile Malware via Facebook

    https://www.morphisec.com/blog/new-noodlophile-stealer-fake-ai-video-generation-platforms/

    Google Deploys On-Device AI to Combat Scams Across Chrome, Search, and Android

    https://blog.google/technology/safety-security/how-were-using-ai-to-combat-the-latest-scams/

    New Investment Scams Employ Sophisticated Techniques to Target Victims

    https://blogs.infoblox.com/threat-intelligence/uncovering-actor-ttp-patterns-and-the-role-of-dns-in-investment-scams/



    This is a public episode. If you would like to discuss this with other subscribers or get access to bonus episodes, visit edwinkwan.substack.com
    続きを読む 一部表示
    12 分
  • Cyber Bites - 9th May 2025

    Cyber Bites - 9th May 2025
    2025/05/08
    * Banks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminals* 'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attacks* WhatsApp Introduces 'Private Processing' for Secure Cloud-Based AI Features* Microsoft Warns Default Kubernetes Helm Charts Create Security Vulnerabilities* Security Concerns Grow Over Electric Vehicles as Potential Surveillance PlatformsBanks at Risk: Nearly 100 Staff Logins Stolen by Cybercriminalshttps://www.abc.net.au/news/2025-05-01/bank-employee-data-stolen-with-malware-and-sold-online/105232872Cyber criminals have stolen almost 100 staff logins from Australia's "Big Four" banks, potentially exposing these financial institutions to serious cyber threats including data theft and ransomware attacks, according to recent findings from cyber intelligence firm Hudson Rock.The compromised credentials belong to current and former employees and contractors at ANZ, Commonwealth Bank, NAB, and Westpac, with ANZ and Commonwealth Bank experiencing the highest number of breaches. All stolen credentials included corporate email addresses with access to official bank domains."There are around 100 compromised employees that are related to those four banks," said Hudson Rock analyst Leonid Rozenberg. While this number is significantly smaller than the 31,000 customer banking passwords recently reported stolen, the security implications could be more severe."Technically, [attackers] need only one [login] to do a lot of damage," Rozenberg warned.The credentials were stolen between 2021 and April 2025 using specialized "infostealer" malware designed to harvest sensitive data from infected devices. These stolen credentials have subsequently appeared on Telegram and dark web marketplaces.Security experts explain that these breaches could potentially give hackers "initial access" to the banks' corporate networks. While banks employ additional security measures such as Multi-Factor Authentication (MFA), specialized cybercriminals known as "initial access brokers" focus on finding ways around these protections, often targeting employees working from home.The investigation also uncovered a concerning number of compromised third-party service credentials connected to these banks, with ANZ having more than 100 such breaches and NAB more than 70. These compromised services could include critical communication and project management tools like Slack, JIRA, and Salesforce.All four banks have responded by stating they have multiple safeguards in place to prevent unauthorized access. NAB reports actively scanning cybercrime forums to monitor threats, while CommBank noted investing over $800 million in cybersecurity and financial crime prevention last financial year.The Australian Signals Directorate has already warned that infostealer infections have led to successful attacks on Australian businesses, highlighting that this threat extends beyond the banking sector to organizations across all industries.'AirBorne' Vulnerabilities Expose Apple Devices to Remote Code Execution Attackshttps://www.oligo.security/blog/airborneSecurity researchers at Oligo Security have uncovered a serious set of vulnerabilities in Apple's AirPlay protocol and software development kit (SDK) that could allow attackers to remotely execute code on affected devices without user interaction. These flaws, collectively dubbed "AirBorne," affect millions of Apple and third-party devices worldwide.The security team discovered 23 distinct vulnerabilities that enable various attack vectors, including zero-click and one-click remote code execution, man-in-the-middle attacks, denial of service attacks, and unauthorized access to sensitive information. Perhaps most concerning are two specific flaws (CVE-2025-24252 and CVE-2025-24132) that researchers demonstrated could create "wormable" zero-click attacks, potentially spreading from device to device across networks.Another critical vulnerability (CVE-2025-24206) enables attackers to bypass the "Accept" prompt normally required for AirPlay connections, creating a pathway for truly zero-interaction compromises when combined with other flaws."This means that an attacker can take over certain AirPlay-enabled devices and do things like deploy malware that spreads to devices on any local network the infected device connects to," warned Oligo. "This could lead to the delivery of other sophisticated attacks related to espionage, ransomware, supply-chain attacks, and more."While exploitation is limited to attackers on the same network as vulnerable devices, the potential impact is extensive. Apple reports over 2.35 billion active devices worldwide, and Oligo estimates tens of millions of additional third-party AirPlay-compatible products like speakers, TVs, and car infotainment systems could be affected.Apple released security updates on March 31 to address these vulnerabilities across their product line, including patches for iOS 18.4, iPadOS 18.4, macOS versions (Ventura 13.7.5...
    続きを読む 一部表示
    12 分