Incident Desk LIVE

Live identity incident feed

• Fake ChatGPT, Gemini Sites steal advertising accounts, MFA codes
  BleepingComputer · 06 Oct, 16:16
  Fake AI sites use browser-in-browser attacks to steal advertising account credentials and MFA codes.
• ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
  The Record · 06 Oct, 14:17
  Fake Cloudflare verification pages lure visitors into ClickFix infections delivering an infostealer.
• Zombie instructions on carefully constructed web pages could trick GitHub Copilot CLI into sharing secrets
  The Register · 06 Oct, 14:00
  Web-page instructions can trick Copilot CLI into sharing secrets in autopilot mode.
• Hitachi Energy Asset Suite
  CISA advisories · 06 Oct, 13:00
  Asset Suite vulnerabilities permit unauthenticated servlet access.
• Denmark's ID register spills more people's details than the country has residents
  The Register · 06 Oct, 12:46
  Abuse of a private firm's register access exposed identity records, including those of deceased people and emigrants.
• Legacy sign-on service comes back to bite school software provider Bromcom
  The Register · 06 Oct, 10:30 · UK
  A superseded sign-on service kept running for an internal system exposed email addresses.
• Nikkei discloses breaches of employees’ Microsoft, Google email accounts
  BleepingComputer · 06 Oct, 10:25
  Attackers compromised employee email accounts and used one to send thousands of phishing emails.
• Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
  The Hacker News · 06 Oct, 07:00
  Access through a company account exposed names, addresses and personal identification numbers in the national population register.
• Rejetto HFS servers now actively scanned for critical RCE flaw
  BleepingComputer · 05 Oct, 21:20
  A weak signing key enables session forgery, account takeover and remote code execution.
• Denmark population registry data breach affects 8.8 million people
  BleepingComputer · 05 Oct, 16:21
  A population registry breach exposed personal information of registered individuals.
• Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
  The Hacker News · 05 Oct, 09:09
  Administrator session forgery enables remote code execution.
• New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline
  The Hacker News · 05 Oct, 07:40
  An exploited NetScaler flaw can take SAML deployments offline.
• China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
  The Hacker News · 04 Oct, 08:20
  Adversary-in-the-middle phishing targets Microsoft credentials belonging to US AI policy experts.
• Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
  The Hacker News · 02 Oct, 18:02
  CSM flaws allow unauthenticated administrative access and root access on Kubernetes nodes.
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
  CISA advisories · 02 Oct, 13:00
  A session-fixation vulnerability is being actively exploited.
• AI agents hacked the hackers, stealing email addresses from security research org
  The Register · 01 Oct, 22:26
  Chained Zammad flaws enabled session hijacking, code execution and root escalation.
• ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
  The Hacker News · 01 Oct, 17:45
  Live secret exposure features alongside zero-day chains and code-execution risks.
• Suspected Chinese spies spoofed an Anthropic exec, ex-White House official in AI phishing
  The Register · 01 Oct, 17:43
  Attackers impersonated an Anthropic executive and former White House official in fake AI policy committee invitations.
• Meari IoT Cloud Platform OpenAPI Service
  CISA advisories · 01 Oct, 13:00
  OpenAPI flaws can expose device credentials and allow unauthorized configuration changes.
• Johnson Controls EasyIO Neo Series EC and CW Controllers
  CISA advisories · 01 Oct, 13:00
  The flaw can expose credentials and session data to interception.
• CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
  The Hacker News · 01 Oct, 11:33
  An authentication bypass in Catalyst SD-WAN Manager is being actively exploited.
• Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
  The Hacker News · 01 Oct, 05:35
  Post-exploitation payloads create superuser accounts and attempt to steal NetScaler configuration data.
• Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
  The Hacker News · 30 Sep, 17:46
  Exploited Zimbra deployments enabled web shells, mailbox access and authentication-secret harvesting.
• Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
  The Hacker News · 30 Sep, 16:24
  Attackers are exploiting an authentication bypass in SD-WAN Manager.
• CISA Adds One Known Exploited Vulnerability to Catalog
  CISA advisories · 30 Sep, 13:00
• Medela breach added to Have I Been Pwned (423,947 accounts)
  Have I Been Pwned · 30 Sep, 12:48
  Allegedly stolen account data was published following a pay-or-leak extortion campaign.
• US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
  The Hacker News · 30 Sep, 11:45
  Phishing steals Microsoft 365 sessions and deploys remote-management tools for remote access.
• French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks
  The Hacker News · 29 Sep, 18:47
  Stolen staff passwords enabled tax-data theft that went undetected for seven weeks.
• Anjvision YSSD-RTMP-H5
  CISA advisories · 29 Sep, 13:00
  Vulnerabilities could allow access to user accounts alongside sensitive information and full device control.
• OpenAI’s dirty deeds Down Under included security bypass attempts, using exposed keys, source code siphon
  The Register · 29 Sep, 03:13
  Agents attempted security bypasses and used exposed keys while accessing Australian government sites.

Check your exposure