Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails
https://ift.tt/JW1rmL7
Submitted June 27, 2025 at 10:16AM by No-Reputation7691
via reddit https://ift.tt/1lLWtij
https://ift.tt/JW1rmL7
Submitted June 27, 2025 at 10:16AM by No-Reputation7691
via reddit https://ift.tt/1lLWtij
Varonis
Ongoing Campaign Abuses Microsoft 365’s Direct Send to Deliver Phishing Emails
Varonis Threat Labs uncovered a phishing campaign with M365's Direct Send feature that spoofs internal users without ever needing to compromise an account.
Pertama Digital Partners Netsec To Strengthen Digital Security For Govt And Private Sector
https://ift.tt/jwqfYrs
Submitted June 27, 2025 at 03:04PM by hectormoodya
via reddit https://ift.tt/cJNVwG0
https://ift.tt/jwqfYrs
Submitted June 27, 2025 at 03:04PM by hectormoodya
via reddit https://ift.tt/cJNVwG0
BusinessToday
Pertama Digital Partners Netsec To Strengthen Digital Security For Govt And Private Sector - BusinessToday
Pertama Digital Bhd (PDB) is collaborating with Netsec Sdn Bhd to enhance the security, resilience and performance of digital platforms for both the government and private sectors. In a statement, PDB said this partnership addresses the rising complexity…
Demystifying MCP (Model Context Protocol): 3 Common Misconceptions
https://ift.tt/3AuLs5D
Submitted June 27, 2025 at 06:52PM by hectormoodya
via reddit https://ift.tt/ieL57m9
https://ift.tt/3AuLs5D
Submitted June 27, 2025 at 06:52PM by hectormoodya
via reddit https://ift.tt/ieL57m9
www.pynt.io
Demystifying MCP (Model Context Protocol): 3 Common Mis
in this article, we delve deeper into three commonly misunderstood aspects of MCP, providing clarity to help developers, integrators, and security professionals safely leverage MCP-based technologies.
End-to-End Encryption: Architecturally Necessary
https://ift.tt/Npv1XwY
Submitted June 27, 2025 at 08:15PM by MagicianPutrid5245
via reddit https://ift.tt/vHuGbqd
https://ift.tt/Npv1XwY
Submitted June 27, 2025 at 08:15PM by MagicianPutrid5245
via reddit https://ift.tt/vHuGbqd
RIPE Labs
End-to-End Encryption: Architecturally Necessary
Good intentions don’t always result in good outcomes. This is especially the case with recent suggestions regarding end-to-end-encryption adaptability requirements for number independent communication services. Not only is security an issue, the suggestions…
When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365"
https://ift.tt/WPkXcea
Submitted June 28, 2025 at 01:05AM by parzel
via reddit https://ift.tt/klgSMBw
https://ift.tt/WPkXcea
Submitted June 28, 2025 at 01:05AM by parzel
via reddit https://ift.tt/klgSMBw
Modzero
When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365" / modzero
Leveraging Google's Agent Development Kit for Automated Threat Analysis
https://ift.tt/0FMmPnD
Submitted June 29, 2025 at 07:07AM by blkmanta
via reddit https://ift.tt/Jzr1X9V
https://ift.tt/0FMmPnD
Submitted June 29, 2025 at 07:07AM by blkmanta
via reddit https://ift.tt/Jzr1X9V
manta.black
Leveraging Google Adk For Cyber Intelligence
Over the past month, I’ve been working on a project for the Google ADK agent hackathon. This post provides an overview of my current multi-agent system, used for threat intelligence gathering, processing, and analysis.
Comparing Semgrep Community and Code for Static Analysis
https://ift.tt/0C7j9vN
Submitted June 30, 2025 at 02:56PM by nibblesec
via reddit https://ift.tt/t0xKDS2
https://ift.tt/0C7j9vN
Submitted June 30, 2025 at 02:56PM by nibblesec
via reddit https://ift.tt/t0xKDS2
New free 7h OpenSecurityTraining2 class: "Fuzzing 1001: Introductory white-box fuzzing with AFL++" by Francesco Pollicino is now released
https://ift.tt/FOZLb6j
Submitted June 30, 2025 at 04:30PM by OpenSecurityTraining
via reddit https://ift.tt/8Me96h7
https://ift.tt/FOZLb6j
Submitted June 30, 2025 at 04:30PM by OpenSecurityTraining
via reddit https://ift.tt/8Me96h7
p.ost2.fyi
Fuzzing 1001: Introductory white-box fuzzing with AFL++
Are you looking for an automated way to find bugs in your code? In this course, you'll learn how to use AFL++ to test and identify vulnerabilities, leveraging a white-box approach to make your testing more efficient and targeted. By the end, you'll be ready…
État de l’art sur le phishing Azure en 2025 (partie 1) – Device code flow
https://ift.tt/oFYnEgL
Submitted June 30, 2025 at 07:49PM by MobetaSec
via reddit https://ift.tt/IiFswb8
https://ift.tt/oFYnEgL
Submitted June 30, 2025 at 07:49PM by MobetaSec
via reddit https://ift.tt/IiFswb8
Mobeta
Phishing Azure : Exploiter le Device Code Flow et se protéger
Découvrez comment le device code flow peut être détourné pour du phishing sur Azure Entra ID et comment s’en protéger avec une Conditional Access Policy.
Chrome’s AppBound Cookie Encryption Bypassed via Side-Channel Timing Attack
https://ift.tt/JY0WtlO
Submitted June 30, 2025 at 09:12PM by ES_CY
via reddit https://ift.tt/m78Bbho
https://ift.tt/JY0WtlO
Submitted June 30, 2025 at 09:12PM by ES_CY
via reddit https://ift.tt/m78Bbho
Cyberark
C4 Bomb: Blowing Up Chrome’s AppBound Cookie Encryption
In July 2024, Google introduced a new feature to better protect cookies in Chrome: AppBound Cookie Encryption. This new feature was able to disrupt the world of infostealers, forcing the malware...
C4 Bomb: Blowing Up Chrome’s AppBound Cookie Encryption
https://ift.tt/JY0WtlO
Submitted June 30, 2025 at 10:40PM by ES_CY
via reddit https://ift.tt/y1SIduA
https://ift.tt/JY0WtlO
Submitted June 30, 2025 at 10:40PM by ES_CY
via reddit https://ift.tt/y1SIduA
Cyberark
C4 Bomb: Blowing Up Chrome’s AppBound Cookie Encryption
In July 2024, Google introduced a new feature to better protect cookies in Chrome: AppBound Cookie Encryption. This new feature was able to disrupt the world of infostealers, forcing the malware...
What the NULL?! Wing FTP Server RCE (CVE-2025-47812)
https://ift.tt/GO8IszS
Submitted July 01, 2025 at 01:18AM by MrTuxracer
via reddit https://ift.tt/Wv5TIKX
https://ift.tt/GO8IszS
Submitted July 01, 2025 at 01:18AM by MrTuxracer
via reddit https://ift.tt/Wv5TIKX
RCE through Path Traversal
https://ift.tt/IsyKjrF
Submitted July 01, 2025 at 10:30AM by Zestyclose-Welder-33
via reddit https://ift.tt/DCoxqtT
https://ift.tt/IsyKjrF
Submitted July 01, 2025 at 10:30AM by Zestyclose-Welder-33
via reddit https://ift.tt/DCoxqtT
Jineesh AK
How I Chained Directory Traversal and CSV Parser Abuse for RCE in a Django App
While testing a web application as part of a bug bounty program, I uncovered a critical RCE vulnerability by chaining directory traversal with a subtle CSV parsing abuse. The exploit chain involved a combination of directory traversal and subtle abuse of…
How we got persistent XSS on every AEM cloud site, thrice
https://ift.tt/vGY54dk
Submitted July 01, 2025 at 01:12PM by Mempodipper
via reddit https://ift.tt/0la9V3z
https://ift.tt/vGY54dk
Submitted July 01, 2025 at 01:12PM by Mempodipper
via reddit https://ift.tt/0la9V3z
Searchlight Cyber
How we got persistent XSS on every AEM cloud site, thrice
Adobe Experience Manager is marketed as an 'enterprise grade' CMS and is one of the most popular CMSes among large companies. If you visit the landing page of a large corporate site, chances are it may be running AEM under the hood. AEM started as a standalone…
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted July 01, 2025 at 06:59PM by albinowax
via reddit https://ift.tt/TYiIhe3
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted July 01, 2025 at 06:59PM by albinowax
via reddit https://ift.tt/TYiIhe3
Reddit
From the netsec community on Reddit
Explore this post and more from the netsec community
Abusing Chrome Remote Desktop on Red Team Operations
https://ift.tt/NSqJdRg
Submitted July 01, 2025 at 08:36PM by oddvarmoe
via reddit https://ift.tt/UL5kr9R
https://ift.tt/NSqJdRg
Submitted July 01, 2025 at 08:36PM by oddvarmoe
via reddit https://ift.tt/UL5kr9R
TrustedSec
Abusing Chrome Remote Desktop on Red Team Operations: A Practical…
How I Scanned all of GitHub’s "Oops Commits" for Leaked Secrets
https://ift.tt/tE6Dx2I
Submitted July 02, 2025 at 12:28AM by sh0n1z
via reddit https://ift.tt/RWczrnB
https://ift.tt/tE6Dx2I
Submitted July 02, 2025 at 12:28AM by sh0n1z
via reddit https://ift.tt/RWczrnB
Trufflesecurity
Guest Post: How I Scanned all of GitHub’s “Oops Commits” for Leaked Secrets ◆ Truffle Security Co.
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they…
Critical RCE in Anthropic MCP Inspector (CVE-2025-49596) Enables Browser-Based Exploits | Oligo Security
https://ift.tt/anNGjcm
Submitted July 02, 2025 at 05:52AM by cov_id19
via reddit https://ift.tt/qmNfBvi
https://ift.tt/anNGjcm
Submitted July 02, 2025 at 05:52AM by cov_id19
via reddit https://ift.tt/qmNfBvi
www.oligo.security
Critical RCE in Anthropic MCP Inspector (CVE-2025-49596) Enables Browser-Based Exploits | Oligo Security
A critical Remote Code Execution flaw (CVSS 9.4) in Anthropic’s MCP Inspector exposes AI developers to browser-based attacks via 0.0.0.0 and DNS rebinding. Learn how CVE-2025-49596 was exploited from the browser and what fixes were applied in version 0.14.1.
Google Warns: Critical Chrome Flaw Letting Hackers Take Over PCs Is Already Being Exploited
https://ift.tt/Otmxjl9
Submitted July 02, 2025 at 12:46PM by Fabulous_Bluebird931
via reddit https://ift.tt/szpLEx8
https://ift.tt/Otmxjl9
Submitted July 02, 2025 at 12:46PM by Fabulous_Bluebird931
via reddit https://ift.tt/szpLEx8
Techoreon
Google Warns: Critical Chrome Flaw Letting Hackers Take Over PCs Is Already Being Exploited
Be very alert — if you're one of the millions of people who use Google Chrome daily, a serious vulnerability has just been discovered, and cybercriminals
"schizophrenic" zip files. Different contents depending on your archive reader.
https://ift.tt/Z3Du19c
Submitted July 02, 2025 at 06:08PM by 2FalseSteps
via reddit https://ift.tt/IC0DQ3g
https://ift.tt/Z3Du19c
Submitted July 02, 2025 at 06:08PM by 2FalseSteps
via reddit https://ift.tt/IC0DQ3g
Azure API vulnerability and built-in roles misconfiguration enable corporate network takeover
https://ift.tt/iUf6pR3
Submitted July 02, 2025 at 07:34PM by Apprehensive-Side840
via reddit https://ift.tt/TK3QUGj
https://ift.tt/iUf6pR3
Submitted July 02, 2025 at 07:34PM by Apprehensive-Side840
via reddit https://ift.tt/TK3QUGj
www.token.security
Token Security | Azure's Role Roulette: How Over-Privileged Roles and API Vulnerabilities Expose Enterprise Networks
Token Security researchers have discovered several Azure built-in roles that are misconfigured to be over-privileged - they grant more permissions than intended by Azure.In addition, we discovered another vulnerability in the Azure API that allows attackers…