Netcrook
#RSA
The Kit Was Burned, Not the Playbook: Kratos and the Afterlife of Phishing Infrastructure
A July 2026 disruption did not end the threat around Kratos - it appears to have pushed its methods into fresh Microsoft 365 phishing campaigns.
Nvidia’s AI Security Coalition Signals a New Front: Testing the Agents Before They Act
A new alliance around AI security puts open testing and auditing tools at the center of the race to defend models and agentic systems.
When a Shared AI Chat Becomes Searchable: The Claude Link Problem
A convenience feature can turn into an exposure surface when a public chat link is reachable by crawlers, reminding users that AI collaboration tools can create web objects, not private notes.
Insurance Phishing Has Learned to Move at the Speed of a Login
CTM360-linked research points to a shift from delayed credential theft to real-time account hijacking, a change that shrinks the defender’s window from hours to seconds.
Why Cyber Rehearsals Matter More Than Panic-Driven Response
When attacks move faster than decision-making, simulated crises help teams learn who acts, what to protect, and how to recover before real damage begins.
Waze’s Gemini Upgrade Looks Small on Paper - but It Rewrites the Risk Model in the Car
Google has rolled out five Gemini-powered Waze features, yet only three were live for US drivers at the time described, turning a product update into a lesson about rollout control, voice trust, and in-car abuse resistance.
Singapore Moves AI Risk Into the Rulebook for Critical Systems
A planned update to cybersecurity controls and a new cloud framework suggest regulators are treating AI-enabled threats as an operational compliance problem, not a theoretical one.
Exim’s Spool Boundary Breaks Open a Quiet Local Attack Path
A high-severity path-handling flaw in Exim shows how a mail queue can become a filesystem boundary issue, with privilege impact depending on how the daemon is deployed.
Exim’s Hidden Boundary Slip Turns a Mail Spool Into a Local Risk
A high-severity directory traversal flaw in Exim can let a local user step outside the intended mail spool and may create a privilege-escalation path on affected Unix-like systems.
A Browser Add-On Became the Weak Link in a Private Chat Chain
Adobe patched a flaw in its Acrobat Chrome extension after it was reported to let any website reach WhatsApp Web conversations, underscoring how extension permissions can reshape privacy risk inside the browser.
A Log Endpoint Turned Into a File Reader in Windmill
A high-severity path traversal flaw in an open-source automation platform shows how a routine log feature can become an unauthenticated server-file disclosure risk.
Procurement Emails Became the Bait in a Session-Theft Campaign Against Microsoft 365
AiTM phishing can turn a routine vendor request into a live browser hijack, letting attackers reuse an authenticated Microsoft 365 session even after MFA is completed.
The WebDAV Lab Hiding in Plain Sight
An exposed file-sharing endpoint was described as a malware rehearsal space, where operators tested lure files, shortcut abuse, and Windows delivery paths tied to PureRAT and credential-stealing payloads.
Fifty Years On, the Z80 Still Forces a Hard Question: What Happens When Hardware Outlives Its Era?
A milestone for the Zilog Z80 is less about nostalgia than about the security lesson hidden in long-lived technology: anything that survives long enough can become a documentation and maintenance problem.
Public PoCs Put Notepad++ on the Watch List, Even After the Fix
Three patched vulnerabilities are now accompanied by public proof-of-concept material, a reminder that remediation does not end when the vendor ships an update.
GPT-Red and the Industrialization of AI Red Teaming
OpenAI’s attacker-style model turns prompt-injection testing into a repeatable security workflow, showing how defensive AI is now being trained to think like an adversary.
A Hash, a Name, and a Claim: The Thin Trail Around suppcentersa.com
A post tied to m3rx names suppcentersa.com and a hash string, but the available details stop short of proving a real intrusion.
M3rx Lists SuppCenter Global Services Domain as a New Victim
A victim entry tied to suppcentersa.com raises extortion risk signals, but the available record does not confirm a breach, stolen data, or the technical path in.
Claimed Ransomware Hit Leaves Only a Hash and a Name
A ransomware group calling itself krybit has claimed an attack tied to formasuniversales.com, but the verified record stops short of proving compromise.
Victim Listing Turns a Quiet Brand Into a Ransomware Signal
A public claim tied to Krybit names Formas Universales, S.A. and raises a familiar warning for defenders: a listed victim is not the same as a verified breach.