Just published a new write-up where I walk through how a small HTTP method misconfiguration led to admin credentials being exposed.
It's a simple but impactful example of why misconfigurations matter.
📖 Read it here: [https://is4curity.medium.com/admin-emails-passwords-exposed-via-http-method-change-da23186f37d3](https://is4curity.medium.com/admin-emails-passwords-exposed-via-http-method-change-da23186f37d3)
Let me know what you think — and feel free to share similar cases!
\#bugbounty #infosec #pentest #writeup #websecurity
This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, including Cobalt Strike, DNSCat2, and Iodine, discussing their prevalence and unique characteristics. It also highlights Infoblox's Threat Insight machine learning algorithms, which can detect and block tunneling domains within minutes. The study provides insights into the detection rates of different tunneling families and discusses the challenges in differentiating between legitimate and malicious DNS traffic.
An analysis reveals a recent attack vector targeting WordPress themes, specifically injecting malicious code into the footer.php file. The injected code uses a function called r2048 to retrieve a URL from a remote server and redirect visitors. This method is particularly insidious as it's not visible from the WordPress dashboard. The attackers utilize either cURL or file_get_contents to fetch the redirection URL, allowing for dynamic control over the destination based on factors like the user's browser or device. This technique underscores the importance of regular theme and plugin audits, as well as securing FTP and SSH access to prevent unauthorized file modifications.
In the high-stakes arena of cybersecurity, Microsoft Defender stands as a cornerstone ofWindows security, integrating a sophisticated array of defenses: the Antimalware Scan Interface (AMSI) for runtime script scanning, Endpoint Detection and Response (EDR) forreal-time telemetry, cloud-based reputation services for file analysis, sandboxing for isolated execution, and machine learning-driven heuristics for behavioral detection. Despiteits robust architecture, attackers increasingly bypass these defenses—not by exploitingcode-level vulnerabilities within the Microsoft Security Response Center’s (MSRC) service boundaries, but by targeting logical vulnerabilities in Defender’s decision-makingand analysis pipelines. These logical attacks manipulate the system’s own rules, turningits complexity into a weapon against it.This article series, Strengthening Microsoft Defender: Analyzing and Countering Logical Evasion Techniques, is designed to empower Blue Teams, security researchers, threathunters, and system administrators with the knowledge to understand, detect, and neutralize these threats. By framing logical evasion techniques as threat models and providingactionable Indicators of Compromise (IoCs) and defensive strategies, we aim to bridgethe gap between attacker ingenuity and defender resilience. Our approach is grounded inethical research, responsible disclosure, and practical application, ensuring that defenderscan anticipate and counter sophisticated attacks without crossing legal or ethical lines.
This comprehensive security report investigates unpatchable vulnerabilities in Windows 10 and11, focusing on systemic flaws that resist traditional patching due to their deep integration intothe operating system’s architecture, hardware dependencies, and legacy compatibility requirements. These vulnerabilities, rooted in fundamental design choices and ecosystem constraints,pose significant challenges to securing millions of Windows devices worldwide. The report examines three critical vulnerabilities: legacy BIOS/UEFI firmware weaknesses, kernel memorymanagement flaws, and backward compatibility with legacy protocols. It provides a detailedtechnical analysis, exploitation vectors, detection challenges, and comprehensive mitigationstrategies. With Windows 10 approaching its end-of-support deadline in October 2025, theseflaws pose heightened risks, necessitating proactive defenses. This report adheres to responsible disclosure principles and aims to support Microsoft’s efforts to strengthen Windows securityin 2025
Johnson Controls starts notifying people affected by 2023 breach
Source: https://www.bleepingcomputer.com/news/security/johnson-controls-starts-notifying-people-affected-by-2023-breach/
New FileFix attack weaponizes Windows File Explorer for stealthy commands
Source: https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/
U.S. House Bans WhatsApp on Official Devices Over Security and Data Protection Issues
Source: https://thehackernews.com/2025/06/us-house-bans-whatsapp-on-official.html
Cybercriminals are exploiting Discord's invite system and content delivery features to distribute malware and steal sensitive data. They use fake invite links, expired codes, and vanity URLs to redirect users to malicious servers. The attack chain involves a sophisticated combination of social engineering, multi-stage loaders, and time-based evasion tactics. Victims are tricked into authorizing a fake bot, which leads to the deployment of AsyncRAT and a customized Skuld Stealer. These malware variants target browser credentials, Discord tokens, and cryptocurrency wallets. The campaign uses trusted platforms like GitHub and Bitbucket to host encrypted payloads, and employs advanced techniques to bypass security measures and maintain persistence.
A fileless AsyncRAT campaign is targeting German-speaking users through Clickfix-themed websites. The attack uses a fake 'I'm not a robot' prompt to execute malicious PowerShell code, which downloads and runs obfuscated C# code in memory. This technique enables full remote access, credential theft, and data exfiltration without leaving traces on the disk. The malware establishes persistence via registry keys and communicates with a command and control server on port 4444. The campaign has been active since at least April 2025, primarily affecting German-speaking regions. Mitigation strategies include blocking suspicious PowerShell activity, monitoring registry changes, and implementing in-memory scanning for threats.
Check Point Research uncovered a malware campaign exploiting expired Discord invite links to redirect users to malicious servers. The attackers use a combination of techniques including ClickFix phishing, multi-stage loaders, and time-based evasions to deliver AsyncRAT and a customized Skuld Stealer targeting crypto wallets. The campaign leverages trusted cloud services for payload delivery and data exfiltration to avoid detection. The operation continues to evolve, with threat actors now able to bypass Chrome's App Bound Encryption using adapted tools like ChromeKatz to steal cookies from new Chromium browser versions. The campaign highlights how subtle features in Discord's invite system can be exploited as attack vectors.
US Tops List of Unsecured Cameras Exposing Homes and Offices, BitSight Reveals
Source: https://hackread.com/us-tops-list-unsecured-cameras-exposing-homes-offices/
Riding The Time Machine: Journey Through An Old vBulletin PHP Object Injection
Source: https://karmainsecurity.com/riding-the-time-machine-old-vbulletin-php-object-injection
