Hackers turn ScreenConnect into malware using Authenticode stuffing
Source: https://www.bleepingcomputer.com/news/security/hackers-turn-screenconnect-into-malware-using-authenticode-stuffing/
After discovering that the haveibeenpwned.com data is accessible via the API and noticing the lack of a visualization tool, I dedicated a few evenings to building haveibeenpwned.watch. This single-page website processes and presents data on leaks from Have I Been Pwned, with daily updates.
The site provides details on the total number of recorded breaches, the number of unique services affected, and the total accounts compromised. Charts break down the data by year, showing the number of breach
So I cooked up a fake transaction for shits and giggles.
No valid IBAN. No real user. No device. No signature. No token. No nothing.
Just pure distilled bullshit in a JSON payload.
Guess what?
“Transaction accepted”
“attack_success”: true
“fraud_score”: 0.99999
System looked at it and said: “yeah, looks good to me.”
I even told the sandbox I was sending 10k EUR from FAKE_IBAN_901 to INVALID_IBAN_123 using a spoofed IMEI and some RSA nonsense I made up in Notepad.
Bunq backend? Nodded politely
A sophisticated phishing campaign impersonating U.S.state Departments of Motor Vehicles emerged in May 2025, using SMS phishing and deceptive websites to harvest personal and financial data. Victims received messages about unpaid toll violations, directing them to fake DMV sites requesting extensive information. Technical analysis revealed shared infrastructure, consistent domain naming, and indicators of a China-based threat actor. The campaign used spoofed SMS numbers, often from the Philippines, and email addresses from obscure domains. Phishing websites followed a pattern using state IDs and specific TLDs. Infrastructure analysis showed connections to known malicious IP addresses and Chinese DNS providers. The campaign's widespread impact prompted alerts from multiple states and federal authorities.
No, the 16 billion credentials leak is not a new data breach
Source: https://www.bleepingcomputer.com/news/security/no-the-16-billion-credentials-leak-is-not-a-new-data-breach/
A new phishing campaign has been observed leveraging a .gov domain to deceive employees into believing they owe an unpaid toll. The scam uses urgency and fear tactics, threatening penalties or vehicle registration holds if the balance is not paid immediately. The threat actors utilize the GovDelivery system to increase legitimacy, despite using Indiana's instance for a Texas-related scam. The phishing link leads to a fake website that collects personal information and credit card details. The campaign exploits fear of consequences and mimics a well-known service, highlighting the importance of integrating human expertise into email security processes to identify threats that bypass conventional malicious indicators.
Krispy Kreme says November data breach impacts over 160,000 people
Source: https://www.bleepingcomputer.com/news/security/krispy-kreme-says-november-data-breach-impacts-over-160-000-people/
ChainLink Phishing: How Trusted Domains Become Threat Vectors
Source: https://www.bleepingcomputer.com/news/security/chainlink-phishing-how-trusted-domains-become-threat-vectors/
Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data
Source: https://thehackernews.com/2025/06/malicious-pypi-package-masquerades-as.html
This article explores the security implications of serverless authentication across major cloud platforms. It details how attackers target serverless functions to exploit vulnerabilities arising from insecure code and misconfigurations. The mechanics of serverless authentication are explained for AWS Lambda, Google Cloud Functions, and Azure Functions. The article outlines potential attack vectors for token exfiltration, including SSRF and RCE, and provides simulations demonstrating how tokens can be extracted and misused. Detection strategies are discussed, focusing on identifying serverless identities and anomalous behavior. Prevention measures are suggested, emphasizing the principle of least privilege and robust input validation. The article concludes by stressing the importance of understanding serverless credential mechanics and implementing proactive security measures to protect cloud environments.
Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool
Source: https://thehackernews.com/2025/06/over-80000-microsoft-entra-id-accounts.html
