Hacking Furbo - A Hardware Research Project – Part 5: Exploiting BLE
Source: https://www.softwaresecured.com/post/hacking-furbo-a-hardware-research-project-part-5-exploiting-ble
I’ve been seeing more and more cases where the SOC reports success, process killed, host isolated, dashboard green. Yet weeks later the same organisation is staring at ransom notes or data leaks.
The problem: we treat every alert like a dodgy PDF. Malware was contained. The threat actor was not.
SOCs measure noise (MTTD, MTTR, auto-contain). Adversaries measure impact (persistence, privilege, exfiltration). That’s why even fully “security-compliant” companies lose millions every day. Look at what's happening in the UK.
Curious how others here are approaching this:
* Do you have workflows that pivot from containment to investigation by default?
* How do you balance speed vs depth when you suspect a human adversary is involved?
* Are you baking forensic collection into SOC alerts, or leaving it for the big crises?
Full piece linked for context.
Moonlock Lab researchers have spotted a new macOS malware campaign that leverages **malvertising + fake social media profiles** to distribute malicious apps. Once installed, the malware exfiltrates sensitive data and can be updated remotely with new modules. This trend shows that macOS is no longer “low priority” for attackers – they’re actively adapting Windows-style tactics for Apple’s ecosystem.
These aren't just random mobile apps with a few hundred or thousand downloads. Most of them had over 100K+, 1M+, 5M+, 10M+, 50M+, or even 100M+ downloads (Tea app only has 500K+ downloads).
I’m also releasing OpenFirebase, an automated Firebase security scanner that checks for unauthorized read and/or write access on Firestore, Realtime Database, Storage Buckets, and Remote Config. It performs checks from both unauthenticated and/or authenticated perspectives, and it can bypass weak Google API key restrictions.
BlackLock Ransomware: From Meteoric Rise to Sudden Disruption
Source: https://wealthari.com/blacklock-ransomware-from-meteoric-rise-to-sudden-disruption/
This takes "Single Sign-On" to a whole new level...
It's not about blaming Microsoft or any one vendor, but questioning why our systems are architected so a single platform can wield this kind of control in the first place.
We've written up a perspective on the broader implications and proposed how identity could be built differently. Full disclosure: we're the researchers/devs behind this piece, sharing our own analysis (hopefully this isn't taken as promotional to our non-commercial solution)
New Infostealer Campaign Targeting Mac Users via GitHub Pages Claiming to Offer LastPass Premium
Source: https://blog.lastpass.com/posts/attack-targeting-macs-via-github-pages
EDR-Freeze: A Tool That Puts EDRs And Antivirus Into A Coma State
Source: https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens
Source: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/
I wrote a hands on guide that shows how leaked webhooks surface as an attack vector; how to find them in the wild; how to craft safe non destructive PoCs; how to harden receivers. Includes curl examples for Slack and Discord; Node.js and Go HMAC verification samples; a disclosure template.
Why this matters
* webhooks are often treated as bearer secrets; leaks are common
* small mistakes in verification or ordering can become business logic bugs
* many real world impacts are serviceable without flashy RCE
What you get in the post
* threat model and scope guidance
* detection rules and SIEM ideas
Read it here: [https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/](https://blog.himanshuanand.com/posts/2025-09-17-how-to-hack-webhooks/)
Notes: do not test endpoints you do not own.follow program scope and responsible disclosure rules.
Happy hunting
A few months ago Dutch newspaper de Volkskrant published a very interesting article describing how, according to secret Iranian documents obtained by the newspaper, the Islamic Revolutionary Guard Corps (IRGC) was attempting to procure encrypted, Chinese Tiantong-1 satellite phones due to increasing distrust of Iranian communications infrastructure in the light of the Iran-Israel war. In this first blogpost of a 2-part series, the previously unexplored Tiantong-1 satellite system and its security aspects are illuminated.
