AWS security bulletin: aws.amazon.com/security/sec...

"This issue did not affect any production services or end-users."

Weird how customer logs show the wiper prompt executing.

Anyone else see "clean a system to a near-factory state" in your logs?

Iran's Internet: A Censys Perspective
https://censys.com/blog/irans-internet-a-censys-perspective

There's a new ClickFix variation called FileFix

This one works by tricking users into copying a file path in Windows Explorer.

Attackers modify the clipboard, so you're actually pasting and running PowerShell ahead of the file path

mrd0x.com/filefix-clic...

I'm starting a new series on Detection Engineering called the Detection Field Manual. I wanted to publish < 10 minute reads on threat detection topics I've built in the field, at conferences and our interviews for candidates at Datadog.
Here's issue 1!
www.detectionengineering.net/p/detection-...

2025-06-18 (Wed): #SmartApeSG --> #ClickFix lure --> #NetSupportRAT --> #StealCv2

A #pcap of the traffic, the malware/artifacts, and some IOCs are available at www.malware-traffic-analysis.net/2025/06/18/i....

Today's the 12th anniversary of my blog, so I made this post a bit more old school.

North Koreans reportedly host fake Zoom meeting featuring multiple deepfake colleagues. Target’s microphone doesn’t work so the colleagues talk them through installing malicious fix. www.huntress.com/blog/inside-...

🥷 Detect & defend vs Entra ID persistence! From my RSAC Cloud Summit talk, I've shared how attackers persist through Entra ID roles, applications, and authentication... and how you can stop them: kknowl.es/posts/defend...

For those that have strong opinions on whether AWS should include more info in error messages, this update is relevant. You'll now know what type of policy prevented the access when the principal and S3 bucket are in the same org. aws.amazon.com/about-aws/wh...

I wrote about how to turn in-person meetings into Signal groups, how to manage large semi-public Signal groups while vetting new members, and how to sue announcement-only Signal groups, perfect for rapidly responding to ICE raids micahflee.com/using-signal...

Oracle has a serious, customer impacting security incident playing out in Oracle Classic, a cloud SaaS service they manage. They're attempting to deny it by saying there's no problem in "Oracle Cloud", which is wordplay. doublepulsar.com/oracle-attem...

CyberHaven malicious extension (24.10.4) details 🧵

A new content script was added to the extension manifest which runs at the start of every webpage

New research: We've been monitoring a threat actor publishing dozens of trojanized GitHub repositories targeting threat actors, leaking hundreds of thousands of credentials along the way

securitylabs.datadoghq.com/articles/mut...

My colleague Devin Coldewey (who, good for him, is not on social) and I put together an updating list of free, open-source and/or self-hosted alternatives to popular apps — like Adobe, Dropbox, Google Docs, Pocket — that can help you reclaim your data from Big Tech.

techcrunch.com/2024/11/24/t...

Daniel Grzelak has released Awseye, a so-called Shodan for AWS, an OSINT and reconnaissance service that tracks and analyzes publicly accessible AWS data

awseye.com