|
|
Hi there, this is your daily ☕️ Cyberpresso.
|
|
|
In today's Cyberpresso:
|
|
🪪 153M driver's licenses sold on dark web 🕸️ FBI dismantles 23-year-old Sality botnet 🔓 SonicWall flaw allows login-free access 🐛 JFrog flaw grants attackers admin tokens Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.
|
|
2 minutes. Your URL. A customer profile worth using.
Most founders can describe their product. They can't describe their customer. Not in a way that actually changes how they sell.
HubSpot for Startups built a free tool to fix that. Paste in your URL, answer a few quick questions, and it generates a structured profile of your best-fit customer. Firmographics, buying triggers, the works.
Takes 2 minutes. No spreadsheet required.
|
🪪 153M driver's licenses sold on dark web
LINK
|
- A new dark web identity theft service called Nexus, advertised on the Russian cybercrime forum Exploit, is selling digital scans of more than 153 million US and Canadian drivers licenses, plus millions of ID cards, travel documents, and medical cards.
- The images appear to come from an active, ongoing breach at Louisiana-based identity verification firm idscan.net, whose customers include Hertz, Target, and marijuana dispensaries like Planet13; records grew by nearly 400,000 in 24 hours, and each scan includes infrared and ultraviolet versions matching where victims physically handed over their licenses.
- The FBI's New Orleans field office opened an official investigation into the apparent idscan.net breach today, with licenses for high-ranking officials including Defense Secretary Pete Hegseth for sale, exposing people to credit fraud and endangering those in witness protection or fleeing domestic violence.
|
🕸️ FBI dismantles 23-year-old Sality botnet
LINK
|
- The FBI, Justice Department, and CrowdStrike this week took apart Sality, a botnet running since 2003 that infected computers to send spam, launch denial-of-service attacks, steal cryptocurrency, and provide access into compromised networks that could be resold.
- Sality endured because it spread by infecting executable files and used a peer-to-peer structure with no central command server, so there was no single machine that could be taken offline to bring the rest down.
- CrowdStrike reverse-engineered the botnet and seeded it with false information convincing infected machines to disconnect from their controller, while the FBI seized the control domains; no arrests were announced and neither infection counts nor losses were disclosed.
|
🔓 SonicWall flaw allows login-free access
LINK
|
- SonicWall is warning that hackers are actively exploiting two zero-day flaws in its SMA1000 remote-access appliances (models 6210, 7210 and 8200v), including one that lets attackers reach the device without any login.
- The main flaw, CVE-2026-83548 in the Appliance Work Place interface, is maximum severity (CVSS 10/10): a remote, unauthenticated attacker abuses an "unintended alternate access path" to reach sensitive functions and run unauthorized operations without any credentials.
- SonicWall urges customers to contact its support to check for indicators of compromise, and if any are found, to re-image or re-deploy the appliances, change all user and admin passwords, and reset TOTP tokens.
|
🐛 JFrog flaw grants attackers admin tokens
LINK
|
- A critical authentication bypass in JFrog Artifactory, tracked as CVE-2026-82329, lets unauthenticated attackers with network access gain administrator-level privileges, and WatchTowr reports attackers are actively exploiting it to mint themselves admin tokens.
- Under the default configuration the flaw needs no valid credentials, and once attackers hold an admin token they can control repositories, user accounts, permissions, and stored secrets, and slip malicious artifacts into trusted CI/CD build and deployment workflows.
- JFrog's cloud environments are already fortified, but self-hosted users must upgrade to fixed releases 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20, then revoke and reissue admin tokens and treat exposed unpatched instances as compromised.
|
|
Introducing The First Agentic CRM
Get revenue agents, workflows, and automations across every stage of your motion. Access customer data in real time through Attio's web app, MCP, API, and SDK.
Then Ask Attio anything about your business and get instant answers.
It's the CRM that runs the work behind every win.
💡 Strategies & Tactics
|
> Android App RCE via dynamic code loading: Attackers can smuggle a malicious code file into an Android app's private folder using a path-traversal trick, then trigger it for full remote code execution.
|
|
|
Other
news & articles you might like
-
Chaotic Eclipse releases GenDigital Avast antivirus ZeroDay PrettyPrague
LINK
-
Dropbox breach seemingly caused by egregious authentication failure [U]
LINK
-
Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeks
LINK
-
Hackers exploit LiteLLM admin API flaw to Turn Read-Only access Into full server takeover
LINK
-
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
LINK
-
Two critical Chrome flaws put users at risk on malicious websites
LINK
-
Critical HPE fabric composer flaws Let unauthenticated attackers execute code and take Over systems
LINK
|
|
🛠️ Trending tools
|
Halo: an API-first tool combining NLP, visual, and audio authentication to detect deepfakes and synthetic media, helping fraud and trust teams block attacks.
LINK
|
|
MonoCloud for Startups: handles authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for a year
LINK
|
|
Shieldstral: provides free open AI models with permissive licenses plus optimized commercial versions, giving developers flexible, efficient deployment options for various needs.
LINK
|
|
Playground: hands-on sandbox for testing prompt injection attacks against AI agents, helping you understand and explore real LLM security weaknesses
LINK
|
|
cain-agent: an AI penetration testing tool for authorized security assessments, with built-in support for AWS, Azure, GCP, and Chinese cloud providers.
LINK
|
|
DeepSec: an AI security platform that audits AI-generated code for errors in real time and automates authorized penetration testing with 40+ skill packs.
LINK
|
|
|
|
📚 Trending research papers
|
3D scene watermarking hides ownership marks ranging from text to full 3D shapes inside photorealistic 3D reconstructions without degrading image quality or requiring costly retraining, giving creators a way to prove copyright and deter unauthorized use.
LINK
|
|
AI-written system code is kept from directly controlling risky, irreversible actions like device commands, letting a fixed trusted gatekeeper approve each action so safety holds even if the code generator is dishonest.
LINK
|
|
Anonymous internet traffic can now be made accountable, letting users stay private online while a trusted party can still unmask senders who break the rules, without slowing every packet with heavy cryptography.
LINK
|
|
AI-powered scams can be fought most effectively by boosting how often, how centrally, and how accurately people report them, since these three levers multiply together to slash scam profits, against 442 billion in yearly losses.
LINK
|
|
Ownership tags for graph AI hide a secret fingerprint inside models that predict connections, like friend suggestions or fraud links, letting owners prove theft even after 21 tested removal tricks.
LINK
|
|
|
|
|
Our AI Academy has 330+ step-by-step tutorials on ChatGPT, Claude, Perplexity, and every tool that matters. No fluff — just practical workflows you can use at work. Try it free for 7 days.
|
|
💬 How did you find today's edition?
We read every reply — just reply to this email and let us know how we can improve!
|
|
