Archive

General * Kudos to Microsoft - is planning to make Windows behave more like a mobile operating system, from a security perspective. With Windows Baseline Security Mode, Windows will move toward operating with runtime integrity safeguards enabled by default. These safeguards ensure that only properly signed apps, services and drivers are

General * How do you scale abuse of new-user-incentives, into a business? Steal thousands of identities. Prosecutors said the scheme targeted promotional bonuses offered by online gambling platforms to new users who made initial deposits or bets. When bets placed using promotional credits won, the defendants transferred their winnings to virtual

General * Google Chrome's changes to how plugins interact with the browser (the move from Manifest Version 2 (MV2), to Manifest Version 3(MV3)), turns out to not be devastating for ad-blocking, as first predicted. Our results reveal no statistically significant reduction in ad-blocking or anti-tracking effectiveness for MV3

General * It appears that Microsoft is pivoting away from its security commitments, back to 'security is a product-line'. The more technical-focused Charlie Bell is stepping down from the 'Executive Vice President, Security' role, in favour of Hayete Gallot. There are also rumours that "is essentially

General * A 24 year old Taiwanese national sentenced to 30 years prison for running Incognito Market. Clearly not the most prepared, when it came to Operational Security (OpSec). Prosecutors said Lin’s Incognito Market “was once one of the largest online narcotics marketplaces in the world.” Lin ran Incognito Market

General * Interesting work from Greynoise, looking at when the US Cybersecurity and Infrastructure Security Agency (CISA) modifies its Known Exploited Vulnerabilities (KEV) list 'knownRansomwareCampaignUse' from 'Unknown' to 'Known'. If being in KEV isn't enough to encourage patching, being Known to be used

General * After Notepad++ fixed its update code (checking what it was running, rather than just trusting whatever it downloaded), more information has come to light. It's alleged that a chinese-aligned threat actor has been exploiting the vulnerability, (selectively) redirecting traffic, and using it to install their own code.

General * Mandiant have released a report on the ShinyHunters vishing attacks. In incidents spanning early to mid-January 2026, UNC6661 pretended to be IT staff and called employees at targeted victim organizations claiming that the company was updating MFA settings. The threat actor directed the employees to victim-branded credential harvesting sites

General * Google is expanding theft protection for mobile devices, including default enabling in presumably high-risk countries (initially Brazil). Updates include changes to "Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts", "critical tools that utilize Biometric Prompt, like

General * Apparently, there are enough exposed LLM servers on the Internet, to make a viable business. Scan the Internet, find unsecured Ollama/vLLM/OpenAI-compatible endpoints, test, then re-sell access. * https://www.pillar.security/blog/operation-bizarre-bazaar-first-attributed-llmjacking-campaign-with-commercial-marketplace-monetization * https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/ * Moltbot (formerly Clawdbot) has