Tag: Intruder
-
What 5 Million Apps Revealed About Secrets in JavaScript
Leaked API keys are nothing new, but the scale of the problem in front-end code has been largely a mystery – until now. Intruder’s research team built a new secrets detection method and scanned 5 million applications specifically looking for secrets hidden in JavaScript bundles. Here’s what we learned. First seen on bleepingcomputer.com Jump to…
-
Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection
Fileless .NET stage and a modular XWorm core: Beyond initial access, Fortinet observed a fileless .NET stage loaded directly into memory, followed by process hollowing into msbuild.exe, a legitimate Microsoft build tool capable of executing .NET code. The choice of msbuild.exe aligns with the malware’s runtime requirements while helping it blend into normal system activity.”A…
-
Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection
Fileless .NET stage and a modular XWorm core: Beyond initial access, Fortinet observed a fileless .NET stage loaded directly into memory, followed by process hollowing into msbuild.exe, a legitimate Microsoft build tool capable of executing .NET code. The choice of msbuild.exe aligns with the malware’s runtime requirements while helping it blend into normal system activity.”A…
-
Phishing campaign chains old Office flaw with fileless XWorm RAT to evade detection
Fileless .NET stage and a modular XWorm core: Beyond initial access, Fortinet observed a fileless .NET stage loaded directly into memory, followed by process hollowing into msbuild.exe, a legitimate Microsoft build tool capable of executing .NET code. The choice of msbuild.exe aligns with the malware’s runtime requirements while helping it blend into normal system activity.”A…
-
Nearly 17,000 Volvo staff dinged in supplier breach
HR outsourcer Conduent confirms intruders accessed benefits-related records tied to US personnel First seen on theregister.com Jump to article: www.theregister.com/2026/02/10/conduent_volvo_breach/
-
Substack says intruder lifted emails, phone numbers in months-old breach
Contact details were accessed in an intrusion that went undetected for months, the blogging outfit says First seen on theregister.com Jump to article: www.theregister.com/2026/02/05/substack_admit_security_incident/
-
Exposed AWS Credentials Lead to AI-Assisted Cloud Breach in 8 Minutes
Researchers recently tracked a high-speed cloud attack where an intruder gained full admin access in just eight minutes. Discover how AI automation and a simple storage error led to a major security breach. First seen on hackread.com Jump to article: hackread.com/8-minute-takeover-ai-hijack-cloud-access/
-
What an AI-Written Honeypot Taught Us About Trusting Machines
AI-generated code can introduce subtle security flaws when teams over-trust automated output. Intruder shows how an AI-written honeypot introduced hidden vulnerabilities that were exploited in attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/what-an-ai-written-honeypot-taught-us-about-trusting-machines/
-
Why Secrets in JavaScript Bundles are Still Being Missed
Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily exposed?To find out, Intruder’s research team looked at what traditional vulnerability scanners actually cover and built a new secrets detection method to address gaps in existing approaches. Applying this at scale by scanning…
-
AppOmni Surfaces BodySnatcher AI Agent Security Flaw Affecting ServiceNow Apps
AppOmni, a provider of a platform for securing software-as-a-service (SaaS) applications, this week disclosed it has discovered a flaw in the ServiceNow platform that could be used to create a malicious artificial intelligence (AI) agent. Dubbed BodySnatcher (CVE-2025-12420), AppOmni researchers discovered it was possible for an unauthenticated intruder to impersonate any ServiceNow user using only..…
-
FTC schools edtech outfit after intruder walked off with 10M student records
Regulator says Illuminate ignored years of warnings, stored kids’ data in plain text, and kept districts in the dark First seen on theregister.com Jump to article: www.theregister.com/2025/12/02/ftc_illuminate/
-
FTC schools edtech outfit after intruder walked off with 10M student records
Regulator says Illuminate ignored years of warnings, stored kids’ data in plain text, and kept districts in the dark First seen on theregister.com Jump to article: www.theregister.com/2025/12/02/ftc_illuminate/
-
As AI enables bad actors, how are 3,000+ teams responding?
Breaking down trends in exposure management with insights from 3,000+ organizations and Intruder’s security experts First seen on theregister.com Jump to article: www.theregister.com/2025/11/10/ai_enables_bad_actors/
-
The State of Exposure Management in 2025: Insights From 3,000+ Organizations
Attackers are using AI to weaponize old vulnerabilities while security teams face expanding attack surfaces and limited resources. Intruder’s 2025 Exposure Management Index reveals how 3,000+ organizations are adapting and fixing critical flaws faster than ever. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-state-of-exposure-management-in-2025-insights-from-3-000-plus-organizations/
-
Foreign hackers breached a US nuclear weapons plant via SharePoint flaws
Tags: access, attack, authentication, breach, china, control, corporate, cve, cyber, cybercrime, cybersecurity, data, defense, exploit, flaw, framework, government, group, hacker, identity, infrastructure, intelligence, Intruder, korea, microsoft, monitoring, network, ransomware, reverse-engineering, risk, russia, supply-chain, tactics, technology, theft, threat, vulnerability, zero-day, zero-trustChina or Russia? Conflicting attribution: Microsoft attributed the broader wave of SharePoint exploitations to three Chinese-linked groups: Linen Typhoon, Violet Typhoon, and a third actor it tracks as Storm-2603. The company said the attackers were preparing to deploy Warlock ransomware across affected systems.However, the source familiar with the Kansas City incident tells CSO that a…
-
Meet ARGUS, the robot built to catch hackers and physical intruders
Hospitals, airports, and campuses are no longer dealing with separate security problems. Someone can slip past a checkpoint while another actor launches a network scan, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/06/argus-robotic-security-system/
-
Meet ARGUS, the robot built to catch hackers and physical intruders
Hospitals, airports, and campuses are no longer dealing with separate security problems. Someone can slip past a checkpoint while another actor launches a network scan, and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/10/06/argus-robotic-security-system/
-
Red Hat fesses up to GitLab breach after attackers brag of data theft
Open source giant admits intruders broke into dedicated consulting instance, but insists core products untouched First seen on theregister.com Jump to article: www.theregister.com/2025/10/03/red_hat_gitlab_breach/
-
Can We Trust AI To Write Vulnerability Checks? Here’s What We Found
Can AI speed up writing vulnerability checks without sacrificing quality? Intruder put it to the test. Their researchers found where AI helps, where it falls short, and why human oversight is still critical. See what they discovered in practice. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/can-we-trust-ai-to-write-vulnerability-checks-heres-what-we-found/
-
Hunt for RedNovember: Beijing hacked critical orgs in year-long snooping campaign
Not to be confused with all the other reports of Chinese intruders on US networks that came to light this week First seen on theregister.com Jump to article: www.theregister.com/2025/09/27/rednovember_chinese_espionage/
-
CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw
Tags: access, breach, cisa, cyber, cybersecurity, detection, endpoint, exploit, flaw, hacker, incident response, Intruder, rce, remote-code-execution, vulnerabilityFederal cybersecurity agency CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. The incident response began after endpoint detection alerts sounded at the agency. Over three weeks, cyber intruders used the flaw to gain initial access, move laterally, and establish persistence across…
-
From prevention to rapid response: The new era of CISO strategy
Tags: access, attack, authentication, automation, awareness, breach, ciso, control, credentials, cybersecurity, data, finance, fintech, infrastructure, Intruder, malicious, monitoring, network, privacy, radius, resilience, service, strategy, threat, zero-trustBreaches will happen, so how do we deal with the fallout?CISOs are now spending less energy trying to keep every threat at bay. They know attackers will get in, but the question is, what’s next? The new mindset is about stopping intruders from moving around and escalating the damage.This shift means investing in sharper visibility,…
-
Black Hat Fireside Chat: API sprawl turns SMBs into prime targets, simple flaws invite breaches
Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics. Related: 51 common SMB cyberattacks That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog“¦ (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/black-hat-fireside-chat-api-sprawl-turns-smbs-into-prime-targets-simple-flaws-invite-breaches/
-
Black Hat Fireside Chat: API sprawl turns SMBs into prime targets, simple flaws invite breaches
Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics. Related: 51 common SMB cyberattacks That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog“¦ (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/black-hat-fireside-chat-api-sprawl-turns-smbs-into-prime-targets-simple-flaws-invite-breaches/
-
Black Hat Fireside Chat: API sprawl turns SMBs into prime targets, simple flaws invite breaches
Cyber attackers don’t always need sophisticated exploits. Too often, they succeed by exploiting the basics. Related: 51 common SMB cyberattacks That’s the warning from Chris Wallis, founder and CEO of London-based Intruder, who sat down with Last Watchdog“¦ (more”¦) First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/09/black-hat-fireside-chat-api-sprawl-turns-smbs-into-prime-targets-simple-flaws-invite-breaches/
-
Shadow IT Is Expanding Your Attack Surface. Here’s Proof
Shadow IT isn’t theoretical”, it’s everywhere. Intruder uncovered exposed backups, open Git repos, and admin panels in just days, all hiding sensitive data. Make your hidden assets visible before attackers do. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/shadow-it-is-expanding-your-attack-surface-heres-proof/
-
The intruder is in the house: Storm-0501 attacked Azure, stole data, demanded payment via Teams
Don’t let it happen to you First seen on theregister.com Jump to article: www.theregister.com/2025/08/27/storm0501_ransomware_azure_teams/