22 Oct 2025
By Mary

InfoSec News Nuggets 10/22/2025

Hackers exploit 34 zero-days on first day of Pwn2Own Ireland On the first day of Pwn2Own Ireland 2025, security researchers exploited 34 unique zero-days and collected $522,500 in cash awards. The highlight of the day was Bongeun Koo and Evangelos Daravigkas of Team DDOS chaining eight zero-day flaws to hack the QNAP Qhora-322 Ethernet wireless router via the WAN interface and gain access to a QNAP TS-453E NAS device. For this successful attempt, they won $100,000 and are now…
Read More
16 Oct 2025
By Mary

InfoSec News Nuggets 10/16/2025

F5 says hackers stole undisclosed BIG-IP flaws, source code  U.S. cybersecurity company F5 disclosed that nation-state hackers breached its systems and stole undisclosed BIG-IP security vulnerabilities and source code. The company states that it first became aware of the breach on August 9, 2025, with its investigations revealing that the attackers had gained long-term access to its system, including the company's BIG-IP product development environment and engineering knowledge management platform. F5 is a Fortune 500 tech giant specializing in cybersecurity,…
Read More
18 Sep 2025
By Mary

InfoSec News Nuggets 9/18/2025

Google will upgrade its revenge porn defenses with help from a UK nonprofit Google is partnering with a UK nonprofit to fight non-consensual intimate imagery (NCII). (You may know it better as revenge porn.) Over the coming months, the company will begin using StopNCII's hashes. These user-uploaded digital fingerprints can block individuals' unwanted intimate content from appearing in search results. StopNCII has a pretty neat system to combat revenge porn. Say you have some images you most definitely don't want…
Read More
18 Jul 2025
By Mary

InfoSec News Nuggets 7/18/2025

Microsoft Teams voice calls abused to push Matanbuchus malware The Matanbuchus malware loader has been seen being distributed through social engineering over Microsoft Teams calls impersonating IT helpdesk. Matanbuchus is a malware-as-a-service operation seen promoted on the dark web first in early 2021. It was advertised as a $2,500 Windows loader that executes malicious payloads directly in memory to evade detection. In June 2022, threat analyst Brad Duncan reported that the malware loader was being used to deliver Cobalt…
Read More
24 Jun 2025
By Mary

InfoSec News Nuggets 6/24/2025

2 clever ways Android 16 guards your security - but you need to enable them Google released Android 16 a bit earlier than expected, and although it was missing some crucial features, there are key additions to the platform that go a long way to improve security. This was an important step forward, as the need for improved security grows every year. Without companies like Google, Apple, and others upping the ante on security, the mobile space…
Read More
07 Nov 2024
By Mary

InfoSec News Nuggets 11/07/2024

Warning: Hackers could take over your email account by stealing cookies, even if you have MFA  The Federal Bureau of Investigation (FBI) has issued a warning that cybercriminals are taking over email accounts via stolen session cookies, allowing them to bypass the multi-factor authentication (MFA) a user has set up. Here’s how it works. Most of us don’t think twice about checking the “Remember me” box when we log in. When you log in and the server has verified…
Read More
19 Apr 2024
By Mary

InfoSec News Nuggets 4/19/2024

Law enforcement infiltrates fraud platform used by thousands of criminals worldwide A website used by more than 2,000 criminals to defraud victims worldwide has been infiltrated in the Met’s latest joint operation to tackle large-scale online fraud. ‘LabHost’ is a service which was set up in 2021 by a criminal cyber network. It enabled the creation of “phishing” websites designed to trick victims into revealing personal information such as email addresses, passwords, and bank details.…
Read More
12 Oct 2022
By Mary

InfoSec News Nuggets 10/12/2022

The Chinese surveillance state proves that the idea of privacy is more “malleable” than you’d expect It’s no surprise that last week, when the Biden administration updated its list of Chinese military companies blocked from accessing US technologies, it added Dahua. The second-largest surveillance camera company in the world, just after Hikvision, Dahua sells to over 180 countries. It exemplifies how Chinese companies have leapfrogged to the front of the video surveillance industry and have…
Read More
15 Sep 2022
By Mary

InfoSec News Nuggets 09/15/2022

Period tracking app Flo rolls out ‘Anonymous Mode’ on iOS, Android launch coming next month Period tracking app Flo has released a new “Anonymous Mode” setting that gives users the option to access the app without their name, email address, and technical identifiers being associated with their health data. Flo promised to release the mode shortly after the Supreme Court overturned Roe v. Wade. The company launched the new Anonymous Mode setting on Wednesday for all iOS…
Read More
05 Jul 2022
By Mary

InfoSec News Nuggets 07/05/2022

Microsoft finds Raspberry Robin worm in hundreds of Windows networks Microsoft says that a recently spotted Windows worm has been found on the networks of hundreds of organizations from various industry sectors. The malware, dubbed Raspberry Robin, spreads via infected USB devices, and it was first spotted in September 2021 by Red Canary intelligence analysts. Cybersecurity firm Sekoia also observed it using QNAP NAS devices as command and control servers (C2) servers in early November [PDF], while…
Read More
24 Aug 2021
By Mary

InfoSec News Nuggets 08/24/2021

Caller ID Spoofing Spoofing is when a caller deliberately falsifies the information transmitted to your caller ID display to disguise their identity. Scammers often use neighbor spoofing so it appears that an incoming call is coming from a local number, or spoof a number from a company or a government agency that you may already know and trust. If you answer, they use scam scripts to try to steal your money or valuable personal information,…
Read More
20 Mar 2020
By Mary

InfoSec News Nuggets 3/20/2020

1 - US Commerce Dept Shares Tips On Securing Virtual Meetings The US National Institute of Standards and Technology (NIST) today shared a number of measures that should be taken by remote workers to prevent eavesdropping and protect their privacy during virtual meetings while working from home during the current COVID-19 pandemic. Jeff Greene, the director of the National Cybersecurity Center of Excellence (NCCoE) at the NIST said that "if virtual meetings are not set up correctly,…
Read More
13 Feb 2020
By Mary

InfoSec News Nuggets 2/13/2020

1 - Robot with coronavirus advice hits Times Square Worried about the spread of coronavirus? A five-foot tall (1.5 meter) Promobot might have your answer. The robot with a friendly face rolled into Times Square on Monday to help provide information about the new virus. Curious passersby stopped, filled out a short questionnaire on an iPad-like touch screen attached to the robot’s chest, and even had a conversation with the machine. Promobot was created by…
Read More
20 Dec 2019
By Mary

InfoSec News Nuggets 12/20/2019

1 - The weird future of brain-computer interfaces: Replacing passwords with thoughts and mind-reading bosses who can tell when you are bored Brain computer interfaces may sound futuristic, but adoption of such systems -- which allow signals from the brain to be recorded or used to control technology -- is on the rise. Much of the development work going on around BCIs is focused on medical uses for the tech, but consumer applications of BCIs…
Read More