Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Github Actions Supply Chain Attacks

This week, we discuss a recent cascading supply chain attack involving multiple Github actions workflows that nearly succeeded in compromising a popular Coinbase application. Before that, we discuss a novel way to download malware onto an endpoint by abusing a web browser's caching feature. Additionally, we cover an FBI alert on file converter malware scams.

How to Safeguard Critical Assets from the Growing Threat of Supply Chain Cyberattacks

Organizations must develop robust programs to manage supply chain risks, both known and unknown, while prioritizing their most critical assets. Often referred to as the "crown jewels", these assets are the most valuable and vital to business success. Supply chain attacks exploit vulnerabilities in the network of suppliers, distributors, and other third-party partners to gain unauthorized access to sensitive data and systems.

Cloudflare DDoS Web Protection Demo

Cloudflare DDoS Web Protection provides automatic, intelligent DDoS mitigation from the edge of Cloudflare's global network — mitigating most attacks in three seconds. Advanced Adaptive DDoS Protection learns your unique traffic patterns and adapts to them to provide better protection against sophisticated DDoS attacks. Learn more.

What is DNS Poisoning & DNS Spoofing? Mitigation Tactics for 2026

When you type a familiar website address in your web browser, you expect to land on a particular webpage, but what if you are redirected to a fake website designed to steal your sensitive data? Cyber attackers trick your internet settings into sending you to fake websites instead of the real ones. This is called a DNS spoofing or poisoning attack which exploits vulnerabilities in the Domain Name System (DNS) to compromise the entire network.

Adversary Tradecraft: Emulating Mustang Panda's Use of MAVInject in Recent Campaigns

In cybersecurity, the adage “what’s old is new” continues to hold true as attackers resurface longstanding techniques or repurpose them with new twists and adaptations. The popularization of Living Off the Land Binaries (LOLBins) — legitimate, Windows-native tools commonly abused for malicious uses — is a great example of this.

Amount of Money Requested In BEC Attacks Nearly Doubled in Q4 2024

The average amount of money requested in business email compromise (BEC) attacks spiked to $128,980 in the fourth quarter of 2024, according to the Anti-Phishing Working Group’s (APWG’s) latest report. This is nearly double the amount requested during Q3 2024. The researchers found that Gmail accounts were used to launch 81 percent of BEC scams last quarter. The report also warns of a surge in SMS phishing scams impersonating toll operators in the US, driven by a popular Chinese phishing kit.

What is a Data Poisoning Attack?

Data poisoning is a sophisticated adversarial attack designed to manipulate the information used in training artificial intelligence (AI) models. By injecting deceptive or corrupt data, attackers can hurt model performance, introduce biases, or even create security vulnerabilities. As AI models increasingly power critical applications in cybersecurity, healthcare, finance, and many other industries, maintaining the integrity of their training data is absolutely critical.

GitHub Action Supply Chain Attack (CVE-2025-30066)

On March 14, 2025, a critical supply chain attack targeted the widely used GitHub Action tj-actions/changed-files. This action, utilized in over 23,000 repositories, was compromised when attackers injected malicious code, causing CI/CD pipeline secrets to be exposed in GitHub Actions logs. This breach raised serious concerns regarding the security of GitHub Actions and the importance of implementing robust security measures in CI/CD workflows.

Trustwave MailMarshal's Secure Email Gateway Protects Against Phishing/Ransomware Attacks

In March 2025, several US federal agencies issued a joint warning on the phishing-based, ransomware-as-a-service (RaaS) threat group Medusa and are encouraging organizations to implement mitigations to reduce the likelihood of being impacted by an attack.

The Prime Cyber Battleground- How Hacktivists and APTs Are Intensifying Attacks

]India has emerged as the globe's number one cyberattack target, with advanced persistent threat (APT) groups and hacktivist groups escalating their cyber assaults. From denial-of-service (DDoS) attacks to high-profile data breaches, cybercriminals are exploiting vulnerabilities in India's rapidly digitizing landscape.

Alleged Oracle Cloud Supply Chain Attack: Six Million Records Stolen, 140K Companies Affected

On March 20, 2025, a Breach Forums user, “rose87168,” claimed to have stolen six million records from Oracle Cloud’s SSO and LDAP services and offered the data for sale or in exchange for zero-day exploits. Breach Forums is a known marketplace for cybercriminals to trade stolen data and exploits.

Phishing Attacks Abuse Microsoft 365 to Bypass Security Filters

Threat actors are abusing Microsoft’s infrastructure to launch phishing attacks that can bypass security measures, according to researchers at Guardz. The attackers compromise multiple Microsoft 365 tenants in order to generate legitimate transaction notifications that contain phishing messages.

Vivek Ramachandran to Speak at Black Hat Asia's 2025 Financial Services Summit on the Evolving Cyber War Against State Actors

PALO ALTO, Calif., - 19 March 2025 - Vivek Ramachandran, Founder of SquareX and a cybersecurity veteran with over two decades of experience, will speak at the Black Hat Asia Financial Services Summit on April 2 2025 at Marina Bay Sands, Singapore. His talk, The War Against State Actors: Bleeding Edge Techniques Targeting Financial Services, will examine how nation-state attackers are evolving their tactics to infiltrate financial institutions and bypass enterprise security controls.

Optimising Supply Chain Cyber Security is Critical to the UK Healthcare and Pharmaceutical Sector

The potential impact on the UK healthcare and pharmaceutical industry from cyber-attacks is front-of-mind for a number of key reasons, including how critical these industries are to everyday life. First, the Intellectual Property (IP) at the operational epicentre of these businesses - collectively worth hundreds of billions in R&D investment annually - makes the pharmaceutical industry an increasingly attractive target for cyber threat actors.

AS-REP Roasting Attack Explained | Real-Life Active Directory Exploit Demo

What is AS-REP Roasting? AS-REP Roasting is an attack that exploits misconfigured Active Directory accounts with disabled Kerberos pre-authentication. Attackers can retrieve password hashes and crack them with minimal effort, leading to unauthorized access. Watch This Real-World Attack Demo Jon Obst, Director of Research at Netwrix, demonstrates: How to Prevent AS-REP Roasting Protect your organization with proactive security controls.

How Attackers Use AI To Spread Malware On GitHub

Github Copilot became the subject of critical security concerns, mainly because of jailbreak vulnerabilities that allow attackers to modify the tool’s behavior. Two attack vectors – Affirmation Jailbreak and Proxy Hijack – lead to malicious code generation and unauthorized access to premium AI models. But that’s not all. Contents hide 1 Jailbreaking GitHub Copilot 1.1 Affirmation jailbreak? “Sure,” let’s exploit the AI system(s) 2 Proxy Hijack.

DNS is the center of the modern attack surface - are you protecting all levels?

If you are a mature organization, you might manage an external IP block of 65,000 IP addresses (equivalent to a /16 network). In contrast, very large organizations like Apple may handle an astonishing 16.7 million IP addresses or more (about a /8 network). However, this isn’t the case for many of us. IP addresses are fixed assets and can be costly, so most modern organizations do not have a large number of directly assigned IP addresses for every service they expose to the internet.

European Cyber Report 2025: 137% more DDoS attacks than last year - what companies need to know

Cyberattacks are no longer an abstract threat - they dominate risk planning for companies worldwide. The latest Link11 European Cyber Report shows an alarming trend: the number of DDoS attacks has more than doubled, and they are shorter, more targeted, and more technically sophisticated. Organizations that do not continuously evolve their security strategies face significant financial losses and long-term reputational damage.

Get the TL;DR: tj-actions/changed-files Supply Chain Attack

The tj-actions/changed-files GitHub Action, which is currently used in over 23,000 repositories, has been compromised, leaking secrets through workflow logs and impacting thousands of CI pipelines. All tagged versions were modified, making tag-based pinning unsafe. Public repositories are at the highest risk, but private repos should also verify their exposure.

Detecting and Mitigating the "tj-actions/changed-files" Supply Chain Attack (CVE-2025-30066)

On March 14, 2025, StepSecurity uncovered a compromise in the popular GitHub Action tj-actions/changed-files. Tens of thousands of repositories use this action to track file changes, and it is now known to have been tampered with, posing a risk to both public and private projects. A CVE has been created for this issue: CVE-2025-30066.

Massive DDoS on X: Dark Storm or Cyber Fog?

Earlier this week, users of the X (formerly Twitter) social network were either unable to access the platform or experienced service degradation somehow. On March 10, 2025, reports emerged of users worldwide being unable to log in, post, or view content. This incident was later attributed to a large-scale distributed denial-of-service (DDoS) attack targeting X's infrastructure.

Protect Yourself: Social Engineering Fuels SIM Swapping Attacks

Group-IB has published a report on SIM swapping attacks, finding that attackers continue to use social engineering to bypass technical security measures. SIM swapping is a technique in which an attacker takes over a victim’s phone number, which enables them to access the victim’s accounts. This involves tricking the telecom operator into reassigning the victim’s phone number to a SIM card controlled by the attacker.

4 Key Steps to Prevent Subdomain Takeovers

Adversaries don’t need to force their way in when they can slip through an organization’s overlooked assets. Subdomain takeovers are a prime example of how attackers exploit misconfigured or abandoned DNS records to gain access, launch phishing campaigns, distribute malware, or take other malicious actions — all while operating under the guise of a legitimate corporate domain.

Implementing DLM for Robust Protection Against Cyber Attacks

Want to strengthen your organization's cyber defenses? By 2025 cybercrime will cost the world $10.5 trillion each year making it essential to defend your devices against cyber attacks. Organizations spend an average of 194 days discovering breaches and then require another 292 days to contain them.

The Connection Between SEO and CyberSecurity

At first glance, SEO and cybersecurity might seem like separate disciplines, each with distinct goals. For example, one focuses on improving a website's visibility in search engine results, while the other prioritizes protecting digital assets from threats. However, a closer look reveals a profound and often overlooked connection between these two domains.

HUNTUBS Ransomware Attack on Tata Technologies: A Major Cybersecurity Breach

Cybersecurity incidents continue to make headlines, with the latest victim being Tata Technologies, a leading global engineering and technology services company. The HUNTUBS ransomware group has claimed responsibility for a major attack, leaking sensitive corporate data. The incident, which resulted in the theft of 1.4 TB of confidential data, has raised concerns about cybersecurity resilience among major enterprises.

How AI is Transforming Cyber Attacks

Since its introduction into cybersecurity in the late 1980s as a tool for detecting unusual activity, artificial intelligence (AI) has grown in popularity and functionality, with a major surge of adoption happening in the past few years, thanks to its growing ability to perform tasks faster and more accurately than humans. However, AI has never operated in isolation; it has always relied on human input. And any advanced technology that requires human input can be used for both good and bad.

Prevent, Detect, Contain: LevelBlue MDR's Guide Against Black Basta Affiliates' Attacks

Between December 2024 and February 2025, the LevelBlue MDR team saw over a dozen attempts and a handful of successful intrusions by threat actors (TAs). Internally, we broadly attribute these attacks to the Black Basta ransomware gang. As outlined by other cybersecurity researchers’ reporting of similar tactics, techniques, and procedures (TTPs) observed; there is a high probability that this activity is from affiliate groups or initial access brokers.

How Three Industry Leaders Are Stopping Identity-Based Attacks with CrowdStrike

The CrowdStrike 2025 Global Threat Report highlights the ongoing threat of identity-based attacks. Adversaries are increasingly exploiting stolen credentials to evade detection, and 79% of detections overall were classified as malware-free. Valid account abuse became the primary initial access method in 35% of cloud intrusions. The report also shares that access broker advertisements rose by 50% year-over-year, indicating a rise in demand for valid credentials and other forms of access.

Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks

North Korea’s Lazarus Group is evolving its tactics again. The latest campaign, dubbed Operation Marstech Mayhem, introduces an advanced implant named “Marstech1.” This malware is designed to compromise software developers and cryptocurrency wallets through manipulated open-source repositories. Unlike previous Lazarus operations, this campaign employs obfuscation techniques that make detection significantly harder. Read the full report here.

SquareX Unveils Polymorphic Extensions that Morph Infostealers into Any Browser Extension - Password Managers, Wallets at Risk

With recent attack disclosures like Browser Syncjacking and extension infostealers, browser extensions have become a primary security concern at many organizations. SquareX's research team discovers a new class of malicious extensions that can impersonate any extension installed on the victim's browser, including password managers and crypto wallets.

Inside a Cyberattack: How Hackers Steal Data

The truth about cybersecurity is that it's almost impossible to keep hackers outside of an organisation, particularly as the cybercrime industry becomes increasingly sophisticated and their technology more advanced. Furthermore, once a hacker has broken through an organisation's defences, it is relatively easy to move within the network and access information without being detected for days and even months. This is a significant concern for Banking and Financial Services organisations, which house valuable sensitive and Personally Identifiable Information (PII).

Detecting and Controlling Hidden DNS Tunnel Attacks

DNS is the backbone of the internet, translating domain names into IP addresses to facilitate communication between devices. However, cybercriminals exploit DNS to create covert channels for data exfiltration and command-and-control (C2) operations using DNS tunneling. This technique allows attackers to bypass security measures by disguising malicious traffic as legitimate DNS queries. As DNS-based attacks continue to rise, securing DNS traffic has become a priority for organizations worldwide.

Intelligence-Led Threat Hunting: The Key to Fighting Cross-Domain Attacks

Cross-domain attacks have become a defining challenge in modern cybersecurity, with adversaries exploiting gaps across endpoints, identity systems, and cloud environments to achieve their objectives. These sophisticated attacks use stealthy, malware-free techniques and legitimate tools, making them exceptionally difficult to detect and disrupt.

The Role of DevSecOps in Modern Software Development

In today's fast-paced digital world, security threats are becoming more sophisticated, requiring businesses to integrate robust security measures into their software development lifecycle. Traditional development approaches often treat security as an afterthought, leading to vulnerabilities that can be costly to fix. This is where DevSecOps comes into play-an approach that embeds security into the DevOps pipeline from the start, ensuring that security is a core component rather than an add-on.

Zero-Day Attacks: From Netflix's "Zero Day" with DeNiro to Real-World Implications

In the realm of cybersecurity, the term “zero-day attack” signifies a threat that exploits previously unknown vulnerabilities, leaving no time for detection or defense. Netflix’s limited series “Zero Day,” starring Robert De Niro as former President George Mullen, brings this concept to the forefront of public consciousness.