bigmacd

"Captain Hook."

DomainTools found a malicious Chrome extension posing as a ChatGPT ad blocker, extracting conversations over 150 characters by cloning the DOM. It exfiltrated data via a Discord webhook to a bot. #cybersecurity

Read more: hackread.com/fake-chatgpt-a…

LinkedIn's site injected a hidden JavaScript fingerprinting script probing 6,236 Chrome extensions by ID, gathering device data, and linking to user profiles. #security #privacy

Qilin added Germany's Die Linke to its Tor leak site on April 1.

Read more: securityaffairs.com/190348/cyber-c…

Quick reference guide on AI agents: Understand what they are, how they operate, and key security considerations. Download the security flashcard for more details. #AI #security

Read more: wiz.io/lp/securing-ai…

Create an "account namespace" to bind bucket names to user accounts. Admins can ensure buckets follow this convention using s3:x-amz-bucket-namespace in SCPs. #AWS #S3 #Namespace

"Bucketsquatting, an issue with S3 since 2019, happens when attackers claim a previously used bucket or follow a predictable naming pattern. AWS has introduced measures to tackle this." (225 characters)

Read more: onecloudplease.com/blog/bucketsqu…

definitions, better placement in app store listings, and automated verification tools.

Google counts off-device data, Apple counts stored data. Labels unverified, no tools for developers. Researchers push for standardized guidelines. #privacy #dataprivacy

Apple & Google introduced app privacy labels in 2020, but a study by Carnegie Mellon CyLab revealed many inaccuracies, mainly from developer confusion. The platforms have varying definitions for data collection.

access policy hardening at the center of the defensive response.

Shift to token-based account takeover bypasses MFA by using cloud-hosted infrastructure, evading detection. Signals a structural change in identity theft tactics, emphasizing the need for improved detection controls.

Device code phishing, exploiting OAuth 2.0 Device Authorization Grant, surged 37.5x in 2026. Attackers harvest tokens without needing victim credentials. This rise is driven by... #cybersecurity

20 images in the long tail are often underwatched. 42% of customers now use at least one FIPS image in production, a significant increase from zero in the top 10 last quarter. #tech #data

Unique CVEs increased by 145% and fixes by over 300%, with median remediation at 2.0 days. 97.9% of high-severity CVEs resolved within a week. 96.2% of vulnerabilities are beyond the top tier. #cybersecurity #remediation

Read more: chainguard.dev/unchained/the-…