Annex Security (acq by Socket)

82 posts

Annex Security (acq by Socket) banner
Annex Security (acq by Socket)

Annex Security (acq by Socket)

@secureannex

Discover what is hiding in your software extensions. Acquired by @SocketSecurity

Katılım Temmuz 2024
5 Takip Edilen291 Takipçiler
Annex Security (acq by Socket)
On a mission to secure the developer endpoint as more people become developers 💪
Feross@feross

Today is a big day for @SocketSecurity. We just raised a $60M Series C at a $1B valuation, led by @ThriveCapital with participation from @a16z, @AbstractVC, and @CapitalOne Ventures. Total funding is now $125M. Four years ago, we started Socket because open source dependencies were flowing into production faster than anyone could vet them. AI has massively accelerated that. Code is being written, shipped, and deployed before any human reads it. Security has to operate at that same speed. One data point from Thrive's diligence that I keep coming back to: they first discovered Socket because @cursor_ai, @OpenAI, and @AnthropicAI all independently told them it was the most important security tool they'd adopted for AI-driven development. Three of the most sophisticated AI companies converging on the same vendor unprompted. Since our Series B, Socket has grown to more than 20,000 organizations, protecting over 1.5 million repositories and blocking more than 1,000 supply chain attacks every week. The team is now over 100 people. Three out of five FAANG companies are Socket customers. So are the companies building the most ambitious AI products: @AnthropicAI, @cursor_ai, @xai, @figma, @vercel, @Replit, @scale_AI, @GustoHQ, @Mercadolibre, and @cribl_io, alongside Fortune 100s in financial services and global media. What we've shipped since the last round: • Socket Firewall blocks malicious packages at install time, before they reach a developer's laptop or CI pipeline. Free for everyone. • Reachability analysis via our acquisition of Coana, eliminating 50-80% of irrelevant vulnerability alerts by focusing only on CVEs that are actually exploitable. • Socket Certified Patches for remediating exploitable CVEs in seconds without waiting on upstream maintainers. • Coverage extending to browser extensions, editor extensions, MCP servers, and AI tools via our acquisition of @secureannex. When the Axios compromise hit, our detection systems flagged the malicious dependency within six minutes. Within 24 hours, more than 2,000 organizations onboarded to Socket to block it. Where the funding goes: deeper investment in Firewall, massively expanding Certified Patches, moving protection closer to every point of install across the developer toolchain, and new product launches pushing Socket into a category we haven't entered before. We're hiring across engineering, sales, customer success, and threat intel. ❤️ Thank you to our customers, investors, and the open-source community for your support. Together, we’re making software safer for everyone.

English
0
1
3
864
Annex Security (acq by Socket) retweetledi
@levelsio
@levelsio@levelsio·
Chrome extensions are so incredibly unsafe Malware criminals find popular ones, pay the owners of the extension lots of money, they add malware to the code and millions of people get infected Then they take your cookies, localStorage, anything they can access Which is why in locked down advanced security devices you can't even install Chrome extensions I mostly run uBlock Origin, but have some others that I'll just vibecode now to stay safe
English
99
96
1.5K
241.8K
Annex Security (acq by Socket) retweetledi
Wes Bos
Wes Bos@wesbos·
HEADS UP. Popular JSON formatter extension has started injecting geolocation tracking and donation UI into websites Reddit thread seems to think they are also swapping tracking IDs for affiliates (a-la honey) Uninstall and switch to another one
Wes Bos tweet mediaWes Bos tweet media
English
97
223
1.8K
324.6K
Annex Security (acq by Socket) retweetledi
Cole Tenold
Cole Tenold@coletenold·
@wesbos "Mom, how did we get so rich?" "Your dad created an open source chrome extension then rug pulled everyone and injected malicious code, sold everyone's data and received affiliate money for every purchase they made online"
Cole Tenold tweet media
English
0
2
36
1.4K
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
A Chrome extension with 7,000 users and a Google Featured badge was recently sold, weaponized, and pushed a malicious update to that executed code through a hidden pixel. Here's how it worked 👇
tuckner tweet media
English
5
81
358
37.8K
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
🧨 New CrashFix techniques found in browser extensions. "Pixel Shield" — a fully functional ad blocker (4.7 stars, 561 users) because it is a uBlock Origin clone. Hidden inside: a "Promise Bomb" that creates 10 MILLION unresolvable promises to crash your browser on command.
tuckner tweet media
English
1
18
95
13.2K
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
This report contains 287 browser extensions tracking 37 million+ users. These were identified using methodology of sandboxing extensions, automatically browsing to URLs, and measuring a data ratio transferred. Real companies, fake services, well established, it's a mixed bag.
tuckner tweet media
English
2
36
183
50.1K
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
The next supply chain worm has been seeded in Open VSX. A cloned Angular extension with 5000 downloads has been available for two weeks and was updated with malware 6 days ago. This multi stage attack uses etherhiding, gcal c2, rust implants, and more. annex.security/blog/worms-lur…
English
2
9
49
10.3K
Annex Security (acq by Socket)
Annex Security (acq by Socket)@secureannex·
RT @tuckner: Great work by the Obsidian Security team exfiltrating ChatGPT API keys to Telegram. I heard there's more to come! https://t.c…
English
0
1
0
139
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
A browser extension with over a million users is poaching the prompts of leading AI chat tools. SimilarWeb loads obfuscated remote configuration to collect the prompts, responses and metadata of your conversations. Your private thoughts are analytics companies gain. secureannex.com/blog/prompt-po…
English
0
5
23
6K
Annex Security (acq by Socket) retweetledi
Trust Wallet
Trust Wallet@TrustWallet·
We’ve identified a security incident affecting Trust Wallet Browser Extension version 2.68 only. Users with Browser Extension 2.68 should disable and upgrade to 2.69. Please refer to the official Chrome Webstore link here: chrome.google.com/webstore/detai… Please note: Mobile-only users and all other browser extension versions are not impacted. We understand how concerning this is and our team is actively working on the issue. We’ll keep sharing updates as soon as possible.
English
808
882
3K
2.9M
Annex Security (acq by Socket) retweetledi
Florian Roth ⚡️
Florian Roth ⚡️@cyb3rops·
Glassworm's resurgence | by @secureannex @tuckner "we've identified and tracked an unprecedented 23 extensions which copy other popular extensions, update after publishing with malware, manipulate download counts, and use KNOWN attack signatures which have been in use for months" secureannex.com/blog/glassworm…
English
1
6
41
6.2K
Annex Security (acq by Socket) retweetledi
tuckner
tuckner@tuckner·
Glassworm returned in a big way during the holiday. We're tracking 23 code extensions across the VS Marketplace and Open VSX which copy popular extensions, evade filters, manipulate their download counts, and then update with sinister malware. secureannex.com/blog/glassworm…
English
0
8
18
2.3K