A recent credential phishing campaign detected by Microsoft Threat Intelligence used AI-generated code within an SVG file to disguise malicious behavior. While the novel obfuscation techniques showcased attacker ingenuity, AI-powered defenses successfully blocked the attack—underscoring that AI-augmented threats remain detectable when defenders adapt analytic strategies. On August 18, Microsoft Threat Intelligence identified a targeted phishing […]
The latest Gcore Radar report analyzing attack data from Q1–Q2 2025, reveals a 41% year-on-year increase in total attack volume. The largest attack peaked at 2.2 Tbps, surpassing the 2 Tbps record in late 2024. Attacks are growing not only in scale but in sophistication, with longer durations, multi-layered strategies, and a shift in target industries. Technology now overtakes gaming as the most
A fresh wave of domain-confusion phishing emails is sweeping through the Python community, once again setting its sights on PyPI maintainers. As malicious actors continually swap out domain names, PyPI users must remain vigilant and adopt stronger safeguards to protect their accounts. In this latest iteration, maintainers receive an unsolicited email urging them to “verify […]
A critical vulnerability in NVIDIA’s Merlin Transformers4Rec library (CVE-2025-23298) enables unauthenticated attackers to achieve remote code execution (RCE) with root privileges via unsafe deserialization in the model checkpoint loader.
The discovery underscores the persistent security risks inherent in ML/AI frameworks’ reliance on Python’s pickle serialization.
NVIDIA Merlin Vulnerability
Trend Micro’s Zero Day Initiative (ZDI) stated that the vulnerability resides in the load_model_trainer_states_from_checkpoint function, which uses PyTorch’s torch.load() without safety parameters. Under the hood, torch.load() leverages Python’s pickle module, allowing arbitrary object deserialization.
Attackers can embed malicious code in a crafted checkpoint file—triggering execution when untrusted pickle data is loaded. In the vulnerable implementation, cloudpickle loads the model class directly:
This approach grants attackers full control of the deserialization process. By defining a custom __reduce__ method, a malicious checkpoint can execute arbitrary system commands upon loading, e.g., calling os.system() to fetch and execute a remote script.
The attack surface is vast: ML practitioners routinely share pre-trained checkpoints via public repositories or cloud storage. Production ML pipelines often run with elevated privileges, meaning a successful exploit not only compromises the model host but can also escalate to root-level access.
To demonstrate the flaw, researchers crafted a malicious checkpoint:
Loading this checkpoint via the vulnerable function triggers the embedded shell command prior to any model weight restoration—resulting in immediate RCE under the context of the ML service.
NVIDIA addressed the issue in PR #802 by replacing raw pickle calls with a custom load() function that whitelists approved classes.
The patched loader in serialization.py enforces input validation, and developers are encouraged to use weights_only=True in torch.load() to avoid untrusted object deserialization.
Patch adding a custom load function
Developers must never use pickle on untrusted data and should restrict deserialization to known, safe classes.
Alternative formats—such as Safetensors or ONNX—offer safer model persistence. Organizations should enforce cryptographic signing of model files, sandbox deserialization processes, and include ML pipelines in regular security audits.
Risk Factors
Details
Affected Products
NVIDIA Merlin Transformers4Rec ≤ v1.5.0
Impact
Remote code execution as root
Exploit Prerequisites
Attacker-supplied model checkpoint loaded via torch.load()
CVSS 3.1 Score
9.8 (Critical)
The broader community must advocate for security-first design principles and deprecate pickle-based mechanisms altogether.
Until pickle reliance is eliminated, similar vulnerabilities will persist. Vigilance, robust input validation, and a zero-trust mindset remain crucial to safeguarding production ML systems against supply-chain and RCE threats.
Threat actors from the Lone None group are exploiting copyright takedown notices to distribute sophisticated malware, including Pure Logs Stealer and a newly identified information stealer dubbed Lone None Stealer (also known as PXA Stealer). This analysis examines the campaign’s tactics, techniques, and procedures (TTPs), highlights key indicators of compromise (IOCs), and underscores how Lone […]
Security researchers at Hacker House have released SetupHijack, a proof-of-concept tool that exploits race conditions and insecure file handling in Windows installers and updaters. The utility demonstrates how attackers can hijack privileged setup processes to run malicious payloads with SYSTEM or Administrator rights. Exploiting Race Conditions in Windows Installers SetupHijack targets installers and updaters that […]
Numerous mobile applications have been found to expose critical user information through misconfigured Firebase services, allowing unauthenticated attackers to access databases, storage buckets, Firestore collections, and Remote Config secrets.
This widespread issue first came to light when security researcher Mike Oude Reimer published findings on 16 September 2025, demonstrating that approximately 150 different Firebase endpoints in top-ranked mobile apps were accessible without any authentication.
These exposures ranged from user credentials and private messages to high-privilege API tokens, underscoring a systemic weakness in how developers configure Firebase security rules.
In the weeks following the initial disclosure, ice0 analysts identified a surge in automated scanning tools exploiting this vulnerability, with attackers harvesting millions of records in bulk.
These tools rely on extracting Firebase project IDs from app APK files or known naming conventions, then probing various service endpoints for open permissions.
Although Firebase warns developers that test-mode configurations expire after 30 days, many teams extend these insecure rules or inadvertently leave production environments in test mode.
The result is an expansive attack surface that miscreants can exploit with minimal effort, jeopardizing both enterprise and consumer data.
The impact extends beyond trivial resources such as public images or non-sensitive flags.
At scale, exposed storage buckets have contained millions of user ID photos, cleartext passwords, and even AWS root access tokens.
In one instance, a storage bucket belonging to an app with over 100 million downloads was discovered hosting user ID photos, allowing attackers to compile vast identity databases.
Similarly, misconfigured Realtime Databases revealed private chat logs and geolocation information, while Remote Config endpoints exposed private API keys for third-party services.
ice0 analysts noted that many of these leaks went unreported or were dismissed as non-issues until full datasets were downloaded and inspected.
The following section explores the infection mechanism leveraged by scanning tools to enumerate and exploit Firebase services, focusing on APK extraction, endpoint discovery, and unauthenticated data retrieval.
Infection Mechanism: APK Analysis and Endpoint Enumeration
Scanning tools like OpenFirebase begin by parsing Android Package Kit (APK) files to extract Firebase project IDs, API keys, and Google App IDs from the compiled res/values/strings[.]xml and bundled google-services[.]json.
These identifiers serve as the primary inputs for constructing service URLs. For example, to retrieve a Realtime Database, the scanner issues a simple GET request appending [.]json to the endpoint:
curl - s https[:]//PROJECT_ID-default-rtdb[.]firebaseio[.]com/[.]json
If the response returns HTTP 200 OK and JSON content, the database is flagged as public. In cases where the database resides in a different region, the initial request returns a JSON error containing the correct regional endpoint, which the tool uses to reissue the request.
This two-step lookup ensures comprehensive coverage without brute-forcing every possible domain variation.
For Remote Config, scanners extract both the google_api_key and google_app_id from strings[.]xml before constructing a POST request to the Remote Config API:
curl - s - X POST \
- H "Content-Type: application/json" \
- d '{"appId":"GOOGLE_APP_ID","appInstanceId":"any"}' \
"https[:]//firebaseremoteconfig[.]googleapis[.]com/v1/projects/PROJECT_ID/namespaces/firestore[:]fetch"
A successful 200 OK response containing configuration data or secrets confirms unauthenticated access to Remote Config entries.
Some configurations include the NOTEMPLATE error when no config exists, allowing scanners to differentiate between protected and empty endpoints.
By automating APK decompilation with tools like JADX and iterating through Firestore collection names—either extracted from code references or guessed via wordlists—attackers can enumerate public Firestore instances.
Github token (Source – ice0)
A query to a non-existent collection returns an empty JSON array rather than an authentication error, signaling vulnerability without prior knowledge of collection names.
This infection mechanism, combining APK metadata extraction with targeted API calls, highlights how minimal information disclosure can lead to full data leakage. Organizations relying on
Firebase must enforce strict security rules, audit test-mode expirations, and remove hardcoded keys to prevent these automated attacks.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
Steam has officially confirmed that malware was discovered in the popular indie game BlockBlasters. The announcement follows widespread player reports and security scans that flagged unusual activity in the game’s files. This incident raises concerns about game security and digital storefront safety. Background of the Incident BlockBlasters launched earlier this month and quickly gained attention […]
Cybersecurity researchers have discovered two malicious Rust crates impersonating a legitimate library called fast_log to steal Solana and Ethereum wallet keys from source code.
The crates, named faster_log and async_println, were published by the threat actor under the alias rustguruman and dumbnbased on May 25, 2025, amassing 8,424 downloads in total, according to software supply chain
Attackers have stepped up their tactics by deploying stealthy backdoors disguised as legitimate WordPress components, ensuring persistent administrative access even after other malware is discovered and removed. Their deceptive appearances belied their dangerous functions: one impersonated a plugin, the other camouflaged itself as a core file. Together, they formed a resilient system that gave hackers […]
.webp)
.webp)