ADMIN.FOUNDATION

  • Microsoft Publishes Guide for Certificate-Based Authentication in Windows Admin Center

    ·

    , ,

    Microsoft has released comprehensive guidance for implementing certificate-based authentication in Windows Admin Center (WAC), providing administrators with enhanced security through smart card integration and Active Directory Certificate Services. This authentication method significantly strengthens access controls by requiring administrators to present valid certificates before accessing the management gateway, effectively adding a strong second authentication factor beyond […]

    The post Microsoft Publishes Guide for Certificate-Based Authentication in Windows Admin Center appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Hackers Exploits IMDS Service to Gain Initial Access to a Cloud Environment

    ·

    , ,

    Threat actors were manipulating the Instance Metadata Service (IMDS), a core component designed to securely furnish compute instances with temporary credentials to infiltrate and navigate cloud infrastructures. 

    By compelling unsuspecting applications to query IMDS endpoints, attackers harvest short-lived tokens, enabling credential theft, lateral movement, and privilege escalation within victim environments.

    Exploit IMDS Service 

    Wiz reports that the Instance Metadata Service operates at the heart of AWS, Azure, and GCP virtual machines, exposing critical data and IAM credentials via HTTP requests to the privileged 169.254.169[.]254 address. 

    While IMDSv2 strengthens security through session-oriented token retrieval, IMDSv1 remains vulnerable to Server-Side Request Forgery (SSRF). 

    Attackers exploit SSRF flaws or misconfigured workloads to proxy IMDS calls, stealing role-based credentials without direct host control.

    By establishing a baseline of legitimate clients, such as AWS SDKs, EC2 agents, and nm-cloud-setup, researchers isolate processes that infrequently access IMDS. 

    Filtering for sensitive metadata paths (for example, /latest/meta-data/iam/security-credentials/ and /computeMetadata/v1/instance/service-accounts/) and prioritizing instances with internet exposure reveals stealthy reconnaissance and exfiltration attempts.

    Two real-world findings underscore the ability of this tactic. In the first, a zero-day SSRF in pandoc (CVE-2025-51591) enabled malicious HTML <iframe> tags to query /latest/meta-data/iam/info, exposing instance roles. 

    Attackers bypassed recommended –raw_html and –sandbox flags, but enforcement of IMDSv2 thwarted their payload by invalidating stateless GET requests. Had IMDSv1 been in use, the exploit would have yielded full credential compromise.

    Prevalence of various processes in cloud environments and their IMDS usage
    Prevalence of various processes in cloud environments and their IMDS usage

    The second discovery involved ClickHouse’s SELECT * FROM url function in an unauthenticated setup.

    By directing URL queries at IMDS, attackers could retrieve metadata tokens. Although this specific incident in a GCP environment failed due to limited privileges, it highlights the cloud-agnostic danger of SSRF-driven IMDS abuse. 

    A misconfigured ClickHouse instance with S3 access could easily precipitate a major breach, Wiz said.

    For defenders, proactive prevention and real-time detection are essential. Enforcing IMDSv2 across all compute instances, limiting network access to metadata endpoints, and applying the principle of least privilege to IAM roles dramatically reduces exposure. 

    Meanwhile, runtime sensors that flag unusual IMDS requests and exfiltration patterns can swiftly identify in-flight attacks.

    Cloud security teams must evolve from signature-based defenses to anomaly hunting tracking, which processes should never query IMDS, and alerting on deviations.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post Hackers Exploits IMDS Service to Gain Initial Access to a Cloud Environment appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New npm Malware Steals Browser Passwords via Steganographic QR Code

    ·

    , ,

    A novel npm package named fezbox has been uncovered by the Socket Threat Research Team as a sophisticated malware delivery mechanism that exfiltrates username and password credentials from browser cookies via an embedded QR code. Published under the npm alias janedu (registration email janedu0216@gmail[.]com), the package masquerades as a harmless JavaScript/TypeScript utility library while quietly […]

    The post New npm Malware Steals Browser Passwords via Steganographic QR Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Lean Teams, Higher Stakes: Why CISOs Must Rethink Incident Remediation

    ·

    Big companies are getting smaller, and their CEOs want everyone to know it. Wells Fargo has cut its workforce by 23% over five years, Bank of America has shed 88,000 employees since 2010, and Verizon’s CEO recently boasted that headcount is “going down all the time.” What was once a sign of corporate distress has become a badge of honor, with executives celebrating lean operations and AI-driven

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service

    ·

    Cybersecurity researchers have disclosed details of a new botnet that customers can rent access to conduct distributed denial-of-service (DDoS) attacks against targets of interest. The ShadowV2 botnet, according to Darktrace, predominantly targets misconfigured Docker containers on Amazon Web Services (AWS) cloud servers to deploy a Go-based malware that turns infected systems into attack nodes

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Zloader Malware Used as Gateway for Ransomware Deployment in Corporate Networks

    ·

    , , ,

    Zloader, a sophisticated Zeus-based modular trojan that first emerged in 2015, has undergone a significant transformation from its original banking-focused purpose to become a dangerous tool for initial access and ransomware deployment in corporate environments. Following an almost two-year hiatus, this malware reemerged in September 2023 with substantial enhancements to its obfuscation techniques, domain generation […]

    The post Zloader Malware Used as Gateway for Ransomware Deployment in Corporate Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • GitHub Enhances NPM’s Security with Strict Authentication, Granular Tokens, and  Trusted Publishing

    ·

    ,

    Recent High-profile supply‐chain attacks have exposed critical weaknesses in package registry security, prompting GitHub to roll out a suite of defenses designed to harden the npm ecosystem. 

    “GitHub Enhances npm’s security with strict authentication, granular tokens, and trusted publishing” marks the latest milestone in defending open source against account takeovers and malicious post-install payloads.

    Account Takeovers and Post-Install Malware

    In mid-September 2025, the npm registry was rocked by the Shai-Hulud attack, a self-replicating worm that leveraged compromised maintainer credentials to inject malicious JavaScript into widely used packages. 

    By embedding post-install scripts that exfiltrated environment variables and API secrets, the worm threatened to create a persistent backdoor across thousands of developer machines. 

    Attackers deployed Indicators of Compromise (IoCs) that included obfuscated PowerShell one-liners and rogue script tags to harvest tokens and credentials. 

    Over 500 infected modules were unpublished within 24 hours, and npm blocked uploads containing the worm’s IoCs.

    This breach underscores how malicious actors exploit weak authentication and overly permissive tokens. Without multi-factor enforcement or scoped tokens, a single stolen classic token can become a foothold for escalating privileges, distributing malware, or pivoting deeper into critical projects.

    Security Measures to Prevent Compromise

    To counter token abuse and prevent future supply-chain compromise, GitHub is introducing three core measures:

    Strict authentication

    All npm publish operations will require enforced two-factor authentication (2FA) using FIDO2/WebAuthn. The legacy Time-based One-Time Password (TOTP) method will be deprecated, eliminating vulnerabilities associated with shared seed values or SMS fallback.

    Granular tokens

    Developers will generate short-lived granular access tokens with scoped permissions for example, read:packages or publish:package-name—and a maximum lifetime of seven days. 

    Classic tokens will be deprecated entirely, removing the risk of unlimited-scope credentials persisting indefinitely.

    Trusted publishing

    Leveraging OpenSSF’s Trusted Publishers specification, maintainers can bind package publication to established identity providers via OIDC. 

    This eliminates the need to embed API tokens in CI/CD pipelines, reducing exposure during build processes.

    Additional measures include disabling token bypass for local publishing, expanding the roster of supported identity providers, and publishing migration guides to integrate these changes seamlessly. 

    GitHub plans a phased rollout with configurable enforcement windows, allowing organizations to adapt CI workflows and update automation scripts without disruption.

    As the open source ecosystem scales, security remains a collective responsibility. By adopting FIDO2-based 2FA, migrating to granular tokens, and embracing trusted publishing, npm maintainers can greatly reduce the attack surface for supply-chain threats. 

    These enhancements not only protect individual projects but also reinforce the integrity of the software industry’s foundational infrastructure.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post GitHub Enhances NPM’s Security with Strict Authentication, Granular Tokens, and  Trusted Publishing appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Beware of Fake Online Speedtest Apps with Hidden JavaScript Code

    ·

    , ,

    These fake online speedtest applications prey on users seeking to measure their internet performance, yet they harbor hidden payloads that compromise system integrity and privacy. Much like the previously analyzed Fake Manual Reader and Finder software, these imposters leverage packers, obfuscated JavaScript, and persistence mechanisms to execute arbitrary code and exfiltrate sensitive data. On September […]

    The post Beware of Fake Online Speedtest Apps with Hidden JavaScript Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation

    ·

    , , ,

    A critical vulnerability in SolarWinds Web Help Desk (WHD) could allow attackers to escalate privileges and execute arbitrary code on affected systems. SolarWinds has released Web Help Desk 12.8.7 Hotfix 1 to address CVE-2025-26399, a deserialization flaw in the AjaxProxy component. Administrators are urged to install the hotfix immediately to prevent exploitation and protect management […]

    The post SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • EV Charging Provider Confirm Data Breach – Customers Personal Data Exposed

    ·

    , ,

    Digital Charging Solutions GmbH (DCS), a leading provider of white-label charging services for automotive OEMs and fleet operators, has confirmed a data breach affecting a limited number of its customers. 

    DCS disclosed that unauthorized access to personal data occurred in the course of its customer-support processes. The incident was detected through irregularities in log data and immediately triggered an extensive forensic analysis.

    On September 19, 2025, DCS detected anomalies in system logs indicating that a third-party service provider had accessed DCS customer records without valid authorization. 

    Customers’ Personal Data Exposed

    This service provider, authorized for customer support operations, is contractually permitted to view limited customer data but is bound by strict data privacy protocols. 

    Initial forensic analysis revealed isolated cases where names and email addresses were accessed outside the intended support portal. 

    Data Breach Notification
    Data Breach Notification

    No complete payment data or financial transaction records were stored in these systems, as DCS employs tokenization and point-to-point encryption to segregate billing data from support databases.

    Extensive IT-forensic analysis, spearheaded by external cybersecurity experts, is underway. Investigators have preserved volatile memory snapshots and conducted full disk imaging of affected endpoints to trace the intrusion vectors. 

    Preliminary root-cause analysis suggests insider misuse rather than an external exploit, though log-correlation across security information and event management (SIEM) systems is ongoing to rule out lateral movement or privileged escalation. 

    Evidence of unauthorized API calls and atypical SSH sessions to the customer-support database was recorded, prompting immediate revocation of all service-provider credentials.

    Mitigation

    DCS has implemented multiple mitigation measures, including forced rotation of access tokens, implementation of multi-factor authentication (MFA) for all third-party users, and enhanced database auditing via Structured Query Language (SQL) anomaly detection rules. 

    The company has also integrated a Security Orchestration, Automation, and Response (SOAR) platform to automate threat-hunt playbooks and streamline incident-response workflows. 

    All affected customers in the single-digit range received direct notifications in compliance with GDPR Article 33, and the relevant Data Protection Authority has been informed.

    Customers can continue to charge their EVs without disruption. Billing processes remain fully operational, as the invoicing subsystem is isolated behind a dedicated payment gateway employing Transport Layer Security (TLS) 1.3 encryption. 

    DCS has recommended that users remain vigilant, update passwords where reused across services, and report any suspicious communications.

    The breach underscores the importance of zero-trust architecture and continuous monitoring of third-party risk in the electromobility sector.

    Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.

    The post EV Charging Provider Confirm Data Breach – Customers Personal Data Exposed appeared first on Cyber Security News.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶