A large-scale cybercrime conspiracy known as ShadowCaptcha was made public by cybersecurity researchers at Israel’s National Digital Agency. This campaign exploits the ClickFix technique, deploying deceptive CAPTCHA interfaces mimicking legitimate services like Cloudflare or Google to manipulate users into running malicious commands. The operation, traced through compromised WordPress websites, represents a sophisticated blend of social […]
A whistleblower disclosure filed today alleges that the Department of Government Efficiency (DOGE) within the Social Security Administration (SSA) covertly created a live copy of the nation’s entire Social Security dataset in an unsecured cloud environment.
Chief Data Officer Charles Borges warned that, if malicious actors gain access, over 300 million Americans could face identity theft, loss of critical benefits, and the monumental task of re-issuing every Social Security number.
Key Takeaways 1. DOGE copied 300M SSNs into an unsecured AWS cloud. 2. An automated ETL pipeline synced live SSN data despite a court order. 3. The lapse risks mass identity theft and demands zero-trust security.
Allegations of Unsecured Cloud Storage
According to the protected disclosure submitted to the U.S. Office of Special Counsel, DOGE officials bypassed standard Information Security and Compliance (ISC) controls, including encryption-at-rest, role-based access control (RBAC), and continuous audit logging, when provisioning a cloud instance containing live Social Security Number (SSN) records.
Borges notes that neither independent vulnerability assessments nor penetration tests were conducted before spinning up the Amazon Web Services (AWS) S3 bucket storing PII, nor were strict Identity and Access Management (IAM) policies enforced.
The cloud environment lacked multi-factor authentication (MFA) on API endpoints and did not employ a secure key management service (KMS), rendering the SSN repository vulnerable to credential stuffing or API key leakage.
Court records show that a lawsuit filed in March 2025 resulted in a temporary restraining order preventing DOGE from accessing production SSN systems until June 6, 2025.
However, internal logs reviewed by Borges indicate that DOGE engineers continued to synchronize data via an automated ETL pipeline—using Python scripts and the SSA’s internal RESTful APIs, effectively cloning the live database outside SSA’s Security Operations Center (SOC).
Borges claims that DOGE’s actions constitute serious mismanagement and abuse of authority by bypassing the SSA’s Change Management Board (CMB) and violating federal Cloud Security advice (NIST SP 800-144).
“This operation not only breaches the Privacy Act but also exposes the public to a significant cyber-attack surface,” Borges wrote in his internal memo.
One SSA executive reportedly acknowledged the risk, stating that the agency might need to re-issue SSNs en masse should the data be compromised.
Andrea Meza, counsel for the whistleblower, urged Congress and the Office of Special Counsel to launch immediate oversight.
She emphasized that mitigation measures such as enforcing zero-trust architecture, rotating access keys, and deploying real-time intrusion detection systems (IDS) must be implemented without delay to protect Americans’ most sensitive identifiers.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
A widespread data theft campaign has allowed hackers to breach sales automation platform Salesloft to steal OAuth and refresh tokens associated with the Drift artificial intelligence (AI) chat agent.
The activity, assessed to be opportunistic in nature, has been attributed to a threat actor tracked by Google Threat Intelligence Group and Mandiant, tracked as UNC6395.
“Beginning as early as
Cybersecurity researchers have discovered five distinct activity clusters linked to a persistent threat actor known as Blind Eagle between May 2024 and July 2025.
These attacks, observed by Recorded Future Insikt Group, targeted various victims, but primarily within the Colombian government across local, municipal, and federal levels. The threat intelligence firm is tracking the activity under
A newly identified ransomware strain named Cephalus has emerged as a sophisticated threat, targeting organizations through compromised Remote Desktop Protocol (RDP) connections.
The malware, which takes its name from Greek mythology referencing the son of Hermes who tragically killed his wife with an infallible javelin, represents a concerning evolution in ransomware deployment techniques.
Cephalus distinguishes itself from other ransomware families through its unique infection methodology and sophisticated evasion tactics.
The malware operators gain initial access to target networks by exploiting RDP credentials that lack multi-factor authentication (MFA), a vulnerability that continues to plague organizations worldwide.
Once inside the network, attackers utilize the MEGA cloud storage platform for data exfiltration before deploying the ransomware payload.
Process lineage showing use of MEGA (Source – Huntress)
The ransomware deployment mechanism involves a particularly clever approach using DLL sideloading through legitimate security software components.
Huntress analysts identified this technique during investigations of two separate incidents occurring on August 13 and August 16, 2025, where the malware successfully infiltrated organizations running legitimate SentinelOne security products.
DLL Sideloading and Execution Chain
The most technically intriguing aspect of Cephalus lies in its deployment strategy, which exploits a legitimate SentinelOne executable file called SentinelBrowserNativeHost.exe.
The ransomware operators place this legitimate binary in the user’s Downloads folder, from where it loads a malicious DLL named SentinelAgentCore.dll.
This DLL subsequently loads a file called data.bin containing the actual ransomware code, creating a multi-stage execution chain that helps evade detection.
Upon successful execution, Cephalus immediately begins system recovery prevention by running embedded commands.
The first command executed is vssadmin delete shadows /all /quiet, which eliminates volume shadow copies that could be used for file recovery.
The malware then systematically disables Windows Defender through a series of PowerShell commands that create exclusions for critical system processes and file extensions including .cache, .tmp, .dat, and .sss files.
The ransomware further modifies Windows Registry entries to disable real-time protection, behavior monitoring, and on-access protection features.
It stops and disables Windows Defender services including SecurityHealthService, Sense, WinDefend, and WdNisSvc through PowerShell commands executed with hidden window styles and bypassed execution policies.
Cephalus ransom note posted publicly on Twitter (Source – Huntress)
Cephalus ransom notes contain a unique characteristic – they reference news articles about previous successful attacks, attempting to establish credibility and create urgency for victims.
The malware encrypts files with the .sss extension and creates recover.txt files containing payment instructions.
Organizations can protect themselves by implementing MFA for RDP access, monitoring for unauthorized use of legitimate security tool executables in unusual locations, and maintaining comprehensive endpoint detection capabilities.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
A critical vulnerability in IPFire 2.29’s web-based firewall interface (firewall.cgi) allows authenticated administrators to inject persistent JavaScript code, leading to session hijacking, unauthorized actions, or internal network pivoting. Tracked as CVE-2025-50975, this stored cross-site scripting (XSS) flaw poses significant risk in environments where multiple administrators share firewall management duties. Details of the Flaw The vulnerability […]
The Cybersecurity and Infrastructure Security Agency (CISA) released three Industrial Control Systems (ICS) advisories on August 26, 2025, detailing nine critical vulnerabilities in INVT VT-Designer and HMITool (CVSS v4 8.5). Multiple flaws in Schneider Electric Modicon M340 controllers (CVSS v4 scores up to 9.1), and several issues in Danfoss AK-SM 8xxA Series drives (CVSS v3.1 […]
A newly documented cache deception attack leverages mismatches in path normalization and delimiter handling between caching layers and origin servers to expose sensitive endpoints and steal authentication tokens. Researchers have demonstrated how subtle discrepancies in URL processing can trick a content delivery network (CDN) into caching protected resources—only for an attacker to retrieve them later, […]
The Government Accountability Project submitted a protected disclosure from Charles Borges—SSA’s Chief Data Officer—to the Office of Special Counsel and congressional oversight committees. Borges reports that since DOGE’s inception in January 2025, its officials have systematically circumvented SSA’s normal review procedures and a March 20, 2025 temporary restraining order forbidding external access to live Social […]
Google has released an emergency security update for Chrome to address a critical use-after-free vulnerability (CVE-2025-9478) in the ANGLE graphics library that could allow attackers to execute arbitrary code on compromised systems.
The vulnerability affects Chrome versions prior to 139.0.7258.154/.155 across Windows, Mac, and Linux platforms.
The security flaw was discovered by Google’s Big Sleep AI-powered vulnerability research team on August 11, 2025, and has been assigned the highest CVSS severity rating.
Key Takeaways 1. Chrome 139.0.7258.154/.155 patches critical ANGLE UAF. 2. Impacts GPU rendering on Windows, Mac & Linux. 3. Update now; use EDR, isolation & CSP to block exploits.
Chrome’s Stable Channel Update, released on August 26, 2025, addresses this critical memory corruption issue through automatic updates rolling out globally.
Critical Chrome ANGLE Vulnerability
The vulnerability resides within Chrome’s ANGLE (Almost Native Graphics Layer Engine) library, which translates OpenGL ES API calls to hardware-specific graphics APIs, including Direct3D, Vulkan, and native OpenGL.
Use-after-free vulnerabilities occur when a program continues to use a memory pointer after the memory has been deallocated, creating opportunities for heap manipulation and memory corruption attacks.
In this specific case, the flaw in ANGLE’s memory management routines could be exploited through maliciously crafted web content that triggers improper memory deallocation sequences.
Successful exploitation would allow attackers to achieve arbitrary code execution with the privileges of the Chrome renderer process, potentially leading to sandbox escape and full system compromise.
The vulnerability is particularly concerning due to ANGLE’s widespread usage across web applications that utilize WebGL rendering, HTML5 Canvas operations, and GPU-accelerated graphics processing.
Attackers could leverage drive-by download attacks, malicious advertisements, or compromised websites to deliver exploit payloads targeting this memory corruption flaw.
Risk Factors
Details
Affected Products
Chrome Desktop (≤ 139.0.7258.153) on Windows, Mac, Linux
Impact
Arbitrary code execution
Exploit Prerequisites
User opens malicious web content with GPU acceleration
CVSS 3.1 Score
9.8 (Critical)
Mitigations
Organizations should prioritize the immediate deployment of Chrome version 139.0.7258.154 or later to mitigate exploitation risks.
The update includes comprehensive patches for the ANGLE library’s memory management functions and enhanced heap protection mechanisms to prevent similar use-after-free conditions.
Security teams should implement application allowlisting, network segmentation, and endpoint detection and response (EDR) solutions to detect potential exploitation attempts.
Additionally, organizations should consider deploying Content Security Policy (CSP) headers and browser isolation technologies to limit the attack surface for web-based exploits targeting this vulnerability class.
Given the critical nature of this flaw and its potential for zero-day exploitation, security professionals should monitor for unusual network traffic patterns, unexpected process spawning, and anomalous memory allocation behaviors that may indicate active exploitation attempts against unpatched Chrome installations.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
.webp)
.webp)