Tulin

[Anish Moonka @anishmoonka]

A tiny piece of code called axios runs inside almost every app on your phone and every website you visit. Developers download it 100 million times a week. A few hours ago, someone poisoned it with malware that hands an attacker full control of your computer.

If you’ve never heard of axios, that’s normal. It does one boring but important job: it lets apps talk to the internet. When a website pulls up your feed or an online checkout processes your card, axios is probably doing the work underneath. Over 173,000 other code packages plug into it. It’s everywhere.

The attacker stole a lead developer’s login for npm (think of it as an app store, but for code that programmers use to build software). Once inside, they swapped the developer’s email to an anonymous ProtonMail account and uploaded the poisoned version by hand. That jumped past every security check the project normally runs before new code goes live.

And this was not some rushed job. The attacker staged the malware at least 18 hours before pulling the trigger. They built separate versions for Windows, Mac, and Linux. They poisoned both the current version and an older one within 39 minutes of each other, casting the widest net possible. Once the malware ran on a machine, it deleted itself to cover its tracks.

The trick was smart. They never touched a single line of code inside axios itself. Instead, they tucked in a fake add-on called plain-crypto-js, built to pass as a well-known, trusted library. It copied the real library’s description and author info, so nothing looked off at a glance. When a developer installed axios, this fake package quietly ran the malware on its own.

When a smaller package called ua-parser-js got hijacked back in 2021 with about 8 million weekly downloads, the security world treated it like a four-alarm fire. Axios has 100 million. Over 12x the exposure, with 173,000+ packages depending on it.

Socket, the security firm that flagged this, caught it in about 6 minutes. That’s fast. But 6 minutes is still plenty of time for automated systems at companies everywhere to pull and install the bad version before anyone can react.

If you or your team runs axios: lock your version to 1.14.0 (or 0.30.3 for the older branch). Change every password, API key, and access token on any machine that installed the compromised update. And check your network logs for connections to sfrclak dot com or the IP address 142.11.206.73.

[Rachel Tobac @RachelTobac]

LinkedIn is now using everyone's content to train their AI tool -- they just auto opted everyone in.
I recommend opting out now (AND that orgs put an end to auto opt-in, it's not cool)
Opt out steps: Settings and Privacy > Data Privacy > Data for Generative AI Improvement (OFF)

[Germán Fernández @1ZRR4H]

🚩 This is worrying and continues to increase, multiple threat actors, including ransomware operators and initial access brokers, are abusing the @GoogleAds service, but at a higher level. Attackers manage to show the original domain (URL) in the malicious ads, which is eventually displayed to thousands of potential victims on Google's main results page.

Three recent examples, thanks to Intel from Colin Cowie (Sophos) and Jérôme Segura (Malwarebytes) 👏

1.- #Pikabot (I think this is new 👀)
▪ https://t.co/lfQGVaYU3T
▪ https://t.co/9rbnbeqLbP

2.- #BatLoader
▪ https://t.co/N5fmR7HOaw

3.- #FakeBat + Hunting Panel:
▪ https://t.co/CU7E0k6uPT

🚨 DON'T TRUST Ads, be cautious, investigate, confirm.

[Bell Direct @belldirect]

Morning Bell: #ASX200 set to open 0.37% higher on the back of the global rally overnight. Monthly CPI indicator data set to be released today. Trading Ideas: $BGA & $DEG. #trading #stocks #investing
https://t.co/1M0s8GkHCD

[Bell Direct @belldirect]

Economic News: The @RBAInfo has raised the cash rate by 25 basis points, taking it to 4.10%, the highest rate in 11 years.
#cashrate #interestrates #ausecon #rba

[Tulin @2lin]

Thank you @thereseraft for putting together another great piece for The Australian Financial Review. It's always a pleasure working with you on some great topical pieces.

As cyber attacks make headlines everyday it's important to…https://t.co/mjnPfyx3Xv https://t.co/zdmv4R9tY4

[Tulin @2lin]

I am inviting all fellow Aussie security professionals and advisors to join us for an exclusive Cybersecurity Advisors Network (CyAN) Australian Wine and Nibbles gathering at the ASX building in Sydney on Thu, 15 Jun 2023 5:30 PM -…https://t.co/zsGhRdBp6O https://t.co/wr0DuhEiak

[Tulin @2lin]

I was invited back to Macquarie University to be part of a panel discussion for students studying cyber security. It was so great seeing all these students enthusiastic to get into cyber and into the work force. The students had some great questions, well…https://t.co/0egXMlhY4t

[Tulin @2lin]

In light of Privacy Awareness Week in Australia, we have recently released our eighth annual survey to assess current perspectives on cyber risk.

Our recent survey findings indicate that companies may be getting complacent with their cyber risk manageme…https://t.co/Bb3pQJ9t6t

[Tulin @2lin]

“We entrust our most sensitive personal and business information to apps. In so doing, such information is shared by entities who create these toolsets under various jurisdictions. The trust element needs to be verified and confirmed by independent and va…https://t.co/pDqVE8SLuJ

[Tulin @2lin]

@troyhunt 😂🙃

[Tulin @2lin]

Had the pleasure of attending the Leaders Forum this morning covering Cyber Resiliency hosted by LexisNexis Pacific.

The panelists answered some challenging and critical questions relating to data management, business continuity, ransomware attacks, boa…https://t.co/igSPc1j0nL

[Tulin @2lin]

It was great attending the Australian Prudential Regulation Authority legal conference, and listening to Shannon Sedgwick share his experience and knowledge around what legal counsel and boards should consider during a data breach.

#apra #databreach #min…https://t.co/iV0j0Wb2VQ

[Tulin @2lin]

@iamkarissabreen Wow lol 😆

[Tulin @2lin]

I am delighted to announce that I have joined the talented team at MinterEllison as a Director in Consulting.

I am excited to be working together with Shannon Sedgwick leading up the national cyber security consulting practice. I'm looking forward to wor…https://t.co/90xhxMgZLz

[Tulin @2lin]

I had the absolute pleasure of sitting down with Lachlan Corne from https://t.co/eaiPgusGzi to discuss my career path to cybersecurity. The podcast Destination Cyber is an excellent initiative for students but also professionals in other industries to get…https://t.co/HNkg9pYzIC

[Tulin @2lin]

Great to see that Lenka Bradovkova, Victor Dominello MP, and the team are working on this great initiative of the Digital Identity and Verifiable Credentials (DIVC) program at the NSW Government.

It's fantastic to read through thi…https://t.co/koLVUR2cKB https://t.co/SbVaENzKU1

[Tulin @2lin]

I had the pleasure of being interviewed by Network Ten for @theprojecttv in Australia, covering the topic of burnout and stress in cyber security. Kevin & I shared some of our stories, check it out: https://t.co/CU8ECzksOm

[Tulin @2lin]

I had a great opportunity to speak with @thereseraft for her piece on Fourth-party verification is the next phase for cyber resilience for The Australian Financial Review.

Released this morning, we discuss the importance of third…https://t.co/ub0XfWKk6S https://t.co/HwvrVAZ7kC

[Tulin @2lin]

Here's a little snippet of some of my thoughts on personalisation on https://t.co/Khmis6RKaH

#2Fa #personalisation #cybersecurity https://t.co/9gFRdIaJIf