ac@t:~#

Scio me nihil scire. #ThreatIntel/#CTI now; was #IncidentResponse/#IR. Humanities (AB Φ, Comm) grad, ex-seminarian (λόγος). Impostor Syndrome ∞. Opinions∴mine.

[Ryan Naraine @ryanaraine]

NEW POD UP!! Microsoft threatens legal action against researchers who drop zero-days. We debate whether it’s a fair line against extortion, or amateur-hour PR from a company that already torched its own research community? Costin plays reluctant defender, JAGS says the damage was done years ago, and Ryan reopens the long history of silent fixes and stolen bounties.

(Presented by @Ent_Security)

Plus, on the 10th anniversary of the Shadow Brokers leak, we discuss some enduring mysteries, theories on attribution, and an interesting trail that leads to Edward Snowden.

@craiu @juanandres_gs @Ent_Security

https://t.co/LTXKDshZ9r

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has uncovered a supply chain attack involving malicious npm packages registered under organizational scopes that mirror real internal corporate namespaces, employing dependency confusion technique to deploy a reconnaissance payload. https://t.co/z2GjRIAyYS

A threat actor operating under three maintainer aliases, mr.4nd3r50n, ce-rwb, and t-in-one, published malicious packages that impersonate internal corporate packages, with several spoofing internal enterprise infrastructure URLs in their package.json to appear legitimate.

Once installed, the packages download and execute an obfuscated payload from an attacker-controlled command-and-control (C2) server to collect system information, hostnames, environment variables, and developer context. Read the blog for in-depth analysis and mitigation, detection, and hunting details.

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Yann LeCun @ylecun]

Dario is wrong.
He knows absolutely nothing about the effects of technological revolutions on the labor market.
Don't listen to him, Sam, Yoshua, Geoff, or me on this topic.
Listen to economists who have spent their career studying this, like @Ph_Aghion , @erikbryn , @DAcemogluMIT , @amcafee , @davidautor

[Steven Lim @0x534c]

🔥🤖 M365 Connector for Claude – Why SecOps Must Care

Monitoring the M365 Connector for Claude is critical because when ResultType=0, it means an Entra Global Admin has granted permissions, enabling Claude to directly access SharePoint, OneDrive, Outlook, and Teams—a governance decision with major security implications that SecOps must track closely. Meanwhile, ResultType=90095 shows end users attempting to use the connector without the admin grant, signaling demand, shadow IT risk, and adoption pressure. By watching both signals, defenders gain visibility into where governance decisions meet user behavior, ensuring connector risks are managed before they escalate.

KQL Code:
https://t.co/NGuwSLgvKF

#Cybersecurity #M365ConnectorClaude #Entra #Governance

[Matt Johansen @mattjay]

Meta is joining the war against encryption - and funding the war for age verification.

[Jonny Johnson @JonnyJohnson_]

🚨NEW PODCAST ALERT🚨

@_JohnHammond and I are excited to announce our new podcast called - The Payload Podcast.

Tune in Thursday @ 10am EST for our first episode. Announcing our first guest tomorrow😎

This podcast is going to be different than others, where every episode is ALSO going to be a livestream. This allows us and our guests to show demos, dive into code, etc a lot easier. Of course we will upload them on all the major platforms post-stream as well!

[Florian Roth ⚡️ @cyb3rops]

For convenience: I wrote a small collector that pulls all SHA-256, SHA-1 and MD5 hashes from Notepad++ releases and compiles them into big CSV + JSON files

Use it to check if any Notepad++ installs in your org match known-good release hashes - and spot weird/malicious outliers

https://t.co/W2pYbfYemz

[ac@t:~# @iAngelus]

https://t.co/GOGp2FJYoI

[ac@t:~# @iAngelus]

Somewhat similar absurd behavior with Standard Chartered Bank (SCB). Their banking app won't work when it's run on Samsung's Secure Folder nor even on Google Pixel's Private Space. When the app is launched, it redirects you to their website with this message.

[CR1337 @CR1337]

HSBC blocks its app due to F-Droid-installed Bitwarden

[Peter Girnus 🦅 @gothburz]

My CISO called me at 3 AM last Tuesday.

"We caught someone."

I asked, "Caught them doing what?"

He said, "Typing."

Let me explain.

We have an employee in IT. Great worker. Always online. Never complained. Perfect Slack etiquette.

One problem.

His keystrokes were arriving 110 milliseconds late.

One hundred and ten milliseconds.

That's 0.11 seconds.

The average American remote worker has 20-40ms of latency.

This guy? 110ms. Every. Single. Keystroke.

My security team ran the numbers.

That latency doesn't come from a bad router in Ohio.

That latency comes from Pyongyang.

Our "Senior DevOps Engineer" was a North Korean operative.

Running his work laptop through a laptop farm.

In America.

While he worked from a government building.

In North Korea.

He passed the interview. He passed the background check. He passed the vibe check.

He did not pass the speed of light.

Here's what people don't understand about physics:

Light travels 186,000 miles per second.

But it still has to go through China.

And China adds latency.

Since April, Amazon has caught 1,800 of these attempts.

Eighteen hundred.

I called an emergency meeting with my board.

I said, "We need to implement Keystroke Velocity Auditing across all remote employees."

They said, "That sounds invasive."

I said, "You know what else is invasive? The Democratic People's Republic of Korea in your Jira tickets."

They approved the budget.

We now monitor keystroke timing to the microsecond.

If your latency exceeds 60ms, you get a call from HR.

If it exceeds 100ms, you get a call from the FBI.

We've already flagged 47 employees.

Turns out 44 of them just have bad Wi-Fi.

3 of them are "still under investigation."

The lesson?

You can fake a resume.

You can fake a background check.

You can fake an American accent on Zoom.

But you cannot fake the speed of light.

Physics is the ultimate background check.

Hire accordingly.

[Ryan Naraine @ryanaraine]

On the pod, Costin poses a simple question to Anthropic: @craiu @juanandres_gs

[The Citizen Lab @citizenlab]

How do authoritarian surveillance mechanisms affect those targeted, and how should societies respond?

On Nov 12, Citizen Lab senior researcher @jsrailton will be at #BerlinFreedomWeek to share his expertise in the panel discussion titled “From Stasi to Spyware: Old Tactics, New Technology.”

Learn more: https://t.co/tdXmFjot7a

[Brave @brave]

The security vulnerability we found in Perplexity’s Comet browser this summer is not an isolated issue.

Indirect prompt injections are a systemic problem facing Comet and other AI-powered browsers.

Today we’re publishing details on more security vulnerabilities we uncovered.

[vxdb @vxdb]

Goodbye privacy

[Dave W Plummer @davepl1968]

The story of FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8.

If you're not the type to pay for your software, you probably know this key. What you might not know is that I worked on the first version of Windows Product Activation, and this was our first major "hack".

And yet, it wasn't a 'hack' at all - it was a disastrous leak.

The FCKGW key was a valid volume licensing key, so all you needed was special volume media to go with it. Eventually, they were bundled and put online by pirates.

WPA worked by generating a hardware ID from your CPU, RAM, and other components, then sending it to Microsoft alongside your product key for validation. A mismatched or suspicious key would flag the install as pirated.

But as a legitimate VLK, FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8 was whitelisted in XP's activation logic—it told the system, "This is corporate volume licensing; no need to phone home." During installation, users selected the "Yes, I have a product key" option, entered the code, and WPA simply... skipped the activation prompt.

The OS booted fully functional, with no 30-day timer or watermarks. It even fooled early validation checks for updates. This loophole let pirates distribute "pre-activated" ISOs, making XP as easy to "acquire" as a free mixtape. Technically, you could still use it today on an old XP disc (if you can find one), but Microsoft's servers shut down validation years ago, and the key's long since been blacklisted.

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Donncha Ó Cearbhaill @DonnchaC]

🚨 BREAKING: New zero-click exploit used to hack WhatsApp users.

WhatsApp has just sent out a round of threat notifications to individuals they believe where targeted by an advanced spyware campaign in past 90 days.

Seek out expert help if you have received this alert

[Nasreddine Bencherchali @nas_bench]

[New Blog 📚] The Ghost in the Logs: DFIR Through a Palimpsest Lens

In this latest blog, I try to link the literary and historical concept "palimpsest" into the DFIR world.

“Forensic echoes” linger for those who are quite enough to listen.

Read More - https://t.co/yDyl8AgSxo