Edu Vargas

CEO @LoopStudio_dev | IVLP Alumnus (Cybersecurity) @statedept | VP Markets @CutiUy | Building secure tech | | 🐍

[Cyber Security News @The_Cyber_News]

⚠️ WhatsApp Chat Histories Stored Unencrypted on macOS and iOS

Source: https://t.co/81kaKGR6V6

New research has revealed that WhatsApp chat histories may be stored unencrypted on both macOS and iOS devices, raising fresh concerns about local data protection and cross-application access within the Apple ecosystem.

While WhatsApp uses strong end-to-end encryption (E2EE) to secure messages in transit, this protection does not extend to how data is stored locally once the user accesses it.

The issue affects both iOS devices and macOS systems running WhatsApp, particularly where shared app containers are utilized. On macOS, where file system access is more flexible, the risk may be more pronounced if endpoint security controls are weak.

#cybersecuritynews #WhatsApp

[Dark Web Intelligence @DailyDarkWeb]

🇺🇾 A threat actor is claiming to sell multiple databases allegedly tied to Uruguay’s Ministry of Education and Culture scholarship platform “Butiá,” with references to citizen and family-member records.

According to the underground post,
the claimed exposure includes:
• national ID numbers (Cédula)
• names and surnames
• dates of birth
• gender information
• family relationships
• addresses
• phone numbers
• scholarship-related records
• family circle mappings

What makes this case particularly sensitive is the relational structure of the alleged data.

This is not just individual records —
the actor claims the datasets map entire family relationships tied to scholarship recipients.

That dramatically increases the potential impact because attackers can use relational datasets for:
• identity fraud
• social engineering
• account recovery abuse
• impersonation
• phishing personalization
• government-benefit fraud
• synthetic identity creation

Another important observation:
the threat actor attempts to publicly humiliate the target by claiming the government site was “AI-generated” or poorly developed.

We are increasingly seeing underground actors use:
• mockery
• public shaming
• reputational attacks
• political narratives
alongside monetization attempts.

This reflects how modern cybercrime increasingly overlaps with:
psychological operations,
hacktivism,
and attention-driven underground branding.

The actor also references:
• JSON exports
• SQLite databases
• public release threats
• staged disclosure tactics
• Telegram-channel growth incentives

That last point is important.

Some cybercriminal groups now use leaked government or citizen data not only for profit,
but also as a mechanism to:
• grow underground communities
• build influence
• increase credibility
• attract affiliates
• amplify visibility before larger releases

From a defensive perspective,
education and scholarship systems are often underestimated attack surfaces.

However,
they frequently contain:
• highly sensitive citizen records
• minors’ information
• family relationships
• socioeconomic data
• identity documentation
• payment or benefits workflows

And because these systems are commonly interconnected with:
• government identity services
• citizen registries
• educational portals
• authentication platforms
• financial assistance systems

a compromise can create cascading downstream risks.

Another major issue:
relational citizen datasets have long-term value on underground markets because they enable attackers to build highly accurate identity profiles over time.

Even years after the initial leak,
such data can still fuel:
• fraud operations
• credential attacks
• telecom scams
• targeted phishing
• SIM swap attempts
• banking impersonation

Organizations operating public-sector citizen services should prioritize:
• segmentation of citizen databases
• strict access control policies
• continuous monitoring for exposed backups
• database activity monitoring
• API security reviews
• encryption of sensitive fields
• secure development lifecycle enforcement
• dark web monitoring for leaked government datasets

Most importantly:
citizen-data systems should assume eventual exposure attempts and adopt architectures that minimize the blast radius of any single compromise.

As always,
claims on underground forums should remain considered unverified until independently validated.

However,
incidents involving:
government platforms + citizen identity data + family relationship mapping
should always be treated as high-priority due to their potential long-term societal impact.

🇺🇾 #DDW #Intelligence #CyberSecurity #DarkWeb #DataLeak #Uruguay #GovernmentSecurity #ThreatIntelligence #CyberCrime #OSINT

[VECERT Analyzer @VECERTRadar]

🚨 CYBER INTELLIGENCE ALERT: ALLEGED COMPROMISE OF CIVIL IDENTITY — URUGUAY 🇺🇾

⚠️ HIGH THREAT: ACTOR CLAIMS RELEASE OF 5.8 MILLION DNIC RECORDS

[STATUS: THREAT UNDER INVESTIGATION / UNCONFIRMED / DISPUTED ACTORS / ACTIVELY MONITORING]

The threat actor, fully identified under the alias LaPampaLeaks, has announced the release and download of the complete database of Uruguay's National Directorate of Civil Identification (DNIC). The clandestinely distributed batch allegedly contains more than 5.8 million records of Uruguayan citizens born up to early 2020. According to the manifesto, the data was originally extracted through the abuse and mass scraping of an external institutional API that lacked request rate limits.

🎯 Affected Entity: National Directorate of Civil Identification of Uruguay (DNIC - Ministry of the Interior).

👤 Threat Actor: LaPampaLeaks / PampaLeaks.

📂 Volume and Format: 5.8 million individual records (5.8M).

⚠️ Verification Status: SUSPECTED / UNDER STRICT INVESTIGATION. The incident remains unconfirmed by the authorities. The announcement comes amidst a disinformation campaign, reputational disputes (egos) between local hacktivist groups ("Expresidents" vs. "PampaLeaks"), and coordinated blocking of their communication infrastructure by international law enforcement agencies (Interpol).

📊 ANALYSIS OF ALLEGED RISK FIELDS AND VARIABLES

Despite its unverified status, the described data structure represents an imminent risk of identity fraud at the national level if the data dump is authentic:

🆔 Critical Identity Correlation:

The batch directly exposes the National Identity Card Number (ID Number) uniquely correlated with the citizen's full name.

Spanning 5.8 million entries, the file would contain virtually all valid national identity card numbers of the current Uruguayan civilian population.

🎯 Automation of Government Procedures:

The attacker explicitly states that the leak is designed to allow secondary actors to complete fraudulent procedures on Uruguayan government websites that only require simple validation of the ID number and full name to authorize access or manage citizen services.

🛡️ MITIGATION AND PREVENTIVE TECHNICAL RECOMMENDATIONS

🛑 Blocking and Disabling Exposed Channels: Register and block Telegram addresses, users, and Signal channels linked to the actor at the perimeter of corporate and institutional firewalls to prevent unauthorized communications or the downloading of logical database components.

🔒 Strengthening Government Portals (Agesic / DNIC): Uruguayan state agencies are urgently urged to abandon the exclusive use of the "National Identity Card + Full Name" combination as sufficient to validate a citizen's identity in online procedures, mandating the adoption of strong authentication mechanisms such as the TuID system or physical cryptographic keys.

⚡ MONITORING AND EVALUATION

🌐 Intelligence System: https://t.co/wk9bZJ2Nli

🛡️ Quickly assess your website's security with: https://t.co/YnDw1QjN9c

#CyberSecurity #Uruguay #DNIC #DataLeak #LaPampaLeaks #PampaLeaks #IdentityTheft #ScrapingAPI #TelegramTakedown #ThreatIntelligence #CyberAlert #VECERT #Infosec #UnverifiedBreach

[Eduardo Preve @EPreve]

🏴‍☠️ AHORA - PAMPA LEAKS

✔️La Pampa Leaks acaba de publicar en la dark web otro supuesto hackeo a la Direccion Nacional de Identificación Civil con los nombres completos y la cédula de identidad de 6.385.000 documentos asignados pertenecientes a 5.800.000 personas registradas en Uruguay.

✔️También grabó un video de cómo llegó a los usuarios, por ejemplo, del ex presidente Lacalle Pou, y lo publicó en la dark web.

[U.S. Southern Command @Southcom]

President of Uruguay Yamandú Orsi and Uruguayan government and military leaders observe flight operations on the flight deck of the aircraft carrier USS Nimitz (CVN 68) in the Atlantic Ocean, May 2, 2026.

The Nimitz Carrier Strike Group is deployed as part of #SouthernSeas2026, which seeks to enhance capability, improve interoperability, and strengthen maritime partnerships with countries throughout the region through joint, multinational and interagency exchanges and cooperation. @USNavy @USFleetForces @NAVSOUS4THFLT

[Malwarebytes @Malwarebytes]

Surprise! Chrome silently installs a 4GB AI model you didn’t ask for.

No install prompt. No consent.

If you delete it, Chrome downloads it again.
https://t.co/LmAa3ndL7L

[Cyber Security News @The_Cyber_News]

⚠️ Unauthorized Group Gains Access to Anthropic's Exclusive Cyber Tool Mythos

Source: https://t.co/akzEU9Xvwa

A group of unauthorized users has reportedly breached access controls surrounding Claude Mythos Preview, Anthropic's powerful and closely guarded AI-driven cybersecurity tool, raising serious concerns about third-party vendor security and the risks of placing advanced offensive AI capabilities in the wrong hands.

The model, deployed under Anthropic's Project Glasswing initiative, is capable of discovering zero-day vulnerabilities across major operating systems and web browsers, chaining software bugs into multi-step exploits, a feat previously achievable only by the most skilled human hackers.

#cybersecuritynews #Anthropic

[Cyber Security News @The_Cyber_News]

⚠️ Claude Desktop Reportedly Adds Browser Access Bridge to Multiple Chromium-Based Browsers

Source: https://t.co/JXCu1Na2FV

A recent technical audit by privacy researcher Alexander Hanff has revealed that Anthropic's Claude Desktop application for macOS silently installs a Native Messaging bridge into the directories of several Chromium-based browsers.

This undocumented behavior occurs without user consent, raising significant privacy and security concerns within the cybersecurity community.

When a user installs Claude Desktop (Claude.]app), the application automatically places a Native Messaging manifest file named com.anthropic.claude_browser_extension.json into the application support folders of up to seven Chromium-based browsers, including Chrome, Brave, Edge, Arc, Vivaldi, and Opera.

#cybersecuritynews #claude

[Edu Vargas @imeduvar]

Un gran problema seguir teniando la app de la app de la app. Para iniciar el trámite necesitas https://t.co/MXMdrHHVKd pero para sacar la cita tu app uy y ahora vas a necesitar otra más? Es genial la necesidad de hacer aplicaciones que tienen. Que sea una con todo unificado y segura.

[Edu Vargas @imeduvar]

@PerezComenale Ante de hacer más apps porque no centralizar todo. Además lo de ahora está seguro?? Son aplicaciones con código seguro?

[Cyber Security News @The_Cyber_News]

📌Anthropic Accuses Chinese Firms of Stealing Claude AI Data

Source: https://t.co/61iWsYXy9U

Anthropic today accused three prominent Chinese artificial intelligence companies, DeepSeek, Moonshot AI, and MiniMax, of running coordinated “distillation” campaigns to steal advanced capabilities from its Claude models.

The San Francisco-based lab said the operations involved roughly 24,000 fraudulent accounts and generated more than 16 million exchanges with Claude, in violation of its terms of service and regional access restrictions.

The company said the labs used proxy services and networks of fake accounts dubbed “hydra clusters” to mask their activity and evade detection.

#cybersecuritynews

[Cyber Security News @The_Cyber_News]

🔻 Cybersecurity Companies’ Stocks Fall Sharply as Anthropic Releases Claude Security Tool

Source: https://t.co/uzV0yPmVvS

Shares of major cybersecurity companies nosedived on Friday after AI startup Anthropic unveiled Claude Code Security, a new AI-powered tool capable of autonomously scanning codebases for software vulnerabilities and suggesting targeted patches, sparking fears that artificial intelligence could begin displacing traditional enterprise security solutions.

Anthropic announced Claude Code Security on February 19, 2026, as a new capability built directly into its Claude Code platform on the web, currently available in a limited research preview for Enterprise and Team customers.

#cybersecuritynews

[leo sarro press @leosarro]

“Totalmente en contra de lo que precisamos. Nosotros lo que precisamos es que las empresas apuesten a Uruguay! ” dijo Perea de Cuti, sobre la medida que pide el ministro castillo, que las empresas avisen antes de despedir empleados.

[Cyber Security News @The_Cyber_News]

🔑25 Vulnerabilities in Cloud Password Managers Allow Unauthorized Access and Modifications

Source: https://t.co/Rs3dMe48zf

25 critical vulnerabilities in three leading cloud-based password managers: Bitwarden, LastPass, and Dashlane enable a malicious server to bypass zero-knowledge encryption claims, allowing unauthorized access, modification, and recovery of users' stored passwords and vault data.

Bitwarden, LastPass, and Dashlane collectively serve over 60 million users and hold significant market share. The analysis targets their client-server interactions under a fully malicious server threat model, where servers deviate arbitrarily from protocols.

#cybersecuritynews #passwordmanagers

[Malwarebytes @Malwarebytes]

Cybercriminals stole the sensitive information of 17.5 million Instagram accounts, including usernames, physical addresses, phone numbers, email addresses, and more.

[Cyber Security News @The_Cyber_News]

⚠️ Instagram Data Leak Exposes Sensitive Info of 17.5M Accounts

Source: https://t.co/3vPNLgpwnG

A significant security breach has compromised approximately 17.5 million Instagram user accounts, exposing sensitive personal information that is now circulating on the dark web.

The breach encompasses a wide range of personal information that could put affected users at serious risk. Compromised data includes usernames, email addresses, phone numbers, and physical addresses.

This combination of information makes users particularly vulnerable to identity theft, phishing, and social engineering.

#cybersecuritynews #databreach

[The White House @WhiteHouse]

Nicolas Maduro had his chance — until he didn’t.

The Trump Admin will always defend American citizens against all threats, foreign and domestic. 🇺🇸🦅

[The White House @WhiteHouse]

If you don’t know, now you know 🦅

[Cuti @CutiUy]

¡Cerramos el año en la comisión de Mercados! ✈️

@YoEduVar nos comparte cómo fue la última reunión del año.

Con la mirada puesta en 2026, seguimos construyendo sobre los aportes de nuestros socios.

Gracias a todos por acercarse y a @effectusok por recibirnos en sus oficinas. 🖥️

[Edu Vargas @imeduvar]

I am deeply honored to announce my selection for the International Visitor Leadership Program (IVLP), focusing on Cybersecurity Policy and Operational Response in the U.S.

The future of the global tech sector hinges on effective, scalable cybersecurity management, and I am committed to bringing direct, actionable models back to @loopstudio_dev and the Uruguayan tech industry.

This is not a theoretical exercise. My objective is to observe and document the execution of key systems and robust public-private collaboration frameworks.

Intensive Three-Week Agenda Highlights:
- Legal & International Cooperation: Reviewing legal frameworks for cybercrime and discussing models for international information sharing.
- Private Sector Imperative: Evaluating the critical role of private companies in data protection and collaborative threat intelligence with government partners.
- Talent Pipeline: Exploring innovative educational programs designed to build a specialized, future-ready cybersecurity workforce.

🇺🇸 The itinerary is structured around policy and technology hubs: Washington (Nov 29 - Dec 4), Boston (Dec 4 - 10), Orlando (Dec 10 - 16), and San Francisco (Dec 16 - 20).

A massive thank you to the @usembassyMVD Montevideo.

I look forward to sharing the specific, operational models for public-private collaboration that I encounter throughout this journey. Stay tuned for updates!