Tesla on DanSec Daily

Cybersecurity Brief – 2026-01-22

Thu, 22 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Zendesk ticket systems were hijacked in a large-scale global spam campaign, with individuals worldwide receiving hundreds of unsolicited and sometimes alarming emails originating from unsecured Zendesk support systems.
Security testing and training applications such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP have been exploited by threat actors to breach cloud environments of major security vendors and Fortune 500 firms, due to misconfigurations and over-permissioned access.
PcComponentes, a Spanish technology retailer, confirmed a credential stuffing attack but denied claims of a data breach affecting 16 million customers.
LastPass users are being targeted by a phishing campaign using fake password vault backup alerts, leveraging convincing subject lines and messaging.
Tesla’s Infotainment System was compromised, and 37 zero-day vulnerabilities were demonstrated at Pwn2Own Automotive 2026, with researchers earning $516,500 for successful exploits.

Newly Discovered Vulnerabilities

Cisco patched a critical zero-day vulnerability (CVE-2026-20045) in Unified Communications Manager (CM) and Webex Calling Dedicated Instance, which was actively exploited for remote code execution.
Fortinet FortiGate firewalls are being compromised via a patch bypass for a previously fixed authentication vulnerability (CVE-2025-59718), with reports of attacks on both patched and unpatched devices. Automated attacks are altering firewall configurations via FortiCloud SSO abuse.
Zoom and GitLab released security updates addressing vulnerabilities that allowed remote code execution, denial-of-service, and a high-severity two-factor authentication (2FA) bypass in GitLab Community and Enterprise editions.
Chainlit, a popular open-source AI framework, was found to have two high-severity vulnerabilities enabling arbitrary file read and server-side request forgery (SSRF), allowing attackers to steal sensitive data and breach cloud environments.
Anthropic’s official MCP server contained vulnerabilities exploitable via prompt injections, leading to potential code execution and data exposure.
Oracle’s January 2026 Critical Patch Update (CPU) delivered 337 new security patches, addressing approximately 230 unique vulnerabilities across over 30 products.
Researchers demonstrated that malicious Google Calendar invites can leverage prompt injection to bypass privacy controls and cause AI assistants to leak private data.

Notable Threat Actor Activity

North Korean threat actors, identified with the PurpleBravo campaign, targeted at least 3,136 IP addresses through fake job interviews, resulting in compromise of 20 organizations, including those in AI, blockchain, and fintech sectors. The campaign involves malicious Visual Studio Code projects and leverages trusted repository authorship to deliver backdoors.
Phishing campaigns targeting LastPass customers are using sophisticated, AI-generated emails to increase credibility and effectiveness, particularly around holiday periods.
New phishing techniques are exploiting human factors such as timing, context, and emotion, with campaigns becoming more industrialized and scalable.
A new family of Android malware is using AI (TensorFlow models) to perform automated click fraud by detecting and interacting with hidden advertisement elements.

Trends, Tools, or Tactics of Interest

AI-assisted social engineering is a growing concern, with 47% of organizations in a World Economic Forum survey citing adversarial AI advancements as their top worry regarding generative AI.
The VoidLink Linux malware framework, comprising 88,000 lines of code, was largely developed with AI assistance, marking a significant evolution in the use of AI for malware creation.
Attackers are leveraging prompt injection vulnerabilities in AI-powered systems (e.g., Anthropic MCP server, Google Calendar invites) to bypass controls and facilitate data exfiltration.
Exposure Assessment Platforms (EAPs) are emerging as a new security focus, reflecting a shift towards continuous, automated exposure management in response to overwhelming security workloads.
Use of legitimate Windows tools (LOLBins) continues as a tactic for deploying remote access trojans (RATs), with recent incidents involving an unusually large assortment of such tools in a single attack.
Managed Security Service Providers (MSSPs) are increasingly adopting AI to manage alert volumes and deliver higher-level protection with reduced analyst headcount.
Data exfiltration via outbound email remains a critical and often underprotected vulnerability vector.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the Embedded Systems Threat Matrix (ESTM), a new security framework designed to help organizations protect critical embedded systems.
Increased attention is being paid to health privacy and surveillance, with reports highlighting the impact of data brokers and law enforcement (e.g., ICE) on patient trust and healthcare access.

Cybersecurity Brief – 2025-08-11

Mon, 11 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Google patched a vulnerability that allowed malicious Google Calendar invites to hijack Gemini agents on target devices, enabling attackers to leak sensitive user data.
Researchers reported that attackers are leveraging Google paid ads to promote fake Tesla websites, potentially leading to credential theft and other fraudulent activities.

Newly Discovered Vulnerabilities

WinRAR maintainers released an update addressing an actively exploited zero-day vulnerability (CVE-2025-8088, CVSS 8.8).
New attack techniques have been identified that exploit flaws in Windows domain controllers, allowing attackers to leverage public DCs via RPC and LDAP to create DDoS botnets.
Researchers disclosed a now-patched Windows Remote Procedure Call (RPC) Endpoint Mapper (EPM) poisoning vulnerability that could be exploited to escalate privileges within a Windows domain.

Notable Threat Actor Activity

Threat actors have been observed exploiting the WinRAR zero-day (CVE-2025-8088) in the wild.
Malicious actors are using Google paid advertisements to direct users to phishing sites impersonating Tesla.

Trends, Tools, or Tactics of Interest

xsshunter-express, a self-hosted tool for capturing and analyzing blind XSS payloads, has been released, offering features such as screenshot capture, DOM dumps, and full attack context.
Attackers are increasingly targeting public infrastructure, such as domain controllers, to amplify DDoS attacks.
POS (Point-of-Sale) scams involving portable devices remain a concern, with continued reports of theft and fraud using these tools.

Cybersecurity Brief – 2025-05-02

Fri, 02 May 2025 00:00:00 +0000

Major Incidents and Breaches

Harrods Cyberattack: Harrods confirmed a cyberattack, marking the third major UK retailer targeted in a week, following incidents at M&S and the Co-op. This highlights increased targeting of high-profile UK retail organisations.
Ascension Health Data Breach: Over 100,000 individuals were notified that their data was likely accessed in a breach at Ascension Health in December 2024, with details only now being disclosed.
Disney Slack Data Theft: A hacker known as “NullBulge” pleaded guilty to stealing over 1.1TB of internal data from Disney’s Slack channels.
Commvault Azure Breach: Commvault disclosed that a nation-state actor exploited CVE-2025-3928 as a zero-day to breach its Microsoft Azure environment. No evidence of customer data compromise was found.
Malicious PyPI Packages: Seven malicious Python packages were discovered on PyPI, abusing Gmail SMTP and WebSockets for data exfiltration and remote command execution.
xAI API Key Leak: An xAI developer leaked a private API key on GitHub, potentially exposing private SpaceX and Tesla LLMs to unauthorised queries for two months.

Newly Discovered Vulnerabilities

WordPress Fake Security Plugin: Attackers are distributing a fake security plugin (“WP-antymalwary-bot.php”) that enables remote admin access on WordPress sites, allowing full compromise.
Commvault Zero-Day (CVE-2025-3928): The recently exploited vulnerability in Commvault’s Azure environment is now confirmed as a zero-day vector used by a nation-state actor.

Notable Threat Actor Activity

North Korean IT Worker Fraud: North Korean operatives continue to secure remote IT positions at global companies, including Fortune 500 firms and at least one US political campaign, using AI tools to pass technical interviews and conceal their identities.
Pro-Russian Hacktivists: Russian-aligned groups are conducting persistent DDoS attacks against Dutch public and private organisations, causing service disruptions.
Nefilim Ransomware: A Ukrainian national was extradited to the US for conducting Nefilim ransomware attacks targeting large companies internationally.
DarkWatchman and Sheriff Malware: Russian and Ukrainian organisations are being targeted with advanced phishing campaigns deploying DarkWatchman malware, demonstrating nation-grade tactics and stealth capabilities.
Claude AI Influence Campaign: Threat actors exploited Anthropic’s Claude AI to operate over 100 fake political personas as part of a global influence operation, engaging with authentic accounts on X (formerly Twitter).

Trends, Tools, and Tactics

Email as Primary Attack Vector: Email remains the leading vector for cyberattacks, as confirmed by recent Barracuda research and continued phishing campaigns.
Malware Delivery via Software Supply Chain: The discovery of malicious PyPI packages and fake WordPress plugins underscores the ongoing risk of software supply chain attacks.
AI in Cyber Operations: Both attackers and defenders are increasingly leveraging AI. Notably, threat actors are using AI to enhance social engineering (North Korean IT worker scam) and to automate influence operations (Claude AI abuse). Cisco is integrating advanced LLMs into its XDR platform for autonomous attack investigation.
SOC Tool Evolution: Top Security Operations Centres are shifting towards Network Detection and Response (NDR) to counter advanced adversaries who evade traditional endpoint detection.
Cloud Security Challenges: Key issues include cloud authorisation sprawl, insufficient cloud logging, and regulatory barriers to AI-powered defence tools.
AppSec Efficacy: New research shows that 95% of application security fixes do not reduce real risk, highlighting the need for more meaningful remediation strategies.

Regulatory and Policy Developments

US Defense Contractor Settlement: Defense contractors agreed to pay $8.4 million for failing to meet federal cybersecurity standards, reinforcing the importance of compliance under the False Claims Act.
Microsoft Bulk Email Compliance Deadline: Organisations using Outlook.com must meet new bulk email compliance requirements by 5 May 2025.
Windows 11 Security Enhancement: Microsoft announced a significant new administrator protection feature for Windows 11, described as the most substantial architectural security change in a generation.
Real ID Security Debate: Ongoing debate over the adequacy of Real ID security standards ahead of the 7 May 2025 deadline.

Other Noteworthy Observations

Retail Sector Under Attack: The spate of attacks against major UK retailers signals a trend of increased targeting within the sector.
AI Security Blind Spots: Despite overall improved cyber resilience, many organisations remain unprepared for emerging AI-driven threats.
Supply Chain and Insider Risks: Recent incidents highlight the persistent risk posed by both compromised supply chains (malicious packages, plugins) and insiders (API key leaks, fraudulent IT workers).