Aggregator

Iranian Hackers Impersonate Online Recruiters
Western Europeans working in aerospace, defense manufacturing or telecoms are receiving waves of emails from putative job recruiters who actually are Iranian state hackers ready to unleash a backdoor and an infostealer. Check Point tracks the threat actor as "Nimbus Manticore."

CS4CA Europe London Event Chair Wayne Harrop on OT Risk and Collaboration
Critical infrastructure providers are facing a volatile geopolitical landscape that could lead to cyberattacks and business disruptions. In advance of the CS4CA Europe London Conference (Sept. 30 - Oct. 1, 2025), conference chair Wayne Harrop shares key cyber strategies to counter enterprise threats.

Het Combat Support Ship Den Helder van de Koninklijke Marine heeft afgelopen zaterdag een Russisch fregat geëscorteerd door de Nederlandse exclusief economische zone (EEZ). Het fregat Neustrashimy voer samen met een ander Russisch koopvaardijschip vanaf de Noordzee richting het kanaal. Een overzicht van Defensieoperaties in de week van 17 tot en met 23 september 2025.

无需权限！OnePlus OxygenOS 被曝可直接窃取短信

种下一颗不让世界变坏的念头，10月24日上海见

看雪论坛作者ID：zZhouQing

当前环境异常,需完成验证后继续访问。

当前环境出现异常状态，需完成验证后方可继续访问相关内容或服务。

当前环境出现异常问题，需完成验证后才能继续访问相关内容。

月球在生锈，而这一切都是地球的错。科学家发现，从地球吹向月球的氧粒子会将月球矿物质转变成赤铁矿，也就是铁锈。澳门科技大学的行星科学家金子梁 (JIN Ziliang)表示，这一发现加深了研究人员对地月之间深层作用的理解，揭示了月球如何保存这些相互作用的地质记录。地球和月球大多数时间都沐浴在太阳的带电粒子流中，但每个月有五天地球会进入到太阳和月球之间，阻挡了大部分太阳粒子流，期间月球主要暴露于曾是地球大气一部分、后被吹入太空的粒子——这一现象被称为“地球风”。地球风包含了各种元素的离子，如氢、氧和氮。当这些带电粒子撞击月球表面时，它们可能会进入月球土壤的上层，触发化学反应。

2025年IEEE Spectrum编程语言排行榜显示，Python以近50%的优势蝉联榜首。Java和JavaScript保持强劲地位，而Rust、Go、TypeScript等新兴语言因性能和安全性迅速崛起。

A sophisticated cybercrime campaign has emerged that transforms legitimate AWS infrastructure into weaponized attack platforms through an innovative combination of containerization and distributed denial-of-service capabilities. The ShadowV2 botnet represents a significant evolution in cyber threats, leveraging exposed Docker daemons on Amazon Web Services EC2 instances to establish persistent footholds for large-scale DDoS operations. This campaign […]

The post ShadowV2 Botnet Exploits Docker Containers on AWS to Turn Thems as Infected System for DDoS Attack appeared first on Cyber Security News.

Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP. Gh0stKCP has been used to carry command-and-control (C2) traffic by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based C2 protocol. I wanted to t[...]

Gh0stKCP是一种基于KCP的C2协议，用于PseudoManuscrypt和ValleyRAT等恶意软件。其握手阶段采用独立会话ID实现NAT穿透，并通过特定检测方法识别该协议。

In early September, Palo Alto Networks publicly acknowledged that Secure Web Gateways (SWGs) are architecturally unable to defend against Last Mile Reassembly attacks. SquareX first discovered and disclosed Last Mile Reassembly attacks at DEF CON 32 last year, warning the security community of 20+ attacks that allow attackers to bypass all major SASE/SSE solutions to smuggle and reassemble malicious sites, scripts and files in the browser.

Despite numerous responsible disclosure efforts, most major vendors maintained complete ignorance, offering no customer warnings about these critical exposures for over a year. However, as attackers increasingly weaponize Last Mile Reassembly techniques to target enterprises, SASE/SSE vendors are finally acknowledging that traditional proxy-based defenses fall short when it comes to browser-native threats. In the same press release, the industry giant also recognized that “the browser is becoming the new operating system for the enterprise, the primary interface for AI and cloud applications” and that “securing it is not optional”.

This article will provide a recap of Last Mile Reassembly Attacks, its impact on organizations and 5 questions you should ask your SASE/SSE vendor.

Palo Alto Networks press release What are Last Mile Reassembly Attacks?

Last Mile Reassembly attacks leverage various methods to smuggle site source codes, malicious scripts and files, before reconstructing them as functional malicious scripts, phishing sites and malware in the victim’s browser. These techniques exploit architectural limitations of SWGs, leading to a complete bypass. These include:

Smuggling Malicious Sites with Canvas Engine

Instead of full blown malicious sites, attackers can deliver a stream of pixel coordinates, which is then used by the canvas engine to “draw” the malicious site. Combined with its ability to capture interactions like keystrokes and mouse clicks, this enables attackers to assemble any malicious site, including phishing sites, in the victim’s browser. In other words, instead of shipping the “painting”, this technique ships the “painter” into the victim’s browser.

Smuggling Malicious Scripts with Web Assembly

Malicious scripts can be smuggled as malicious payloads in WASM modules, which are not inspected by SWGs. Once it lands on the victim’s browser, these malicious scripts can be extracted and assembled into a functioning malicious script to exfiltrate data, steal credentials and session tokens.

Smuggling Malicious Files with Various Techniques

There are multiple ways to smuggle files into the victim browser, including file chunking, embedding encryption and encoding. File chunking involves breaking malware into “chunks” that individually do not contain a malicious signature. File embedding involves hiding files in web elements like CSS, Javascript and images using steganography techniques. Regardless of which technique is used, the file is then reassembled into a functional malware which can be loaded in the browser or downloaded to the victim’s endpoint.

Unmonitored Channels

Attackers can smuggle malicious scripts, site MHTML/HTMLs and files via binary channels like WebRTC, gRPC and WebSockets. These are common communication channels used by web apps like video conferencing and streaming tools, but are completely unmonitored by SWGs. In fact, many SWGs publicly admit this on their website and recommend their customers disable these channels.

Why are SWGs Unable to Detect Last Mile Reassembly Attacks?

As a proxy solution, SWGs work primarily by inspecting network traffic, with no direct visibility into what the user scripts, sites and files the user interacts with in the browser.

Lack of Visibility into the Browser

SWGs identify malicious sites through URL filtering and running the site’s HTML/CSS/JS against its ML model trained on the web markups of known malicious sites. Neither of these techniques allow direct visibility into what the user sees in the browser. The canvas engine attack exploits this technique, “drawing” malicious/phishing sites in the victim’s browser with pixel coordinates without needing to send any actual HTML/CSS/JS.

No Web Assembly Inspection

Similar to communication channels, Web Assembly is a relatively new browser component that remains uninspected by SWGs. Given that there is no static or dynamic analysis performed, attackers can freely smuggle malicious scripts through WASM modules, disguising itself as a legitimate functionality in the browser.

Limitations in File Inspection

SWGs typically work by using heuristics like HTTP headers to identify file download requests. When a file download request is detected, it will then send a copy of the file to its cloud for inspection, blocking the download if any malicious file signature is detected. Last Mile Reassembly attacks exploit architectural vulnerabilities in each of these steps by preventing SWGs from detecting a file download (e.g. unmonitored channels, embedding) and/or inspecting the file properly (e.g. encryption, encoding, chunking). Once the file, or components of it, reaches the victim’s browser, SWGs have limited visibility on how it is modified, reassembled and the form it takes when it is finally downloaded onto the victim’s device.

Unmonitored Channels

Browser communication channels like WebRTC and gRPC are relatively new browser features popularized long after SWGs were invented. Thus, SWGs do not monitor any of these channels, making them prime avenues for attackers to smuggle malicious components. Most SASE/SSE vendors have attempted to solve this problem by advising their customers to block all browser communication channels. However, this is an unrealistic solution as most modern web apps, including enterprise apps, rely on these channels to function.

Test Your SWG Against Last Mile Reassembly Attacks Now

To see if you are vulnerable to LMRs, visit scan.browser.security to get a free Web Security Posture Assessment on how your SWG performs against LMR attacks.

Why are SASE/SSE Vendors Highlighting this Vulnerability Now?

Unfortunately, attackers have been increasingly exploiting enterprises with Last Mile Reassembly techniques. While we are unlikely to ever see a public admission, it is highly probable that SASE/SSE vendors are seeing more of their customer base fall prey to LMR attacks despite having full SWG protection. In fact, many of our customers are from this exact demographic — existing SASE/SSE customers who realize they are still being exploited by browser-based attacks like LMR.

There has also been evidence that attackers are using similar techniques to exfiltrate sensitive data out of organizations. Termed Data Splicing Attacks, the SquareX research team disclosed multiple attacks at BSides SF this year that allow insider threats to effectively copy-paste any data and upload any file to the browser. In the talk, researchers showed Data Splicing completely bypassing both SASE/SSE cloud DLP and endpoint DLP solutions.

This presents a two-pronged challenge for SASE/SSE vendors, which hundreds of thousands of enterprises rely on to protect themselves from both web threats and data loss. Thus, several vendors, such as Palo Alto Networks and Netskope, have become the first to embrace the inevitable and face the issue head on by buying or building their own browser security solution.

Unfortunately, these attacks are far from only browser-native attacks that are affecting enterprises. One major attack is Browser Native Ransomware, which combines identity attacks and agentic AI to systemically exfiltrate and hold sensitive data from enterprise SaaS apps as ransom. These ransomwares require no local files and processes, allowing them to completely evade traditional anti-ransomware solutions. Similarly, there has been an uptick in malicious extensions that exfiltrate data, monitor users and steal credentials without being detected by traditional enterprise security solutions.

What are SASE/SSE vendors doing to mitigate LMR?

There are two categories of SASE/SSE vendors. The first category, which unfortunately includes the majority, is still in complete denial of the rise of browser-based attacks. The second category, recognizes the shift it attack surface towards the browser and has branded themselves to be “first movers” in browser security among incumbent SASE/SSEs. This includes Palo Alto Networks, who purchased Talon (now known as Prisma Access Browser) and Netskope, who built their own Netskope Enterprise Browser.

Unfortunately, both solutions are met with significant adoption challenges due to the change management and productivity hindrance involved in migrating all employees to a dedicated enterprise browser. According to Gartner, enterprise browsers have only seen a 10% adoption rate at best due to resistance from both end users and IT teams. Most importantly, these enterprise browsers are primarily designed for application access control, and thus are unable to protect against bleeding edge browser-based attacks like Last Mile Reassembly.

How does SquareX protect against LMR?

SquareX’s Browser Detection and Response (BDR) extension acts as an “EDR in the browser” to secure any browser on any device, including unmanaged devices and AI browsers. This includes:

Full Visibility of User View for Canvas Engine Attacks

As a browser-native solution, SquareX has full visibility into what the user sees, including sites that are assembled using canvas engine. This allows SquareX to perform OCR and run each site rendered on the user’s browser through our advanced phishing detection engine, protecting users against malicious sites that go undetected by SWGs.

Granular Script Inspection for Malicious Scripts Smuggled via WASM

SquareX inspects every script running on in the user’s browser, be it those smuggled through WASM modules or injected by a malicious extension. Thus, regardless of how the script gets loaded on the site, SquareX is able to inspect and block any malicious scripts from running.

Client-side File Scanner for Reassembled Files

SquareX built the industry’s first client-side file scanner. In addition to latency benefits, this allows SquareX to scan every file download at the last mile to identify malicious, after any reassembly activities have occurred in the browser. With a single policy, SquareX blocks the download of any file containing malicious macros and/or executables. SquareX can even inspect encrypted files by forcing the users to enter the password before each download, which is often delivered separately by the attacker.

Last Mile Protection for Communication Channels

As SquareX has full visibility into the final site, script and file that the user/user’s browser interacts with, this allows SquareX to provide last mile protection against any malicious site MHTML/HTML, scripts and files that are smuggled through communication channels that go unmonitored by SWGs.

In addition to Last Mile Reassembly attacks, SquareX also protects against other bleeding edge browser threats such as Data Splicing Attacks, Browser Native Ransomware, malicious extensions, identity attacks, rogue AI agents and GenAI data loss. Furthermore, SquareX’s browser extension is compatible with all browsers, allowing enterprises to have browser-native protection without the overhead and productivity risks involved with enterprise browsers.

What Should I Do to Mitigate LMRs?

To begin, here are three actionable steps that we recommend to mitigate LMRs:

1. Visit scan.browser.security to get a free assessment on your LMR exposure
2. Speak to your SASE/SSE provider about how they are mitigating LMR attacks (question guide below)
3. Adopt a browser-native solution that protect against LMR attacks

5 Questions to Ask Your SASE/SSE Vendors

1. Last Mile Reassembly attacks were disclosed at DEF CON last year, can you provide the documentation on how your product protects against these?
2. As communication channels like gRPC and WebRTC are essential to modern web apps, do you have any solution to prevent malicious components from being smuggled via these channels without disabling them?
3. LMR allows attackers to smuggle malware into our employees’ browsers, including known malware. Does this break your SLA that promises to protect against all known malware?
4. [If your vendor has an enterprise browser] Your enterprise browser claims to protect against LMR, why does the report from scan.browser.security still show multiple bypasses?
5. What is your strategy/product roadmap to defend against other emerging browser-based threats? How soon are you planning to launch or integrate a browser security solution?

For industry consortium representatives and enterprise security leaders who would like to learn more, contact us at [email protected]. We would be more than happy to provide a technical deep dive with our researchers and answer any questions over an in-depth conversation.

Why SASE Vendors Are Finally Admitting the Need for Browser Security Solutions was originally published in SquareX Labs on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Why SASE Vendors Are Finally Admitting the Need for Browser Security Solutions appeared first on Security Boulevard.

官方赛程议题公布

全球贸易命脉面临勒索软件、GNSS干扰与AI攻击三重威胁。

Ещё в 2024-м — концепт, а в 2025-м — летные испытания: GE ускорила гиперзвуковую гонку.

An unnamed federal agency was hacked last year after threat actors exploited a critical GeoServer vulnerability

The FBI is warning internet users about fake versions of its official IC3 cybercrime reporting website. Learn how to spot these ‘spoofed’ sites, avoid scams where criminals impersonate agents, and protect your personal information by following the FBI’s crucial safety tips.