Security researchers at Palo Alto Networks uncovered a large-scale extortion campaign exploiting misconfigured cloud environments. Attackers targeted over 110,000 domains by accessing exposed .env files, which contained sensitive information like AWS IAM keys, SaaS API keys, and database logins. These misconfigurations allowed attackers to infiltrate cloud environments, exfiltrate data, and …
The Department of Health and Human Services (HHS) faces significant cloud security vulnerabilities, as highlighted in a recent audit by the Office of Inspector General (OIG). The report reveals weaknesses in a dozen security controls and inadequacies in HHS’ cloud inventory processes. Critical issues include a lack of multifactor authentication …
CrowdStrike warns of a new malware campaign that exploits the recent Falcon update bug, leading to widespread IT outages. Cybercriminals are distributing the Daolpu information-stealing malware through phishing emails disguised as recovery instructions. Once active, Daolpu harvests account credentials, browser history, and cookies from popular web browsers, posing a significant …
