¡Ya disponible! Investigación de Telegram 2025 — los principales insights del año 
Bug bounty Tips
Ir al canal en Telegram
🛡️ Cybersecurity enthusiast | 💻 Helping secure the digital world | 🌐 Web App Tester | 🕵️♂️ OSINT Specialist Admin: @laazy_hack3r
Mostrar más5 784
Suscriptores
+1024 horas
+887 días
+41930 días
Archivo de publicaciones
5 783
#Analytics
#Threat_Research
"Red Report 2025:
The Top 10 Most Prevalent MITRE ATT&CK Techniques. SneakThief and The Perfect Heist".
// This year's findings highlight a new era of adversarial sophistication in infostealer attacks, epitomized by malware like "SneakThief," which executed in a kill chain what has come to be known as "The Perfect Heist." Although the SneakThief malware is a fictitious name in this scenario, its attack patterns reflect real-world incidents. This advanced threat leverages stealth, persistence, and automation to infiltrate networks, bypass defenses, and exfiltrate critical data
5 783
#Analytics
#Threat_Research
An analytical review of the main cybersecurity events for the week (Jan.10-17, 2026)
1⃣ VideoLAN fixed vulns in its VLC software
// CVE-2025-51602
2⃣ Hijacking Bluetooth Accessories Using Google Fast Pair
// Many Bluetooth accessories do not implement Google Fast Pair correctly, enabling an attacker to forcefully pair with a vulnerable accessory
3⃣ CVE-2025-64155: Fortinet FortiSIEM Argument Injection to RCE
// PoC exploit for Fortinet FortiSIEM which abuses an argument injection to write a file to gain code execution as root
4⃣ Critical Privilege Escalation Vulnerability in Modular DS plugin affecting 40k+ Sites exploited in the wild
// CVE-2026-23800
5⃣ Sicarii Ransomware: Truth vs Myth
// Sicarii is a newly observed RaaS operation that surfaced in late 2025
6⃣ Security Detections MCP
// An MCP server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, and KQL security detection rules
]-> Analytical review (Jan.03-10, 2026)
5 783
#tools
#OSINT
1⃣ SwaggerSpy - Automated OSINT on SwaggerHub
2⃣ RedTiger-Tools - Open-Source Security Multi-Tool
3⃣ ASN - ASN Lookup Tool and Traceroute Server
4⃣ SatIntel - OSINT tool for Satellites. Extract satellite telemetry, receive orbital predictions, and parse TLEs
5 783
Resources for securing AI systems
https://github.com/TalEliyahu/Awesome-AI-Security
5 783
leash - take your AI agents for a walk - github.com/strongdm/leash
Authorize and monitor your AI agents with policy enforcement, sandboxed execution, and real-time observability—ensuring they operate safely within your defined boundaries.
Leash wraps AI coding agents in containers and monitors their activity. You define policies in Cedar; Leash enforces them instantly.
5 783
Awesome AI Security
- Learning resources
- Frameworks and standards
- AI for offensive cyber
- AI for defensive cyber
- Safety and sandboxing for AI tools
- Detection & scanners
https://github.com/ottosulin/awesome-ai-security
Contributor Otto Sulin
#ai #cybersecuriyty
5 783
#exploit
#AppSec
1⃣ Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data
// The attack exploits the q URL parameter, double-request techniques, and chain-request methods to inject malicious prompts, perform repeated actions, and establish ongoing data exfiltration chains
2⃣ Lack of isolation in agentic browsers resurfaces old vulnerabilities
// Agentic browsers' lack of proper isolation enables vulnerabilities like XSS and CSRF, leading to data leaks, prompt injections, and session hijacking, necessitating system-level security measures and extended origin policies
3⃣ Clang Hardening Cheat Sheet
// The article reviews a decade of Clang hardening techniques, highlighting new compiler flags and hardware-assisted protections against modern exploits like ROP, JOP, and speculative attacks
5 783
#AIOps
#exploit
#AppSec
BodySnatcher (CVE-2025-12420):
A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow
https://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow
// The discovery of BodySnatcher represents the most severe AI-driven security vulnerability uncovered to date and a defining example of agentic AI security vulnerabilities in modern SaaS platforms
5 783
#AIOps
#Research
#Threat_Research
"VulnLLM-R: Specialized Reasoning LLM for Vulnerability Detection", Dec. 2025.
]-> Code & Data
]-> Demo
]-> Model
// We propose VulnLLM-R, the~\emph{first specialized reasoning LLM} for vulnerability detection. Our key insight is that LLMs can reason about program states and analyze the potential vulnerabilities, rather than simple pattern matching
5 783
#AIOps
#AppSec
#Threat_Research
ZombieAgent: New ChatGPT Vulnerabilities
https://www.radware.com/blog/threat-intelligence/zombieagent
// several new vulnerabilities + method to achieve persostence + new propagation technique
5 783
#DFIR
#Tech_book
"Cyber Security Kill Chain - Tactics and Strategies: Breaking down the cyberattack process and responding to threats", 1st Edition, 2025.
// The book is a timely response to the increasing complexity of cyber threats. With the rapid growth of technologies such as AI, the Internet of Things, and quantum computing, the battlefield of cyber warfare is evolving faster than ever..
5 783
#AppSec
#Threat_Research
1⃣ GnuPG Vulnerabilities
2⃣ zlib v1.3.1.2 Global BOF in TGZfname() of zlib untgz Utility
// The untgz utility that is part of zlib suffers from a straightforward buffer overflow in the filename parameter
3⃣ SmarterMail Pre-Auth RCE
// pre-auth RCE (CVE-2025-52691) in SmarterMail allowed unauthenticated file uploads via
/api/upload, enabling RCE through path traversal, highlighting risks of silent patches and the need for proactive security5 783
#DevOps
#Tech_book
#Threat_Modelling
"Threat Modeling Best Practices:
Proven frameworks and practical techniques to secure modern systems", Oct. 2025.
// This book takes you through the spectrum of threat modeling processes and practices. From foundational methodologies such as STRIDE to cutting-edge implementations that keep pace with the speed of system development, we begin by establishing a solid understanding of threat modeling principles, methodologies, and best practices that form the foundation of threat identification
5 783
#MLSecOps
AI Model Confusion:
An LLM/AI Model Supply Chain Attack
https://checkmarx.com/zero-post/hugs-from-strangers-ai-model-confusion-supply-chain-attack
// Checkmarx Zero research reveals the AI Model Confusion attack pattern against registries like Hugging Face, building on Dependency Confusion in OSS library registry
5 783
#AIOps
#MLSecOps
"OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs", Jan 2026.
]-> https://github.com/AI45Lab/OpenRT
// Existing red-teaming benchmarks are often fragmented, limited to single-turn text interactions, and lack the scalability required for systematic evaluation. To address this, we introduce OpenRT, a unified, modular, and high-throughput red-teaming framework designed for comprehensive MLLM safety evaluation
5 783
⚙️ Learn Python, Docker, Git, DevOps & more, all in one interactive platform
A new all-in-one learning resource has popped up with fully interactive courses covering Python, Docker, Git, DevOps, and many other tech topics, perfect for beginners and upskillers.
🔸 Step-by-step explanations for every concept, function, and method.
🔸 Interactive lessons with lots of hands-on practice and real examples.
🔸 Covers everything from basic syntax to advanced workflows.
For anyone looking to build strong technical skills from scratch, this is a clean, beginner-friendly place to start.📊 Powered by Crypto Insider
5 783
Repost from Startups & Ventures
⚙️ Learn Python, Docker, Git, DevOps & more, all in one interactive platform
A new all-in-one learning resource has popped up with fully interactive courses covering Python, Docker, Git, DevOps, and many other tech topics, perfect for beginners and upskillers.
🔸 Step-by-step explanations for every concept, function, and method.
🔸 Interactive lessons with lots of hands-on practice and real examples.
🔸 Covers everything from basic syntax to advanced workflows.
For anyone looking to build strong technical skills from scratch, this is a clean, beginner-friendly place to start.📊 Powered by Crypto Insider
5 783
#exploit
Complete comprehensive archive of all 1558 exploits added to Packet Storm in 2025.
5 783
#tools
#Offensive_security
1⃣ MSFinger - Microsoft Network Service Fingerprinting Tool
2⃣ PowerShell Script to Reset The KrbTgt Account Password/Keys For Both RWDCs And RODCs
3⃣ ZeroPulse - Modern Command & Control (C2) Platform with Cloudflare Tunnel Integration
5 783
#MLSecOps
#Whitepaper
"Implementing Secure AI Framework Controls in Google Cloud", Dec. 2025.
// Google’s Secure AI Framework is a framework for securing AI systems throughout their lifecycles. SAIF is designed for practitioners – the security professionals, developers, and data scientists on the front lines – to ensure AI models and applications are secure by design
