UnSafeLeaks - an emerging threat disregarding rules of engagement, getting personal and vicious against organisations and individuals. Read more about the implications their activity could have here. ➡ jumpsec.com/guides/compoun… #ransomware #cybernews #CybersecurityNews

NEW BLOG: AiTM/ MFA phishing attacks in combination with “new” Microsoft protections (2023 edition) In this blog, I'm going to explore all the new and existing capabilities (Token protection/ attack disruption and more) jeffreyappel.nl/aitm-mfa-phish… #AzureAD #MicrosoftSecurity

Its nice to see some tooling off the back of some of our prior research. This demonstrates the impact of allowing external Teams collaboration.

Malware delivery to Microsoft Teams users made easy - helpnetsecurity.com/2023/07/10/mic… - Octoberfest7 Andrea Santese maxicorbs Tom E #MicrosoftTeams #Phishing #RedTeam #SocialEngineering #Vulnerability #InitialAccess #CybersecurityNews #InfosecNews

Full disclosure - this was published yesterday by one of my team mates at Cyvisory Group Mr pfiatde : x.com/pfiatde/status…

More great coverage of mine and Tom E’s research 💪 China Hacked US Email Systems youtu.be/7qf-sDw8Qx8 via YouTube

Having the external collab setting as default (allowing cross org comms) has allowed us use that technique during red teams on several occasions. It also led to maxicorbs and I finding this: labs.jumpsec.com/advisory-idor-… Not limiting external collab is a real, impactful gap.

What a career 🤯#GOAT in my eyes

We warned Microsoft back in June about the risk of external tenant interaction being used for initial access, I’m honestly expecting the prevalence of this to sky rocket in coming months. That doesn’t even take into account the IDOR they chose not to fix. labs.jumpsec.com/advisory-idor-…

The vast amount of data that builds up during a #purpleteam engagement can quickly become overwhelming if not managed properly. Check out our experience of using the #opensource framework VECTR to solve this problem! labs.jumpsec.com/vectr-for-purp…

🤯

🫠

I did another thing

Great to see Max Corbett, at UKCyberWeek presenting insights about #cloud #redteaming and security concerns that are being introduced & how red teamers and threat actors are leveraging them to great effect! #azure, #aws #gcp #security #cybersecurity #risk

🚨 Tool Release 🚨 We've just open-sourced our #automation scripts for setting up #vulnerable #Azure environments to practice #cloud red teaming. It's basically free to run and has hints to help you along your journey if needed 💪 #AHHHZURE github.com/gladstomych/AH…

A great weekend for our #Adversary simulation team at BSides Cymru. Big shout out and thanks to Sunny and maxicorbs for fantastic presentations and some great insights. A job well done! JUMPSEC LABS #redteam #bsides

Tool Release! We've been having a lot of fun recently bypassing swathes of security controls using alternative web technologies to smuggle payloads right past mail security products. We've open-sourced the tool that we've been using to leverage WASM: github.com/JumpsecLabs/WA…

Imagine the feeling of a long-forgotten canary token triggering in one of your client's estates, which leads you down a path to catch and remove a sophisticated red team... No need to imagine, as Umair has written up a blog: labs.jumpsec.com/active-cyber-d…

🚀My biggest AI watershed moment since getting ChatGPT to write a poem in Jamaican dialect. I’ll be diving deeper into the security side of all this in my new blog 'Securing AI: A Learning Journey' Join the ride! 🧵👇 #AI #VibeCoding #MCP #LLMs maxcorbridge.substack.com

This week in 'Securing AI: A Learning Journey' I got hands on with the awesome #spikee tool. I also broke down the differences between prompt injection and jailbreaking attacks in the world of LLM cybersecurity. Check it out: maxcorbridge.substack.com #AI #cybersecurity