Tag: SANS Internet Storm Center, InfoCON: green

Clipboard Pictures Exfiltration in Python Infostealer, (Wed, Oct 15th)

For a while, clipboard content has been monitored by many infostealers. Purposes can be multiple, like simply searching and exfiltrating juicy data or on-the-fly modification like crypto-wallet swapping[1]. Note that the clipboard is a major risk when you don't disable…

Read more →

Microsoft Patch Tuesday October 2025, (Tue, Oct 14th)

I am experimenting today with a little bit of a cleaned-up patch overview. I removed vulnerabilities that affect Microsoft's cloud systems (but appreciate Microsoft listing them at all), as well as vulnerabilities in third-party software like open source libraries. This…

Read more →

Heads Up: Scans for ESAFENET CDG V5 , (Mon, Oct 13th)

In January, a possible XSS vulnerability was found in the electronic document security management system ESAFENET CDG. This was the latest (as far as I can tell) in a long list of vulnerabilities in the product. Prior vulnerabilities included SQL…

Read more →

Wireshark 4.4.10 and 4.6.0 Released, (Sun, Oct 12th)

Wireshark release 4.4.10 fixes 6 bugs and 1 vulnerability (in the MONGO dissector). This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Wireshark 4.4.10 and 4.6.0 Released, (Sun, Oct 12th)

Read more →

Polymorphic Python Malware, (Wed, Oct 8th)

Today, I spoted on VirusTotal an interesting Python RAT. They are tons of them but this one attracted my attention based on some function names present in the code: self_modifying_wrapper(), decrypt_and_execute() and polymorph_code(). A polymorphic malware is a type of…

Read more →

More .well-known Scans, (Thu, Oct 2nd)

I have been writing about the “.well-known” directory a few times before. Recently, about attackers hiding webshells [1], and before that, about the purpose of the directory and why you should set up a “/.well-known/security.txt” file. But I noticed something…

Read more →