Amazon's threat intelligence team has linked a recent hack of the popular JavaScript library axios to earlier compromises by a North Korean hacking group. They traced domain records from the axios breach back to a lesser-known npm package that was used as a precursor in their attack strategy. This earlier incident highlights the tactics employed by the attackers and raises concerns about the security of open-source software, which many developers rely on for their projects. As more developers use these packages without thorough vetting, they become attractive targets for cybercriminals. Users of axios and related npm packages should be particularly vigilant about security practices to protect their applications from potential vulnerabilities.
Articles tagged "Amazon"
Found 51 articles
Help Net Security
A recent study by Aryon Security found that over 3.7 million short-lived cloud resources on AWS are exposed to the public, often containing highly sensitive information. These exposures typically last only a few minutes to hours, which makes them difficult for existing security tools like Cloud Security Posture Management (CSPM) and Cloud Native Application Protection Platforms (CNAPP) to detect. This gap poses a significant risk for organizations using AWS services that allow public sharing, as attackers could easily exploit these misconfigurations within that short window. The findings raise concerns about the limitations of current security practices and the need for proactive measures to protect cloud resources from being inadvertently exposed. Organizations must reassess their security strategies to address these fleeting vulnerabilities effectively.
A newly disclosed vulnerability in the Linux kernel, known as RefluXFS and tracked as CVE-2026-64600, allows unprivileged local users to overwrite files owned by the root user on systems using the XFS filesystem. This flaw, which has been around for nine years, can grant persistent root access to attackers on default installations of Red Hat Enterprise Linux (RHEL), Fedora Server, and Amazon Linux. Researchers from Qualys demonstrated how this vulnerability can be exploited, raising significant concerns for system administrators and users of these platforms. Given the potential for local users to gain elevated privileges, it is crucial for affected organizations to assess their systems and apply necessary mitigations to prevent unauthorized access.
Amazon has introduced a new feature in GuardDuty called the investigation agent, which is currently in public preview. This tool uses artificial intelligence to streamline the initial steps of threat investigations within AWS accounts and organizations, aiming to help security teams save time. During the preview phase, users can access the investigation agent at no additional cost in 10 different AWS Regions, but there are limitations on usage: each account can only run 10 investigations daily and a total of 100 during the preview. It's important to note that failed investigations do not count against these limits. This development could significantly enhance the efficiency of security operations for AWS users by automating routine investigation tasks.
A newly discovered vulnerability in the Shark RV2320EDUS robot vacuum allows attackers to control other Shark vacuums within the same AWS region. By extracting a certificate from the vacuum's flash storage, researchers can execute root commands on other devices, giving them access to features like the vacuum's camera, navigation controls, and even the Wi-Fi password in plaintext. This security flaw was reported by a researcher known as tokay0, who tested the method on a limited number of devices. The implications are significant, as it raises concerns about the security of smart home devices and the potential for unauthorized surveillance and control. Users of affected Shark vacuums should be aware of this vulnerability and take steps to secure their devices until a fix is provided.
Krebs on Security
The Cybersecurity and Infrastructure Security Agency (CISA) faced a significant data leak after a contractor mistakenly published internal CISA credentials, including AWS Govcloud keys, on a public GitHub repository. This sensitive information was accessible for nearly six months before the leak was brought to light by KrebsOnSecurity. The incident raises serious concerns about the agency's security protocols and response strategies. Experts emphasize the need for improved oversight and better training for contractors to prevent similar occurrences in the future. This leak not only jeopardizes CISA's operations but also sets a concerning precedent for handling sensitive information in the cybersecurity community.
A lone attacker successfully breached a large AWS cloud environment in just 72 hours by exploiting artificial intelligence workflows, taking advantage of cloud vulnerabilities, and using stolen credentials. This incident targeted a significant Amazon customer, resulting in an extortion attempt. The implications are serious, as it showcases how AI can be manipulated for malicious purposes and emphasizes the need for stronger security measures in cloud environments. Organizations using cloud services should be especially vigilant about credential management and vulnerability assessments to prevent similar attacks. This incident serves as a warning for companies relying on cloud infrastructure to enhance their security protocols.
Recent reports have surfaced regarding the use of AI to generate recipes for illicit drugs, including cocaine, which raises serious concerns about the potential for increased drug production and trafficking. Additionally, a Russian hacking group has been implicated in a series of cyberattacks targeting various organizations, showcasing their ongoing efforts to exploit vulnerabilities for espionage and financial gain. Meanwhile, the cybersecurity group known as Scattered Spider has been linked to multiple incidents involving data breaches and ransomware attacks, further complicating the security landscape. Companies like Cisco and Amazon have also found themselves in the spotlight as new vulnerabilities have been identified in their systems, prompting urgent calls for updates and patches to safeguard user data. The combination of these threats emphasizes the need for heightened security measures across industries to protect against both physical and digital dangers.
A serious vulnerability in Amazon Q Developer was discovered, allowing malicious repositories to execute commands and potentially steal cloud credentials from developers. This flaw, tracked as CVE-2026-12957, received a CVSS score of 8.5, indicating its severity. The issue stemmed from the way Amazon's AI coding assistant interacted with Model Context Protocol (MCP) servers. Developers could unknowingly expose their credentials simply by opening a compromised repository and trusting its workspace. Amazon has since patched the vulnerability, emphasizing the need for developers to be cautious when dealing with untrusted code repositories.
Check Point Research has reported a significant rise in the registration of Amazon-themed domains, with 6,843 new domains registered between December and May. Alarmingly, nearly 10% of these domains have been flagged as malicious or suspicious. This spike coincides with Amazon Prime Day, a time when many consumers are actively shopping online, making them prime targets for cybercriminals. The increase in malicious domains could lead to phishing attempts and scams, putting users' personal and financial information at risk. As shoppers gear up for sales events, researchers urge users to be vigilant and verify the authenticity of websites before making purchases.
Schneier on Security
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) accidentally exposed sensitive credentials in a public GitHub repository. This leak included access details for several highly privileged AWS GovCloud accounts and internal CISA systems, along with documentation on how the agency builds and deploys software. Security experts have labeled this incident as one of the most serious data leaks involving government information in recent years. The exposure raises significant concerns about the security of sensitive government operations and the potential for misuse of the leaked credentials. It underscores the importance of maintaining strict access controls and oversight for contractors handling sensitive data.
A significant security breach involving the Japanese hotel platform Tabiq has exposed over 1 million sensitive documents, including passports, driver's licenses, and selfies. This incident occurred due to a misconfigured Amazon Web Services (AWS) cloud storage bucket, which left personal information accessible online. The data leak impacts a large number of users who utilized Tabiq's check-in system, raising serious concerns about identity theft and privacy violations. Such lapses highlight the need for companies to implement stricter security measures and regularly audit their cloud configurations. As the tech landscape evolves, protecting personal data must remain a top priority for businesses in the hospitality sector.
Schneier on Security
A newly disclosed Linux vulnerability, dubbed 'copy.fail', poses a serious risk across multiple distributions, including Ubuntu, RHEL, Debian, SUSE, Amazon Linux, and Fedora. Revealed by Theori on April 29, 2026, this local privilege escalation flaw allows attackers to manipulate the Linux kernel's crypto API to write unauthorized data into the page cache of files they do not own. Importantly, the exploit does not modify files on disk, making it difficult for traditional monitoring tools like AIDE and Tripwire to detect. This vulnerability is concerning because it affects a wide range of systems without requiring any specific modifications for different distributions. Organizations using these Linux variants should prioritize assessing their security posture and applying necessary mitigations to protect against potential exploitation.
A new malware called 'PCPJack' has emerged, specifically designed to target web applications and cloud environments, such as AWS, Docker, and Kubernetes. This worm not only removes existing infections from a group known as TeamPCP but also steals user credentials. The dual functionality makes it particularly dangerous as it can both cleanse systems of one threat while introducing a new one. Organizations utilizing these cloud services should be vigilant and assess their security measures to prevent unauthorized access and data breaches. The presence of such malware underscores the need for continuous monitoring and robust security practices in cloud environments.
Securelist
Researchers have identified a new phishing technique that exploits Amazon's Simple Email Service (SES) to send fraudulent emails that appear legitimate. By using this widely trusted cloud email service, attackers can bypass traditional email security measures. Victims may struggle to distinguish these phishing emails from real communications, making them more susceptible to scams. The implications are significant, as this method could lead to increased identity theft and financial loss for individuals and organizations alike. Users are advised to be vigilant and verify the authenticity of unexpected emails, especially those requesting sensitive information or prompting urgent actions.