VulnHub

A significant vulnerability has been identified in the Pulsetto Vagus Nerve Stimulator, affecting all versions of the device. This flaw allows attackers to exploit hidden commands via Bluetooth Low Energy (BLE) without any authentication or encryption. If successfully exploited, attackers could disable safety mechanisms or alter stimulation settings, posing serious risks to patients who rely on this medical device. Pulsetto has not collaborated with CISA to address the issue, leaving users vulnerable. It's crucial for users to contact Pulsetto directly for assistance and take defensive measures to protect their devices from potential exploitation.

Recent research has shown vulnerabilities in passkey systems designed to enhance online security by replacing traditional passwords and resisting phishing attacks. Three separate studies demonstrated methods for bypassing these protections without breaking the underlying cryptography. For instance, attackers were able to exploit signed authentication data exposed by Windows, leverage a cloud-synced passkey system compromised by existing malware on a victim's device, and other techniques. This is concerning for users and organizations relying on passkeys for secure authentication, as it suggests that even advanced security measures can be undermined. As these attacks become more sophisticated, it raises questions about the reliability of passkeys and the need for ongoing vigilance in security practices.

Levi Strauss recently fell victim to a cyberattack that involved social engineering tactics. Attackers gained access to the computers of three employees, allowing them to steal sensitive corporate data. This breach raises concerns about the effectiveness of employee training in recognizing phishing attempts and other social engineering schemes. The stolen data could potentially harm the company's reputation and lead to legal ramifications. Organizations must remain vigilant and strengthen their cybersecurity measures to prevent similar incidents in the future.

IEH Corporation, a U.S. defense and aerospace manufacturer based in Brooklyn, New York, recently suffered a phishing attack that compromised its Microsoft 365 inbox. This breach potentially exposed sensitive emails and export-controlled military data. IEH specializes in high-reliability electrical connectors, which are critical in military and aerospace applications. The incident raises concerns about the security of sensitive information in the defense sector, as attackers could exploit such data for malicious purposes. Companies in similar fields need to be vigilant and enhance their email security measures to prevent similar attacks in the future.

Unlimited Technology Systems, a U.S.-based healthcare technology company, has reported a data breach affecting approximately 3.8 million individuals. The breach occurred after hackers gained access to one of its commercial data centers between October 5 and 10, 2025. Stolen data includes personal, medical, and insurance information of patients, raising significant concerns about privacy and identity theft. This incident emphasizes the vulnerabilities within healthcare technology systems, which are critical for patient care and data security. Individuals affected should be vigilant about potential phishing attempts and monitor their accounts for suspicious activity.

A vishing group identified as UNC6671 has shifted its focus to targeting mergers and acquisitions (M&A) firms with extortion schemes. This group, known for using voice phishing tactics, aims to exploit sensitive financial data and negotiations occurring in these high-stakes environments. Experts are advising firms to implement managed-device logins and closely monitor audit logs to combat the rising threat of phishing-led data theft. The implications of this shift are significant, as M&A firms often handle large sums of money and confidential information, making them prime targets for attackers seeking to leverage that data for financial gain.

A recent hacking campaign has targeted over 200 firms, including prominent financial institutions like Blackstone and Bridgewater Associates, by impersonating IT support through fake help desks. The attackers, associated with various names like Redact and Falcon, set up credential-stealing websites aimed at employees to capture multi-factor authentication (MFA) credentials. This tactic raises significant concerns as it not only compromises sensitive financial data but also undermines trust in internal IT support systems. The scale of this operation suggests a well-organized effort to exploit vulnerabilities in corporate security practices, emphasizing the need for enhanced training and awareness among employees about potential phishing attempts. Companies must remain vigilant and adopt stricter security measures to protect against such impersonation schemes.

A vishing extortion group known as UNC6671 has rebranded several times, initially operating under the name BlackFile. The group has expanded its operations by adopting new names including Redact, Pink, Helix, and Falcon, reportedly making millions through their schemes. Vishing, or voice phishing, involves using phone calls to trick individuals into revealing sensitive information or transferring money. This group's activities raise concerns for both individuals and businesses, as they can lead to significant financial losses and a breach of personal data. The ongoing evolution of this group’s branding suggests they are attempting to evade detection while continuing their extortion efforts.

A vulnerability has been discovered in Medixant's RadiAnt DICOM software that could allow attackers to exploit specially crafted DICOM files. Versions 2025.2 and earlier of the software are affected, which could lead to application crashes or even remote code execution due to an out-of-bounds write triggered by malicious JPEG-compressed pixel data. Users are advised to upgrade to version 2026.1 to mitigate this risk. The vulnerability is particularly concerning for healthcare and public health sectors worldwide, as it could compromise patient data and system integrity. While there are currently no reports of this vulnerability being actively exploited, users should remain cautious and only open DICOM files from trusted sources.

A recently discovered vulnerability in Johnson Controls Inc.'s TL280 device could allow attackers to access sensitive information. Specifically, versions of the TL280 prior to 5.63 are impacted due to the use of hardcoded credentials in the device's firmware. This presents a significant risk, particularly for sectors such as critical manufacturing, government services, and energy. To mitigate the threat, Johnson Controls recommends updating to firmware version 5.63 and implementing several network security measures, such as restricting access to trusted VLANs and monitoring device access logs for unusual activity. Although no active exploitation of this vulnerability has been reported, organizations should take proactive steps to protect their systems.

A recent phishing campaign is taking advantage of concerns related to the COLDCARD wallet vulnerability and a significant Bitcoin theft, estimated at $88.6 million. Cybercriminals are using this fear to trick users into downloading ScreenConnect, a remote access tool. This software could allow attackers to gain control over victims' devices, potentially leading to further theft of digital assets. Users of the COLDCARD wallet are particularly at risk as they may be targeted due to their connection to the vulnerability. The situation underscores the need for heightened vigilance among cryptocurrency users, especially in the face of ongoing scams exploiting current events.

Kali365 is exploiting Microsoft authentication to gain unauthorized access to corporate data in the United States. The phishing kit tricks users into approving device codes controlled by attackers on the legitimate Microsoft authentication page. Once users authorize this access, attackers receive tokens that allow them to access emails, documents, and cloud resources. This poses serious risks, as it opens the door to data breaches and potential financial fraud for affected organizations. Companies using Microsoft services should be vigilant and educate their employees about this method of attack, as it takes advantage of a widely trusted platform.