@edoardottt2
Subdomain enumeration won’t show you every domain your target trusts... 👀
csprecon by @edoardottt2 reads the Content Security Policy of your targets and pulls out every domain it allows, from API hosts to CDNs and third-party services! 🤠
🔗 github.com/edoardottt/csp…View quoted post on X
‼️ Security firm Varonis built a hacking tool that hides inside Amazon's cloud and uses Amazon's own AI to carry out an attacker's orders.
Called NotC2, it lets an attacker already inside an AWS account type "list all running EC2 instances with their IPs" and Bedrock, Amazon's AI service, works out the commands.
It never connects to the attacker directly. Every step runs on Amazon's own queue, code and notification services.
Varonis calls it "functionally, a backdoor with an AI assistant."
It is a proof of concept, not seen in real attacks. Varonis says tight permissions are the best defence.View quoted post on X
Some of the biggest openings in security have nothing to do with patching
How breaches began, per a 2026 report:
- 31% exploited a vulnerability
- 35% used phishing, stolen logins or impersonation scams
And nearly half now involve a vendor or partner, up 3x since 2024
Full piece from a16z's Asaf Ezra and Steph Zhang on six cybersecurity companies worth building: a16z.news/p/defense-in-d…View quoted post on X
The year is 2003.
You're logging onto your family PC to play some internet flash gamesView quoted post on X
