RASC 2025 executive interview: Oligo Security’s Gal Elbaz

GBHackers News reports that malicious Python Package Index repository packages abusing TikTok and Instagram APIs have been leveraged by threat actors to check the validity of pilfered account credentials.

Hackread reports that newly identified threat operation Hazy Hawk has been exploiting DNS misconfigurations and deserted cloud resources to take over domains belonging to the Centers for Disease Control, the state of Alabama, the Australian Department of Health, the University of California at Berkeley, and the University College London, as well as Deloitte and PwC, since December 2023.

Ivanti Endpoint Manager Mobile instances in cloud environments impacted by the authenticated bypass flaw, tracked as CVE-2025-4427, and the post-authentication remote code execution issue, tracked as CVE-2025-4428, have been subjected to ongoing attacks since Friday, following the initial targeting of on-premises implementations, The Register reports.