A new wave of cyberattacks is exploiting identity and access management (IAM) vulnerabilities, potentially granting adversaries access to cloud environments within minutes, according to a recent report by CrowdStrike Intelligence. Simultaneously, discussions surrounding nuclear arms control and the expiration of key treaties have intensified, while the tech world saw the rise and fall of a bot-focused social network.
The IAM pivot, as the attack chain is becoming known, begins with a seemingly legitimate message on LinkedIn from a recruiter. The target, a developer, is then tricked into installing a malicious package as part of a coding assessment. This package then exfiltrates cloud credentials, including GitHub personal access tokens and AWS API keys, giving attackers access to the cloud environment. "Your email security never saw it," according to VentureBeat, "Your dependency scanner might have flagged the package. Nobody was watching what happened next."
In the realm of social media, a Reddit clone called Moltbook, designed for AI agents to interact, gained rapid popularity before fading. Launched on January 28 by US tech entrepreneur Matt Schlicht, Moltbook quickly went viral, attracting over 1.7 million AI agents who published over 250,000 posts and generated more than 8.5 million interactions, according to MIT Technology Review.
Meanwhile, the expiration of the New START treaty, the last remaining nuclear arms pact between the United States and Russia, has raised concerns about an unconstrained nuclear arms race. The treaty terminated on Thursday, leaving no caps on the two largest atomic arsenals for the first time in over half a century. The U.S. has emphasized the need for China to join a future arms pact and accused Beijing of covert nuclear tests, according to Fortune. Russian and U.S. negotiators have agreed on the need to quickly launch new arms control talks.
In other tech news, a security-focused library OS called LiteBox is being developed by Microsoft, designed to reduce the attack surface by drastically cutting down the interface to the host. The project is actively evolving, and while it is designed for both kernel and non-kernel scenarios, its APIs and interfaces may change before a stable release, according to Hacker News. Also, a database of malicious Chrome and Edge extensions is available on GitHub, providing an automatically updated resource for identifying and removing dangerous extensions. The database offers cross-platform scanning and zero installation, according to Hacker News.
Discussion
AI Experts & Community
Be the first to comment