153M driver's licenses sold on dark web

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🪪 153M driver's licenses sold on dark web

🕸️ FBI dismantles 23-year-old Sality botnet

🔓 SonicWall flaw allows login-free access

🐛 JFrog flaw grants attackers admin tokens

Plus: 💡 6 strategies & tactics, 🎁 7 other news you might like, 🧰 6 tools, and 📚 5 papers.

🪪 153M driver's licenses sold on dark web LINK

A new dark web identity theft service called Nexus, advertised on the Russian cybercrime forum Exploit, is selling digital scans of more than 153 million US and Canadian drivers licenses, plus millions of ID cards, travel documents, and medical cards.

The images appear to come from an active, ongoing breach at Louisiana-based identity verification firm idscan.net, whose customers include Hertz, Target, and marijuana dispensaries like Planet13; records grew by nearly 400,000 in 24 hours, and each scan includes infrared and ultraviolet versions matching where victims physically handed over their licenses.

The FBI's New Orleans field office opened an official investigation into the apparent idscan.net breach today, with licenses for high-ranking officials including Defense Secretary Pete Hegseth for sale, exposing people to credit fraud and endangering those in witness protection or fleeing domestic violence.

🕸️ FBI dismantles 23-year-old Sality botnet LINK

The FBI, Justice Department, and CrowdStrike this week took apart Sality, a botnet running since 2003 that infected computers to send spam, launch denial-of-service attacks, steal cryptocurrency, and provide access into compromised networks that could be resold.

Sality endured because it spread by infecting executable files and used a peer-to-peer structure with no central command server, so there was no single machine that could be taken offline to bring the rest down.

CrowdStrike reverse-engineered the botnet and seeded it with false information convincing infected machines to disconnect from their controller, while the FBI seized the control domains; no arrests were announced and neither infection counts nor losses were disclosed.

🔓 SonicWall flaw allows login-free access LINK

SonicWall is warning that hackers are actively exploiting two zero-day flaws in its SMA1000 remote-access appliances (models 6210, 7210 and 8200v), including one that lets attackers reach the device without any login.

The main flaw, CVE-2026-83548 in the Appliance Work Place interface, is maximum severity (CVSS 10/10): a remote, unauthenticated attacker abuses an "unintended alternate access path" to reach sensitive functions and run unauthorized operations without any credentials.

SonicWall urges customers to contact its support to check for indicators of compromise, and if any are found, to re-image or re-deploy the appliances, change all user and admin passwords, and reset TOTP tokens.

🐛 JFrog flaw grants attackers admin tokens LINK

A critical authentication bypass in JFrog Artifactory, tracked as CVE-2026-82329, lets unauthenticated attackers with network access gain administrator-level privileges, and WatchTowr reports attackers are actively exploiting it to mint themselves admin tokens.

Under the default configuration the flaw needs no valid credentials, and once attackers hold an admin token they can control repositories, user accounts, permissions, and stored secrets, and slip malicious artifacts into trusted CI/CD build and deployment workflows.

JFrog's cloud environments are already fortified, but self-hosted users must upgrade to fixed releases 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, or 7.161.20, then revoke and reissue admin tokens and treat exposed unpatched instances as compromised.

💡 Strategies & Tactics

> Android App RCE via Dynamic Code Loading: Attackers can smuggle a malicious code file into an Android app's private folder using a path-traversal trick, then trigger it for full remote code execution.

> 1-Click ATO Via Host Header Injection: Exploiting Password Reset Poisoning.: Building password reset links from the attacker-controllable Host header lets a hacker steal the reset token and take over accounts (ATO) with one victim click.

> Hiding a Signup Button Isn’t Security: From Client-Side Controls to Cross-Tenant Data Exposure: Client-side feature flags like a hidden signup button don't enforce security, since attackers can call the backend API directly to register, escalate privileges, and steal other organizations' credentials.

> Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira: Sift scans across file shares, Microsoft 365, Slack, and Jira because credentials hide everywhere, so a clean file-share scan proves nothing about the rest.

> Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars: Adapting an industrial-controller exploit with Claude still demands hours, expert oversight, and hundreds of dollars, but that cost may soon fall across many targets.

> Closing an Azure OpenAI assistant's retrieval gap didn't take a new identity platform. It took one filter and a narrower assistant.: Add a query-time filter checking each user's permissions before retrieval so an AI assistant never surfaces documents that user couldn't otherwise open.

Other news you might like

• Chaotic Eclipse Releases GenDigital Avast Antivirus ZeroDay PrettyPragueLINK

• Dropbox breach seemingly caused by egregious authentication failure [U]LINK

• Attacker stole a METR API key, used $600K worth of credits, and no one noticed for weeksLINK

• Hackers Exploit LiteLLM Admin API Flaw to Turn Read-Only Access Into Full Server TakeoverLINK

• Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weaponLINK

• Chrome and Firefox Updates Patch Dozens of VulnerabilitiesLINK

• Critical HPE Fabric Composer Flaw Lets Unauthenticated Attackers Execute Commands as Privileged UserLINK

🧰 Trending tools

Halo: an API-first tool combining NLP, visual, and audio authentication to detect deepfakes and synthetic media, helping fraud and trust teams block attacks.LINK

MonoCloud for Startups: handles authentication and Cedar-based authorization for users, APIs, and AI agents, letting you control, audit, and revoke access, free for a yearLINK

Shieldstral: provides free open AI models with permissive licenses plus optimized commercial versions, giving developers flexible, efficient deployment options for various needs.LINK

Playground: hands-on sandbox for testing prompt injection attacks against AI agents, helping you understand and explore real LLM security weaknessesLINK

cain-agent: an AI penetration testing tool for authorized security assessments, with built-in support for AWS, Azure, GCP, and Chinese cloud providers.LINK

DeepSec: an AI security platform that audits AI-generated code for errors in real time and automates authorized penetration testing with 40+ skill packs.LINK

📚 Trending papers & reports

3D scene watermarking hides ownership marks ranging from text to full 3D shapes inside photorealistic 3D reconstructions without degrading image quality or requiring costly retraining, giving creators a way to prove copyright and deter unauthorized use.LINK

AI-written system code is kept from directly controlling risky, irreversible actions like device commands, letting a fixed trusted gatekeeper approve each action so safety holds even if the code generator is dishonest.LINK

Anonymous internet traffic can now be made accountable, letting users stay private online while a trusted party can still unmask senders who break the rules, without slowing every packet with heavy cryptography.LINK

AI-powered scams can be fought most effectively by boosting how often, how centrally, and how accurately people report them, since these three levers multiply together to slash scam profits, against 442 billion in yearly losses.LINK

Ownership tags for graph AI hide a secret fingerprint inside models that predict connections, like friend suggestions or fraud links, letting owners prove theft even after 21 tested removal tricks.LINK

See you tomorrow for a new dose of ☕️ Cyberpresso!