IDScan Sued Over Alleged 153M Driver’s License Leak
IDScan faces four proposed class-action lawsuits over claims that more than 153 million U.S. and Canadian driver’s license records were offered for sale on the dark web.
The company has not confirmed a breach or the reported scale, though researchers linked several records to businesses using its technology.
Industry experts have raised concerns about the concentration risk created by identity verification providers for years.
Review your identity-verification vendors and document exactly what ID data they retain, how long they keep it, and whether full document images are actually necessary.
Mathspace Breach Exposes Over One Million Users
I’m following the Mathspace incident affecting over one million people in Australia and New Zealand after an attacker accessed its internal reporting system and stole user data.
The threat actor exploited a Metabase flaw four days after disclosure, while Mathspace said its vulnerability process failed to escalate the alert.
Your remediation process should include determining whether attackers exploited the vulnerability before the fix was applied, not just confirming the patch was installed.
Review historical logs and indicators of compromise to determine whether the vulnerability was exploited before the patch was applied.
CrowdStrike Investigates FalconFlank SYSTEM-Level Exploit
CrowdStrike is investigating FalconFlank, a PoC that lets low-privilege Windows users potentially gain SYSTEM access on Falcon-protected endpoints.
The company has not reported active exploitation but advised customers to disable the affected Office setting while it deploys additional protections.
What concerns me is the potential visibility gap. Researchers reproduced the technique and reported that the final overwrite did not appear in Falcon telemetry, reinforcing why defenders cannot assume their EDR will capture every step of an attack chain.
Disable the affected macro-removal setting, then hunt for suspicious DLL staging, filesystem redirection, and unexpected MareBackup execution.
MikroTik Flaws Let Attackers Take Over Routers
MikroTik RouterOS flaws can give attackers full administrative control of routers when SSH is exposed to the internet.
The attacks began before patches were released, with attackers chaining two flaws to take over devices without authentication.
What concerns me is that compromising the router potentially gives attackers control over network traffic, making post-patch configuration validation important.
Restrict SSH to trusted networks and compare configurations against a known-good baseline.
WeedHack Uses Fake Minecraft Sites to Steal Credentials
I’m tracking a malware campaign still spreading WeedHack through fake Minecraft sites despite the disruption of its original command-and-control infrastructure.
Attackers are using SEO poisoning and trusted services like Discord, GitHub, and Dropbox to distribute malware that steals credentials, cookies, and session IDs.
Taking down attacker infrastructure is valuable, but WeedHack shows why it doesn’t necessarily kill the campaign. If the delivery network remains intact, attackers can replace infrastructure and continue reaching victims through search results and services people already trust.
On managed devices, restrict unauthorized JAR execution and hunt for unusual Java activity, new Defender exclusions, scheduled tasks, and registry persistence.