ASOS is investigating after an unauthorised push notification was sent. What the company confirms about accessed data and the UK NCSC’s advice.
Resources
Blog
Insights, field notes, and practical guidance on off-cloud security.
Atlassian fixes a file-access vulnerability
Soclyde Team
CVE-2026-21589 exposes specific files in six Atlassian Data Center products, as well as Crucible and Fisheye. Scope and recommended actions.
Unit 42 describes a campaign targeting Iraqi infrastructure that hid malware in a Visual Studio test sent under the Dubai Airports name.
Google added 37 security fixes to Chrome 155 on October 13, including seven critical flaws. Check the installed version and restart browsers across your team.
CrocoRat uses ClickFix and DNS requests
Soclyde Team
A ClickFix lure prompts victims to run a Windows command; CrocoRat then retrieves instructions through DNS TXT and adapts its payload.
MALFEX npm packages steal credentials
Soclyde Team
Checkmarx details MALFEX, an npm campaign targeting Windows. Review suspicious dependencies and exposed access without equating downloads with infections.
A campaign exploits Ninja Forms and WPC Product Bundles to retain WordPress access. Apply the fixes and investigate persistence on affected sites.
Wikimedia reports unauthorised AI agent activity
Soclyde Team
Wikimedia describes unapproved edits, attempts to misuse tools and heavy automated traffic. It found no evidence of compromised systems or data.
Daiwa data exposed through a service provider
Soclyde Team
An incident at Scala Communications exposed Daiwa customer data; the exposed data cannot be used to access brokerage accounts or trade, Daiwa says.
Denmark: unauthorized access to CPR records
Soclyde Team
Unauthorized parties accessed CPR data by misusing a private company’s legitimate lookup access. What authorities disclosed and what people can do next.
Fortra BoKS flaws put service accounts at risk
Soclyde Team
October advisories describe multiple BoKS flaws, including an Active Directory service account password generation weakness.
Nikkei discloses two email account incidents
Soclyde Team
Nikkei reports a compromised Microsoft 365 account and a separate Google Workspace access incident, raising phishing risks.
Take the next step
Build a calmer password strategy
Have a question about off-cloud security or Soclyde? Let’s talk directly.