Hello and welcome to the Monday June 8, 2026 edition of
 the SANS Internet Storm Center's Stormcast. My name is
 Johannes Ullrich, recording today from Jacksonville,
 Florida. And this episode is brought to you by the SANS.edu
 graduate certificate program in cybersecurity engineering.
 Xavier this weekend wrote up another interesting piece of
 malware. This one originally starts out with a phishing
 email claiming to come from WeTransfer. Well actually the
 interesting part here is WeTransfer being the
 legitimate free file transfer service. The link in the email
 is actually a legitimate WeTransfer link only that it
 well goes to the next stage of the downloader which happens
 to be JavaScript and then this JavaScript is being used to
 execute powershell commands and that'll end you up with an
 image that looks just like an MSI wallpaper. So they're
 trying to hide in this generic relatively well-known brand.
 So that way someone may not notice the Base64 encoded
 script being appended to the end of the image. It's Base64
 encoded, but slightly obfuscated, so it's not easily
 recognizable at least by automated scripts as Base64
 encoded. So that's another layer of obfuscation here
 which then in the end gets you the ultimate malware
 downloader. Xavier promised a second diary with a more
 detailed analysis of just that downloader. But the lesson
 here well, you know these free services are heavily abused
 being abused like WeTransfer. They are also taking advantage
 of some of the cloudflare resources here like their .dev
 links in order to link to additional files. All of these
 are legitimate service services that you can't
 outright block because they're often used in applications and
 as such well best you can probably do is pay attention
 to them. Things like WeTransfer. I'm not sure how
 often this is used in a corporate environment but
 definitely something that you keep an eye on and maybe you
 can block it in if they're not legitimately used in your
 environment. These cloudflare .dev links are definitely used
 by developers so that's definitely something to be
 aware of and again don't just simply block them. 
 [
  A story by Include Security about Bright Data was removed
  by request from Bright Data's PR team. Please refer to the
  Include Security URL in the show notes for updates
 ]
 Dashlane
 published an update on its investigation into a recent
 brute force attack and what they stated that a relatively
 small number of walls like about 20 got actually leaked
 in this particular attack. Now these are encrypted password
 walls so the attacker still needs to then brute force
 whatever master key was used to protect the particular
 wall. The issue that Dashlane was running into is that in
 order to add a new device to sync with your Dashlane
 account someone needs to essentially respond to a six
 digit challenge. Well six digits it's basically a one in
 one million chance of getting it right so if you're trying
 often enough you'll get a couple of accounts and that
 apparently is exactly what happened here. Now they
 promised additional security measures here they don't
 really state exactly what they are but I could imagine some
 kind of global rate limits or such to essentially slow down
 brute forcing across multiple accounts coming from different
 IP addresses because that's sort of obviously a challenge
 when it comes to preventing these kind of brute force
 attacks. Maybe also limiting the number of attempts that
 they're allowing for a particular account within a
 particular time frame in order to further slow down the
 attack. As a user of these password managers the biggest
 problem here is that their economy really depends on
 cloud sync features and as long as they offer ways to
 synchronize devices via the cloud instead of some kind of
 private system. Well they will end up with having to defend
 authentication to these cloud APIs and that's not easy and
 that's just the latest example of a weakness in these
 defenses against these public APIs. Well and this is it for
 today so thanks for listening thanks for liking thanks for
 subscribing and yeah if you have any feedback please let
 me know and talk to you again tomorrow bye