SANS Internet Stormcenter Daily Cyber Security Podcast (Stormcast) SANS Stormcast Wednesday, July 16th, 2025: ADS Keystroke Logger; Fake Homebrew; Broadcom Altiris RCE; Malicious Cursor AI Extensions
Jul 16, 2025
A newly discovered keystroke logger stores data in alternate data streams, raising concerns about data privacy. Mac users are under attack from a malicious version of Homebrew, advertised through Google ads. A critical remote code execution vulnerability has been found in Broadcom's Symantec systems, potentially exposing many to threats. Additionally, a developer's workstation was compromised by a malicious AI extension, leading to a staggering loss of $500,000 in cryptocurrency. Cybersecurity issues are evolving rapidly!
AI Snips
Chapters
Transcript
Episode notes
Keystroke Logger Uses ADS Stealth
- Keystroke logger stores data in alternate data streams (ADS) including clipboard content for stealthy data collection.
- Hidden file attributes can serve as suspicious indicators, aiding detection of malicious ADS usage.
Use PowerShell to Detect ADS
- Use PowerShell scripts to identify and extract alternate data streams for malware investigation.
- Inspect ADS on Windows systems to catch hidden or suspicious files potentially carrying malicious payloads.
Avoid Fake Homebrew via Ads
- Avoid installing Homebrew or any software directly from ads or unknown sources.
- Always verify the official website or repository to prevent malicious software installation risks.