Hackers exploit security testing apps to breach Fortune 500 firms

Threat actors are exploiting misconfigured web applications used for security training and internal penetration testing to gain unauthorized access to cloud environments. The targeted applications include DVWA, OWASP Juice Shop, Hackazon, and bWAPP. Attackers are leveraging these vulnerable training platforms to breach Fortune 500 companies and security vendors. The exploitation focuses on web applications that organizations use for internal security testing and training purposes. This represents a significant security risk as these tools, meant to improve security posture, are being weaponized against the organizations themselves.