Cloud Imperium Games, the studio behind Star Citizen, disclosed a January 21 data breach over a month later, revealing that attackers gained unauthorized read-only access to backup systems containing usernames, contact details, dates of birth, and other personal information. The company downplayed the risk by noting no financial data or passwords were compromised, but security experts warn the exposed PII is sufficient to fuel targeted phishing campaigns. Players criticized the delayed, near-hidden disclosure, with the breach notice buried in a small pop-up rather than communicated directly via email.
A ransomware attack on August 31, 2025, compromised the data of 1.2 million at the University of Hawaiʻi Cancer Center, targeting research servers but sparing clinical operations. This affected 87,493 study participants' names, SSNs, health info from a 1993 cohort, plus 1.15 million others' names, driver's licenses, SSNs, and voter records.
France's health ministry has confirmed a data breach involving the exposure of administrative information for 15.8 million patients and sensitive doctors' notes for approximately 165,000 individuals. The breach is connected to Cegedim Sante software, which is used by around 1,500 practices. Reports indicate that data such as sexual orientation and AIDS status appeared online, prompting experts to warn of potentially irreparable damage to privacy.
A suspected DPRK-aligned campaign is targeting crypto professionals through fabricated VC firms (SolidBit Capital, MegaBit, and Lumax Capital) on LinkedIn, funneling victims to spoofed Zoom/Google Meet pages that deploy cross-platform ClickFix payloads via fake Cloudflare CAPTCHA. The attack chain uses clipboard poisoning to inject OS-specific commands, delivering fileless PowerShell loaders on Windows and multi-stage Python payloads on macOS, with fully undetectable Mach-O binaries evading all VirusTotal vendors. Crypto and Web3 professionals should treat unsolicited LinkedIn outreach with extreme caution, verify company domains via WHOIS, and never paste commands into a terminal as part of any "verification" process.
A coordinated phishing operation abuses Google Cloud Storage to host a redirector HTML file at storage.googleapis.com, allowing emails to sail through SPF/DKIM checks while pointing to seemingly trustworthy Google infrastructure. The operator reuses one GCS bucket but fans out across 25+ lures, ranging from “Cloud Storage Full” and fake AV expiry to retail rewards and health offers, all converging on credit-card-harvesting pages that present low “shipping” or “service” fees. Defenders should flag storage.googleapis.com links in email, scrutinize sender metadata, and report abusive buckets like “whilewait” to Google Cloud Abuse to collapse the campaign's shared infrastructure.
The Infoblox Threat Intel team detected a novel phishing campaign that abuses the .arpa domain using IPv6 reverse domains to bypass firewalls and other detections. The .arpa TLD is a special TLD that is primarily used to map IP addresses to domains and is unlikely to be blocked. The attackers were able to find DNS registrars that allowed them to create A records for these domains and used them in phishing campaigns that advertised free prizes.
Sponsored
The costs of cybercrime are expected to reach $12.2 trillion annually by 2031. The Huntress 2026 Threat Report breaks down the main profit centers: RMM abuse, malicious AI use, social engineering, ransomware, identity attacks, and more. Get the full report [10]. Just want the
mquire is an osquery-inspired memory forensics tool that enables SQL-based querying of Linux kernel memory snapshots without requiring external debug symbols. Written in Rust, it leverages embedded BTF and Kallsyms data to enumerate processes, open files, and network connections, and to extract cached files directly from memory dumps. Designed for incident response and malware analysis, it supports interactive shell, single-query, and custom command modes, including process tree visualization and file carving.
Nearby Glasses is a new Android app that continuously scans for Bluetooth signals from smart glasses made by Meta and Snap, alerting users when potentially always-recording wearable devices are detected nearby. The app matches manufacturer-specific Bluetooth company identifiers and supports custom IDs for detecting a broader range of surveillance wearables, though it may produce false positives from VR headsets. The tool addresses growing privacy concerns about covert recording devices, particularly following reports that Meta Ray-Ban smart glasses were used in immigration raids and harassment.
Fig Security traces data flows through security stacks, alerting teams to changes impacting detection or response. It back-traces detections, samples data pipelines, and simulates fixes via SIEM integrations.
Researchers reversed the Aeternum Loader malware, revealing its use of the Polygon blockchain for C2 communications via a hardcoded smart contract address, with AES-encrypted commands that can be decrypted using only the contract address as the key. The loader employs per-string XOR obfuscation, CRC32/DJB2 API hashing, NTFS ADS-based self-deletion, PPID spoofing to explorer.exe, and novel anti-VM checks including CPUID thermal/power MSR detection and SMBIOS BIOS characteristics bit counting. Notably, the blockchain C2 approach creates a permanent, immutable record of all attacker commands, giving defenders a historical audit trail once the encryption is broken.
A joint investigation by Svenska Dagbladet and Göteborgs-Posten revealed that data annotators at Meta subcontractor Sama in Nairobi routinely encounter intimate footage from Meta Ray-Ban smart glasses, including nudity, bank details, and sexual content from users who appear unaware they are being recorded. Network traffic analysis confirmed the glasses require constant communication with Meta servers to function, contradicting retailer claims that data stays local, while Meta's own terms permit both automated and human review of user interactions. Privacy lawyers and Sweden's data protection authority questioned the legality of transferring such sensitive data to Kenya, where no EU adequacy decision exists, raising significant GDPR compliance concerns.
Anthropic's Claude Code Security and OpenAI's Aardvark raise concerns about being slow, expensive, and noisy compared to established SAST tools, especially when the same AI both writes and reviews code. Experts argue these assistants should augment, not replace, existing pipelines, as AI-driven “vibe coding” accelerates insecure code and growing security debt. The real value lies in AI-enhanced remediation workflows and the potential revival of interactive, AI-powered code review.
Sponsored
Cobalt reviewed data from 16k+ pentests, and the results are as ugly as it gets. Only 21% of serious LLM vulnerabilities actually get
Huawei is marketing its modular AI datacenters globally, featuring homegrown Kunpeng CPUs and Ascend GPUs with a 4-to-6-month deployment promise, targeting nations outside Western security restrictions where Nvidia and AMD GPU supply remains scarce.
Drone strikes linked to Iranian retaliatory attacks hit three AWS data centers in the UAE and Bahrain, causing structural damage, power disruptions, and service outages in what experts called the first time major cloud infrastructure has been knocked offline by military action.
Phishing campaigns targeting European corporate networks exploit Windows File Explorer and WebDAV to deploy RATs via malicious shortcut files hosted on Cloudflare Tunnel domains.
Hacktivist group “Department of Peace” claims to have breached a DHS tech‑procurement office, leaking ICE contract records involving over 6,000 vendors, including major defense and surveillance firms. The data exposes contract values and detailed contact information, sharpening doxxing, targeting, and supply‑chain risks for companies embedded in the US immigration enforcement infrastructure.
Madison Square Garden has confirmed a data breach linked to the 2025 Oracle E-Business Suite campaign, in which Cl0p exploited vulnerabilities in a third-party-hosted instance. Over 210GB of personal information, including names and Social Security numbers, was stolen. Notifications are being sent to individuals affected by the breach.
Google's March 2026 Android security update patches 129 vulnerabilities, the highest monthly count since April 2018, including an actively exploited Qualcomm zero-day (CVE-2026-21385) affecting 234 chipsets. Google's Threat Analysis Group reported a high-severity memory-corruption flaw in an open-source Qualcomm display component in December, and fixes were made available to OEMs in January. Android device users should apply security updates as they become available from their device manufacturers.
Using passkeys' WebAuthn PRF (Pseudo-Random Function) extension to derive encryption keys for E2EE (End-to-End Encrypted) data dangerously couples data availability to authentication credentials, dramatically increasing the “blast radius” of routine credential loss or deletion. Common password-manager UIs don't clearly communicate that deleting a passkey may permanently orphan encrypted backups, so users can recover their account via other methods yet still be unable to decrypt or restore their data—effectively a self-inflicted, irreversible data-loss scenario. If you must use PRF, add prominent up-front warnings and support documentation, and push credential managers to show explicit deletion warnings for PRF-enabled passkeys.
A long‑standing TOCTOU flaw in Node.js ClientRequest.path allows attackers to bypass CRLF validation by mutating the path after construction but before _implicitHeader() serializes the request line, enabling header injection, body injection, and full HTTP request splitting across popular proxy and HTTP client libraries with roughly 160M+ weekly downloads. Tracing the original CVE‑2018‑12116 fix pinpoints the remaining design gap, demonstrates practical exploits against common proxy patterns, and contrasts vulnerable libraries with those whose architectures naturally close the window. Node.js considers this out of scope for its threat model, shifting responsibility to library authors and application developers, who are urged to re‑validate paths, avoid exposing raw ClientRequest objects before flushing, and audit code where user input flows into req.path or proxyReq.path during this critical window.
Kerberos TGT requests emit Windows Events with the Id 4768 and include a wealth of information about the request. The user can compare the request flags against those commonly set by tools such as Metasploit, those included in IoCs from malware campaigns, or those that differ from an established baseline to identify suspicious activity. This post includes a breakdown of the flags and a KQL query for hunting suspicious ones.
Sponsored
Writing code can be stressful—but not half as stressful as a surprise security meltdown. Inject optimism and calm into the developer scrum with Microsoft Azure [11]. Unified security across code and cloud environments and built-in DDoS protection mean you've got less cause for concern—and a clear mind for innovation. Help
AWS Security Hub Extended introduces a unified, full‑stack security plan that bundles AWS-native detections with curated partner tools across endpoints, identity, email, data, network, browser, cloud, AI, and SecOps. It standardizes findings via OCSF, centralizes them in Security Hub, and offers pay‑as‑you‑go procurement with AWS as seller of record.
Digibastion is an open-source Web3 security platform that centralizes threat intel, OpSec assessments, best-practice checklists, and tooling to help protect crypto users from phishing, scams, and technical risks.
Safety for Agents (Sage) is a lightweight agent detection and response layer for AI agents that guards commands, files, and web requests.
This is a technical primer on how elliptic curve cryptography works. ECC's security comes from the one-way nature of scalar multiplication, rather than from the hardness of the Elliptic Curve Discrete Logarithm Problem, while enabling much smaller keys than RSA for comparable security. The post walks through the mechanics behind point addition, finite-field arithmetic, ECDH, ECDSA, and ECIES, and highlights a key operational risk: reused ECDSA nonces can leak private keys. For security professionals, the actionable takeaway is to prefer well-vetted modern curves and implementations, ensure strong nonce handling and key generation, and remember ECC remains efficient and widely deployed today but is not post-quantum safe.
Multiple major Pakistani news channels, including Geo News, ARY News, and Samaa TV, had their satellite feeds hijacked on March 1 to display anti-military messages during peak Ramadan viewing hours. Attackers compromised the PakSat satellite beams and live feeds. The breach triggered retaliatory cyberattacks from a group called Pakistan Cyber Force against Indian media outlets. Authorities are investigating the coordinated incident, which also reportedly affected websites across 19 countries through unauthorized Google ad campaigns.
Researchers from StepSecurity have uncovered an automated hacking bot, dubbed “hackerbot-claw,” which claims to have scanned over 47k repositories for security vulnerabilities but has actually exploited vulnerabilities to compromise 6 popular open-source projects. The compromised projects include repositories from DataDog, Microsoft, and Aqua Security. Aqua Security renamed and made Trivy private after the bot fully compromised it.
Sponsored
Microsoft Azure autoscales when traffic spikes—adjusting capacity automatically so you can skip the scramble. With more global regions than any other cloud provider, you've always got room to grow. Scale
Chrome is rolling out Merkle Tree Certificates and a dedicated quantum‑resistant root store to make HTTPS post‑quantum safe without bloating TLS handshakes.
A serious vulnerability in the OpenClaw AI assistant enabled attackers to take control of agents through malicious websites by exploiting unsecured localhost WebSocket connections and unlimited password brute-force attempts, but it has been fixed in version 2026.2.25.
A Florida woman was sentenced to 22 months in prison and fined $50,000 for trafficking tens of thousands of stolen Microsoft COA labels, extracting product keys, and selling them in bulk to customers worldwide, in a scheme totaling over $5 million.
Sponsored
ClickFix, Fake CAPTCHA, and ScreenConnect misuse are familiar threats, but they're still getting results.
A 2025 e‑commerce breach at Canadian Tire exposed data from over 38 million accounts, including names, contact details, hashed passwords, and partial card numbers, with under 150,000 records containing full dates of birth. Financial systems and in‑store transactions were reportedly unaffected, but 42 million records were added to Have I Been Pwned.
DIY marketplace ManoMano is notifying about 38 million affected customers after unauthorized access at a subcontracted customer service provider handling Zendesk-based interactions. Threat actor “Indra” claims to have compromised data for 37.8 million accounts, including names, emails, phone numbers, and support communications.
ShinyHunters is dumping Odido customer records in daily batches, exposing sensitive identifiers, bank details, and support notes, and threatening to escalate the leaks after already impacting more than a million accounts. Dutch police publicly support Odido's stance of refusing ransom payments and emphasize the need for rapid law enforcement engagement and anti‑phishing vigilance.
AmberWolf disclosed an RCE vulnerability in Delinea's Secret Server Protocol Handler (≤6.0.3.39) and Connection Manager (≤2.7.1) where improper sanitisation of the sslauncher:// URL handler's generic process launcher allowed a malicious server to supply attacker-controlled process names and arguments via encrypted launcher data, achieving arbitrary code execution on both Windows and macOS when a victim visits a crafted webpage and accepts a security prompt. The exploit, implementable as a NachoVPN plugin, abuses the legitimate key exchange flow to inject serialized launcher configurations that RDPWin.exe blindly executes via Process.Start(). Delinea patched the protocol handler as of January 17. Organizations should upgrade immediately and monitor for anomalous child processes spawned by RDPWin.exe.
Twitch's iOS app uses server-side Eppo SDK keys instead of client tokens, exposing over 260 unobfuscated production feature flags via a CDN endpoint that can be freely polled once a key is observed in traffic. The flags reveal Twitch's near-term roadmap. Hardcoded IDs, internal codenames, and future launches like “Elevate Prime 2026” are visible, turning feature flags into a live intelligence feed on product, security posture, and internal economics.
Many security products in Windows 10 and 11 use kernel Event Tracing for Windows (ETW) hooks to monitor process creation and be notified of potentially malicious activity. An attacker can bypass these checks by exploiting a race condition between the kernel's completion of the executive process object setup and the invocation of process-creation callbacks. Attackers can also use legacy APIs for process creation, which do not trigger process-creation callbacks.
MacNoise is a modular macOS telemetry-generation framework designed to help security teams validate EDR, SIEM, and firewall detection coverage by producing real system events across the network, process, file, TCC, and persistence categories. The tool includes MITRE ATT&CK-mapped modules, pre-built APT emulation scenarios, and OCSF 1.7.0-compliant audit logging for structured correlation. Scenarios can be dry-run previewed, chained via YAML, and output as JSONL for automated detection gap analysis.
Rustdesk is an open-source remote desktop application designed for self-hosting. An alternative to TeamViewer, it works out of the box with no configuration required. You have full control over your data, with no security concerns.
ksentinel is a Linux kernel module that monitors syscall table integrity, function prologues, and LSTAR MSR values using FNV-1a hashing to detect unauthorized modifications from rootkits such as PUMAKIT, Diamorphine, and KoviD. It covers 500+ syscall wrappers, plus critical VFS, networking, credential, and tracing functions, with anti-unload protection via a compile-time-generated unlock key. The module supports Linux versions 5.4 to 6.12+ on x86_64 and ARM64. It features configurable check intervals and a management script for live monitoring and violation alerts.
Researchers reported flaws in Gardyn Home and Studio, which exposed roughly 138,000 indoor smart gardens to unauthenticated, internet‑reachable remote compromise, including OS command execution via command injection and hardcoded admin credentials in the Gardyn IoT Hub and Azure IoT infrastructure. Thankfully, patches are out and auto‑delivered.