Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Dux is an agentic exposure management startup that uses AI workers to analyze enterprise environments, identify exploitable attack paths, validate existing controls, and recommend lightweight mitigations to prevent vulnerability exploitation across assets.
YAK is a large-scale cybersecurity technology stack built around a domain-specific language. It spans compiler technology, security infrastructure, vulnerability analysis, and many other areas.
Infoblox research shows over 90% of parked domains now redirect visitors to scams, malware, or infostealers, up from less than 5% a decade ago. Malicious redirects target residential IPs, while VPN users see safe parking pages. One threat actor controls nearly 3,000 typosquatting domains targeting major sites such as Gmail, YouTube, Netflix, and government sites, hosting a mail server to capture misaddressed emails for business email attacks. Users should use bookmarks instead of typing to avoid typosquatting.
Cloudflare recorded unprecedented DDoS attacks in 2025, with hyper-volumetric assaults reaching 31.4 Tbps and 14 Bpps. During this period, global Internet traffic increased by 19%, and AI crawler activity surged, with Googlebot accounting for 4.5% of HTML requests and user action crawling rising over 15 times. Adoption of post-quantum encryption nearly doubled, covering 52% of human-generated web traffic. An email security analysis revealed 5.6% of messages as malicious, mainly due to deceptive links. 174 major Internet outages were documented, with nearly half caused by government-enforced shutdowns. Security professionals should closely watch the expanding capacity for hyper-volumetric DDoS attacks, adopt post-quantum cryptography as it becomes widely used, and enhance email security measures against sophisticated impersonation and brand deception attacks enabled by AI-generated content.
Microsoft acknowledges that December 2025 security updates have broken Microsoft Message Queuing on some older Windows 10 and Windows Server systems, causing inactive queues. The root cause is tightened NTFS permissions on the MSMQ storage folder, which now block required write access for MSMQ users. Only older, mostly enterprise systems are affected. There is no proper fix beyond workarounds or uninstalling the update.
TruffleHog's new JWT detector identifies public-key-signed tokens and verifies liveness through local claim validation and OIDC Discovery.
Kimwolf is a large DDoS botnet that hijacked around 1.8 million Android TVs, TV boxes, and tablets worldwide to flood targets with traffic.
Chinese-linked threat group Ink Dragon is compromising misconfigured IIS servers at government organizations in Europe, Asia, and South America to create a stealthy mesh relay network that obscures C2 traffic origins.
Sponsored
Martial artists don't flail wildly, and neither should your security team. With agentic AI, automation, and industry-leading log analytics, Sumo Logic helps SecOps and DevSecOps teams act with fluid agility.
PromptPwnd is a new vulnerability class that affects GitHub Actions and GitLab CI/CD pipelines that use AI agents like Gemini CLI, Claude Code, and OpenAI Codex. In this vulnerability, untrusted user input from issues, pull requests, or commit messages is injected into prompts, leading to the execution of privileged tools. The attack allows secret exfiltration by tricking AI agents into leaking GITHUB_TOKEN or cloud credentials through shell commands such as gh issue edit. Google's Gemini CLI repository was confirmed vulnerable before the patch. To mitigate this, organizations should restrict AI toolsets, avoid injecting untrusted input into prompts, treat AI output as untrusted code, and limit GitHub token permissions by IP.
The ShinyHunters extortion gang is extorting the adult video platform PornHub after stealing over 200M records of personal information in the Mixpanel breach. The breached data includes email address, activity type, location, video URL, video name, keywords associated with the video, and the time the event occurred. PornHub stated that they have not worked with Mixpanel since 2021, so the stolen records are historical analytics data from 2021 or earlier.
Japanese e-commerce and logistics firm Askul suffered a ransomware attack by the RansomHouse group, which exfiltrated data and encrypted its systems, severely disrupting ordering, shipping, and automated logistics operations. Attackers used the compromised credentials to delete backups and deploy file-encrypting malware, exposing over 700,000 records across customers, partners, employees, and executives.
The ShadyPanda campaign compromised popular Chrome and Edge extensions after seven years of building trust, affecting 4.3 million users, and installed full RCE frameworks that could steal session tokens and hijack SaaS accounts, bypassing MFA. The attack demonstrated that browser extensions represent a critical blind spot between endpoint and cloud security, with silent auto-updates enabling overnight weaponization. Organizations should implement extension allow lists, treat extension permissions as OAuth access grants, conduct regular permission audits, and monitor for behavioral changes that indicate compromise.
As AI coding agents become more common, security teams should understand what data these tools collect and where it goes. Chaser Systems created a test environment with seven coding agents, testing actions such as starting the agent, tab autocomplete, creating new features, committing and pushing to a git repository, running tests, and uploading data to 0x0.st. They also checked access to AWS credentials and files outside the project directory. The article describes the domains contacted, sample requests, and data transfer volumes during tests conducted with telemetry both disabled and enabled, including scenarios where telemetry is enabled, but FQDNs are blocked.
A critical flaw was found in the JumpCloud Remote Assist for Windows agent that lets any low-privileged user on a machine gain full SYSTEM-level control or crash the system entirely. The issue stems from the agent's uninstaller performing file creation, deletion, and execution in the user's %TEMP% directory, which an attacker can redirect using symbolic links and mount points to target protected system files. This enables both denial-of-service via driver corruption and full local privilege escalation through a race condition involving Windows Installer files, making rapid patching to version 0.317.0 or later essential for organizations using JumpCloud-managed Windows endpoints.
Sponsored
ICS phishing exploits the calendar integration capabilities of Microsoft 365 and Google Workspace to evade conventional email security. This upcoming Sublime webinar [13] explores the vulnerabilities that make ICS phishing possible and demonstrates how Sublime Security's email security platform automatically detects and
Theori's Xint Code, an AI-powered code analysis tool, discovered critical 0-day RCE vulnerabilities in Redis, PostgreSQL, and MariaDB with zero human intervention at ZeroDay Cloud, sweeping the database category and outperforming all human teams. The tool analyzes source code, configuration files, and binaries without packaging or harnessing requirements, producing actionable reports with dramatically fewer false positives than traditional static analysis while identifying vulnerabilities missed by humans for decades. Theori is seeking early partners to validate findings on real codebases before broader rollout.
sq is a CLI that provides jq-style access to structured data sources such as SQL databases or document formats like CSV or Excel.
Echo uses AI agents to create and maintain vulnerability-free Docker base images by stripping non-essential components, reducing attack surface, and continuously patching newly discovered flaws. These CVE-free images drop into existing workflows by changing a single Dockerfile line, instantly lowering container vulnerability counts.
A novel clickjacking technique leverages SVG filters applied to cross-origin iframes to read pixel colors, hide or manipulate UI elements, and execute logic gates for complex multi-step attacks without JavaScript. The technique enables data exfiltration through fake captchas, dynamic attack overlays that respond to iframe state changes, and even QR code generation to encode stolen data for mobile exfiltration. Security teams should note that traditional X-Frame-Options and CSP frame-ancestors remain the primary defenses, as this attack only works against frameable pages.
SoundCloud detected unauthorized access to an internal dashboard, triggering incident response and outside forensics support. Attackers accessed email addresses and public-profile data for roughly 20 percent of users, but no passwords or financial information. The company also faced web-only DDoS attacks, and later configuration changes accidentally disrupted some VPN users, sparking false rumors that SoundCloud was banning VPN access.
SantaStealer is a new malware-as-a-service info‑stealer advertised in Telegram channels and forums that can exfiltrate documents, credentials, crypto wallets, and other sensitive data from numerous applications. It uses a modular, multi-threaded design that runs mostly in memory. The software gathers data from browsers, messaging apps, and gaming platforms, zips everything, splits it into 10 MB chunks, and sends it over unencrypted HTTP to attacker-controlled servers.
Sponsored
Get Infosec IQ security awareness training for your organization and receive 3 complimentary Infosec Skills seats—giving your technical staff access to hands-on cyber ranges and labs. Limited time offer.
South Korean e-commerce giant Coupang's CEO resigned following a data breach that exposed 33.7 million customer accounts.
Amazon Threat Intelligence disrupted Russian GRU hackers (linked to Sandworm/APT44) who shifted from vulnerability exploitation to targeting misconfigured edge devices like routers and VPN gateways for credential theft against Western critical infrastructure.
Microsoft will block mobile devices running Exchange ActiveSync versions below 16.1 from connecting to Exchange Online starting March 1, 2026.
Sponsored
ThreatLocker's annual Zero Trust World [4] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
An unsecured 16TB MongoDB database was discovered on November 23. The database contained 4.3 billion professional records, including LinkedIn-like data such as names, emails, phone numbers, job roles, employers, work histories, and social media accounts. It was secured two days after discovery, but prior access remains unknown. This exposed data could facilitate large-scale AI-powered social engineering, phishing attacks, CEO fraud, and credential stuffing by enabling automated personalized messaging and profile enrichment when combined with other breach data. Security teams should urgently monitor threat intelligence, improve email security to prevent AI-driven phishing, and train users to recognize advanced social engineering that exploits professional profiles.
A campaign attributed to likely Eastern European threat actors is distributing PyStoreRAT malware through GitHub repositories disguised as OSINT tools, GPT wrappers, and DeFi bots, using artificially inflated star counts and social media promotion to build credibility. The modular JavaScript-based RAT executes via mshta.exe, scans for cryptocurrency wallets, evades detection by CrowdStrike and Cybereason, and delivers the Rhadamanthys infostealer as a secondary payload. Security teams should audit dependencies from trending GitHub repositories, monitor for scheduled tasks masquerading as NVIDIA updates, and deploy endpoint detection and response solutions capable of identifying mshta.exe activity and JavaScript-based payloads to strengthen defenses against PyStoreRAT.
A widely trusted Chrome and Edge extension, Urban VPN Proxy, was updated in 2025 to inject JavaScript that hooks network APIs, silently captures all AI chatbot prompts and responses, plus metadata, and then sends them to Urban VPN's analytics servers. The data is shared with parent company BIScience for commercial insights, despite “AI protection” marketing and a privacy policy that downplays risks. Security teams should review browser extension permissions, monitor network traffic for unusual API calls, and enforce policies restricting the installation of unverified extensions to prevent data exfiltration by malicious extensions such as Urban VPN Proxy.
Four new phishing-as-a-service kits have emerged: BlackForce ($200-300, MFA bypass via Man-in-the-Browser attacks), GhostFrame (iframe-based evasion with 1M+ attacks), InboxPrime AI ($1,000 perpetual license with AI-generated emails mimicking Gmail behavior), and Spiderman (targeting European banks via Signal with OTP/PhotoTAN interception). These kits feature anti-analysis techniques, real-time credential exfiltration to Telegram, and spintax-based email variation to bypass signature detection. Organizations should implement phishing-resistant MFA, such as FIDO2, and monitor for the emerging Salty-Tycoon hybrid, which combines multiple kit techniques to evade detection rules.
A new group is running a phishing campaign that impersonates payment confirmations to trick finance-related staff into opening a ZIP file containing a malicious ISO image. Once mounted and executed, the ISO drops a multi-stage payload chain that ultimately runs Phantom Stealer, which uses DLL injection, anti-analysis checks, and steganography to load and hide its code. The stealer targets browser credentials, cookies, credit cards, crypto wallets, Discord tokens, clipboard data, keystrokes, and selected files, then exfiltrates everything via Telegram bots, Discord webhooks, or FTP.
Chrome DevTools Protocol (CDP) allows tools to inspect, debug, instrument, and profile Chrome and other Chromium browsers. CDP provides a tempting target for C2 communication because the traffic can blend in with existing traffic and because browsers are usually already configured with appropriate proxy and firewall information. This post demonstrates a C2 implant that uses CDP to run in a headless browser and communicate with the C2 server via XHR requests driven by CDP JavaScript.
Sponsored
AI-powered attackers are already chaining recon, exploitation, and lateral movement autonomously, as shown in Anthropic's GTG-1002. Watch XBOW's Nico Waisman and Albert Ziegler break down offensive AI [11]—and how the same agentic technology behind the #1 HackerOne AI can defend you. Try XBOW Lightspeed by Dec 26 with a money-back
KustoHawk is an incident triage and response tool for Microsoft Defender XDR and Sentinel. It collects indicators of compromise and shows device or account activities. Using Graph API, it runs hunting queries in the Resources folder.
RegScale provides an AI-powered Continuous Controls Monitoring platform that automates governance, risk, and compliance processes, replacing manual, document-based workflows with real-time, integrated, “compliance as code” across highly regulated environments.
Pro-Russian hacktivist group CyberVolk's new VolkLocker ransomware-as-a-service contains a critical implementation flaw that hard-codes AES-256 master keys in binaries and writes them to a plaintext file in the %TEMP% folder, enabling free decryption without paying the ransom. The Golang-based malware targets Windows and Linux systems, featuring privilege escalation, VM detection, shadow copy deletion, and a 48-hour enforcement timer that wipes user folders if payment isn't made. Victims should check for the system_backup.key file in their Temp directory before considering a ransom payment, as this oversight renders the $800-$2,200 RaaS offering ineffective for attackers.
Jaguar Land Rover confirms that a cyberattack in August not only halted factory production, it also exposed payroll data for current and former staff, including bank details and tax information. The incident has driven reported sales losses of £1.5 billion, plus £196 million in related losses, and is estimated to have cost the broader UK economy up to £2.1 billion, with the Scattered Lapsus Hunters group blamed.
Nathan Austad, a 21-year-old from Minnesota known as “Snoopy,” admitted to helping run a credential stuffing scheme that compromised over 60,000 betting-site accounts, drained roughly $600,000 from about 1,600 victims, and sold access via online shops. He now faces up to five years in prison and is the third defendant tied to the DraftKings-related hacks.
Sponsored
Get Infosec IQ security awareness training for your organization and receive 3 complimentary Infosec Skills seats—giving your technical staff access to hands-on cyber ranges and labs. Limited time offer.
Have I Been Pwned has added 630 million passwords from FBI-seized devices, including 46 million previously unseen credentials originating from dark web marketplaces, Telegram channels, and infostealer malware, to its free password-checking service, which now handles over 18 billion monthly queries.
Google is shutting down its dark web reports feature, which notified people when their personal data appeared on criminal marketplaces.
Hamas-linked threat group Ashen Lepus (WIRTE) has expanded its espionage campaign to target diplomatic offices across the Middle East using new AshTag malware delivered via geopolitical-themed lure documents.
Sponsored
Between January and May 2025, Flashpoint analysts tracked over 2.6 million AI-related posts across dark web marketplaces, Telegram groups, and underground LLM communities.