Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
India's Department of Telecommunications directed messaging apps, including WhatsApp, Telegram, and Signal, to require account linking to an active SIM card and implement mandatory 6-hour web session logouts within 90 days to combat cross-border fraud, phishing, and "digital arrest" scams that exploit anonymous or migrated accounts.
Google's December 2025 Android Security Bulletin addressed 107 vulnerabilities, including two actively exploited high-severity framework flaws (CVE-2025-48633 and CVE-2025-48572) that enable local code execution via improper input validation on Android 13-16.
Japanese e-tailer Askul restored B2B online sales and warehouse systems after a ransomware attack in October disrupted ordering, shipping, and logistics for its brands and partners, forcing temporary reliance on fax-based ordering for critical customers.
Sponsored
Before the ransomware hits, and much before the breach makes headlines — there's usually an infostealer. These cheap, widely available tools have become the #1 driver of identity-based attacks [4]. They quietly harvest credentials that get sold, traded, and weaponized downstream.
ShadyPanda, a threat actor, compromised 4.3 million Chrome and Edge users through a seven-year campaign that published legitimate extensions, accumulated Featured and Verified status, and then weaponized them via malicious updates containing backdoors and spyware. The malware enabled complete browser surveillance, with remote code execution capabilities, hourly C2 communication to a server, arbitrary JavaScript execution with full browser API access, and real-time exfiltration of browsing data. ShadyPanda exploited the fundamental gap that allows marketplaces to review extensions only at submission, rather than monitor post-approval updates. Five extensions with over 4 million combined installs remain active on the Edge marketplace.
There is an ongoing phishing campaign that uses Calendly to impersonate popular brands to phish for business ad manager accounts. These accounts are tempting for threat actors as they can be used as a springboard to launch malvertising campaigns with advanced features like geo-targeting, domain filtering, and device-specific targeting. The victims receive a Calendly invite from the threat actor impersonating a recruiter with a fake meeting invitation, which directs the user to an Attacker-in-the-Middle phishing page that attempts to steal login credentials.
North Korea's Famous Chollima are running a campaign in which they attempt to lure developers into renting their identities for illicit fundraising. The attackers offer legitimate engineers a percentage of the salary for a remote job if they grant the threat actor remote access to their computer. In some cases, they act as a frontman for the agent in interviews.
Primitive Bear (Gamaredon), an FSB-attributed APT group, exploited CVE-2025-6218, a critical WinRAR path traversal vulnerability affecting versions through 7.11, in targeted spear-phishing campaigns against Ukrainian military units and government entities using military-themed lures. The attack chain leveraged malicious RAR archives containing HTA files with obfuscated VBScript, weaponizing a path traversal flaw to write payloads directly to Windows Startup folders, then used mshta.exe as a LOLBIN to fetch secondary-stage malware from a DynDNS-based C2 infrastructure across 14 active domains. The campaigns demonstrated sophisticated tradecraft, including minimal obfuscation, multi-stage payload delivery, phishing URL masquerading (president.gov.ua@malicious-domain), and infrastructure leveraging InterLIR IP marketplaces and No-IP dynamic DNS services. Defenders are recommended to update WinRAR to 7.12+, block HTA execution via AppLocker/WDAC, and monitor LOLBIN abuse and Startup folder modifications.
Managed external secrets is a new capability in AWS Secrets Manager that allows automatic rotation for participating third-party SaaS secrets without the overhead of rotation, Lambda function creation, or management. At present, the supported third-party vendors are Salesforce, BigID, and Snowflake. AWS has released a guide for becoming an integrated third-party vendor. The guide demonstrates how to create, manage, and view external secrets.
SCONE-bench, created by Anthropic researchers, contains 405 exploit-prone smart contracts. Claude Opus 4.5, Sonnet 4.5, and GPT-5 exploited 34 contracts worth $4.6 million. Sonnet 4.5 and GPT-5 found two new zero-day vulnerabilities in 2,849 new contracts, producing exploits worth $3,694 at an API cost of $3,476 for GPT-5. This shows that profitable autonomous exploitation is feasible with current models. Security teams should adopt AI agents for smart contract auditing before deployment, as the decreasing window for exploitation and dropping costs ($1.22 per run) give attackers advantages, while enabling proactive vulnerability detection and fixing.
Sponsored
SO-CON 2026 (April 13-18, 2026) [12] is where the community comes together to advance the practice of Attack Path Management. The week begins with a two-day main conference packed with talks, research, and community exchange, followed by four days of deep-dive, hands-on trainings led by adversary-experienced practitioners.
Telegram Cocoon is a TON blockchain-based decentralized AI compute network that connects GPU providers (compensated in toncoin tokens) with privacy-focused applications that require AI model execution. It is positioned as a confidential alternative to centralized cloud providers like Amazon and Microsoft. The network employs attested compute layers to process AI requests while settling payments on-chain. Security professionals should note ecosystem concerns, including hardware limitations restricted to specific Intel processors, potential scrutiny of the "100% confidentiality" claims, and the strategic implications of a central messaging platform controlling AI compute infrastructure that could process sensitive organizational workloads.
India's telecoms ministry has privately asked smartphone makers to preload all new devices with a state-owned cybersecurity app that cannot be deleted. Smartphone makers will have 90 days to ensure the government's Sanchar Saathi app is preinstalled on new devices and should push the app to existing devices in the supply chain via software updates. Apple is expected to push back on this requirement and may come to a compromise in which it agrees to nudge users to install the app.
vt-py is the official Python client library for VirusTotal. The library allows for interacting with the VirusTotal REST API v3.
Saporo provides a graph-native identity security platform that analyzes relationships, events, and misconfigurations across on‑prem, cloud, and machine identities to surface attack paths, reduce exposure, and harden access to critical assets before exploitation.
Glassworm malware returned for a third wave on OpenVSX and Microsoft Visual Studio marketplaces with 24 new packages impersonating popular developer tools. The supply chain attack evolved to use Rust-based implants alongside invisible Unicode character obfuscation, steals GitHub, npm, and OpenVSX credentials plus cryptocurrency wallet data from 49 extensions, deploys SOCKS proxies for traffic routing, and installs HVNC clients for stealthy remote access while manipulating download counts to boost search rankings. Development teams should immediately audit installed VS Code extensions against published IOC lists, verify publisher authenticity before installation, monitor for suspicious extension updates, and implement controls to detect invisible Unicode characters in code reviews to prevent credential theft and environment compromise.
A command-injection vulnerability in OpenAI's Codex CLI allows trusted local configuration files to execute attacker-controlled commands without user approval. By slipping malicious configs into a repository, an attacker could gain remote access, run arbitrary commands, steal secrets, and even poison supply chains via CI and build systems. OpenAI fixed the issue in Codex CLI version 0.23.0 after disclosure.
Sponsored
Unlock on-demand cybersecurity ranges and labs for your technical team with any new Infosec IQ security awareness training contract. Act
Australian hacker Michael Clapsis was sentenced to seven years and four months in prison for using a Wi‑Fi Pineapple to run evil twin attacks at major Australian airports and on domestic flights.
A typosquatted npm package, eslint-plugin-unicorn-ts-2, poses as a TypeScript ESLint plugin and runs a post-install script that steals environment variables and embeds a deceptive prompt apparently intended to confuse AI-based scanners.
Sponsored
Today's phishing attacks involve AI-generated voices, videos, and interactive deepfakes of company executives. They fool 99% of people.
Privilege escalation flaws have been discovered in AWS SageMaker. Attackers with specific permissions can inject malicious code via lifecycle configurations, mimicking EC2 user data escalation and affecting Lambda and CloudFormation. It is important to detect stop-modify-start sequences in CloudTrail and implement strict access controls.
South Korean e-commerce giant Coupang disclosed unauthorized access that affected 33.7 million customer accounts beginning June 24 through overseas servers, exposing names, email addresses, phone numbers, shipping addresses, and order histories. Authorities are investigating a suspected Chinese former employee. The government is examining potential personal information protection violations. This is the country's worst data breach in over a decade.
The popular open-source SmartTube YouTube client for Android TV, which provides ad blocking and runs well on low-powered devices, was compromised after an attacker gained access to the developer's signing keys. The compromise was detected when multiple users reported that Play Protect blocked SmartTube. The app developer confirmed that his digital keys were compromised and stated that he had revoked the old signature and would publish a new version with a separate app ID.
Threat actors can abuse Windows 11's Bind Link API through the bindflt.sys driver to redirect EDR installation folders to attacker-controlled directories, enabling DLL hijacking and code execution under EDR context. The EDR-Redir proof of concept uses LoadLibraryW to load bindfltapi.dll and CreateDirectoryW to create transparent folder mappings between virtual and backing paths. CrowdStrike, SentinelOne, and Carbon Black have implemented BindFlt monitoring, while Microsoft Defender for Endpoint remains vulnerable. Security teams should deploy Sysmon Event ID 7 monitoring for bindfltapi.dll image load events, validate whether legitimate bind link usage exists in their environment to reduce false positives, and investigate EDR vendor support for bindflt driver activity detection.
Microsoft Intune provides an endpoint management suite for Windows devices. Windows Autopatch is built into Intune and allows administrators to define groups to gradually roll out to an organization. Administrators can also configure hot patching on devices to expedite compliance.
Sponsored
ThreatLocker's annual Zero Trust World [13] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, become Cyber Hero certified, and attend sessions led by cybersecurity, IT, and business experts.
Guilty-As-Yara is a Rust-based tool that generates Windows PE executables containing data patterns designed to trigger YARA rule matches for validating rules.
r2frida is a radare2 plugin that bundles Frida to instrument and analyze local or remote processes via r2 commands and scripts.
Tomiris is a Kazakhstan-linked threat actor that leverages Telegram and Discord as command-and-control infrastructure while targeting foreign ministries and government entities across Russia and Central Asia through spear-phishing campaigns. The attack deploys multi-language malware, including Rust-based downloaders, Python-based backdoors like Distopia, and custom implants. Over 50% of lures use Russian-language content to blend malicious traffic with legitimate service activity. Security teams should monitor for unusual Telegram and Discord API traffic patterns, implement application control policies that restrict execution from archive files, and deploy behavioral detection to detect persistence mechanisms targeting Windows Registry modifications associated with these custom implant families.
AWS has added a new CLI command, `aws login`, which allows users to obtain short-lived credentials for AWS even if the account isn't configured with IAM Identity Center. AWS IAM Outbound Identity Federation now allows AWS users or services to request a short-lived JWT for external services that trust your AWS account, which can replace the use of hardcoded, long-term credentials or API keys in Lambda or EC2. AWS has also enabled Attribute-Based Access Control (ABAC) for S3, which allows users to define access permissions to S3 using tags instead of listing every bucket in an IAM policy.
Organizations that wish to start with purple teaming can begin by defining a purple team strategy with loosely scheduled sessions, referencing MITRE ATT&CK tactics in testing, and feeding early detection gaps into detection engineering. Teams can then introduce metrics as they mature, begin using more structured purple team exercises, and map red team TTPs more closely to MITRE ATT&CK tactics and threat intel. As teams further mature, they can introduce automated adversary emulation. Eventually, purple teaming can be driven by threat-intel, continuously run fully automated attack chains, and integrate machine learning, SOAR, and XDR to power rapid detection and response.
Sponsored
Unlock on-demand cybersecurity ranges and labs for your technical team with any new Infosec IQ security awareness training contract. Act
North Korean threat actors deployed 197 malicious npm packages downloaded over 31,000 times as part of the Contagious Interview campaign.
CloudSEK discovered over 2,000 interconnected fake shopping sites targeting Black Friday and Cyber Monday shoppers through coordinated phishing campaigns.
Europol and partner agencies have seized Cryptomixer, a widely used crypto-mixing service linked to cybercriminal activities such as drug trafficking, arms sales, ransomware, and card fraud.
Sponsored
In the age of AI and SaaS, IT and security leaders are confronting a new reality. Productivity and innovation are racing ahead, and legacy security tools are struggling to keep up.
Security researcher Luke Marshall examined all 5.6 million public GitLab Cloud repositories with TruffleHog and found 17,430 verified active secrets across 2,804 distinct domains. This exposure is nearly three times that found in a similar scan of Bitbucket. The leaked credentials included over 5,200 Google Cloud Platform keys, MongoDB credentials, Telegram bot tokens, and OpenAI keys. Some secrets date back to 2009 and are still valid today. Although many organizations revoked their credentials after receiving automated alerts—earning the researcher $9,000 in bug bounties—some secrets continue to be exposed on GitLab repositories.
South Korean crypto exchange Upbit suffered a $30 million breach on November 27 when attackers drained assets from a Solana hot wallet. North Korea's Lazarus Group is suspected of being the threat actor. Post-incident analysis revealed a critical vulnerability that allowed inference of a private key from publicly disclosed blockchain wallet transactions, though Upbit's CEO did not explicitly confirm that this flaw enabled the breach. The exchange has suspended deposits and withdrawals for a complete wallet system overhaul and will cover all customer losses using company assets. $1.5 million of the stolen funds have already been frozen.
A new Malware-as-a-Service called Albiriox has been observed providing customers with remote access to victim Android devices. Victims typically receive messages promising them discounts or prizes for an app. The links lead to fake versions of legitimate apps that request permissions to install applications, then fetch and install the malware. In addition to traditional infostealer capabilities, Albiriox includes a VNC module that streams the victim's device screen to the attacker.
Valkyrie Stealer is a C++ infostealer developed by threat actor "Lawxsz" that employs Themida protection, ChaCha20-encrypted payload with reflective DLL loading, and comprehensive anti-VM defenses. The malware targets Chromium browsers by extracting AES master keys and parsing SQLite databases using an embedded engine, steals Discord and Telegram sessions, harvests credentials from 20+ gaming platforms, and exfiltrates cryptocurrency wallets from MetaMask, Exodus, Atomic Wallet, and Electrum. Stolen data is compressed using dual-method ZIP packaging, encrypted with AES-GCM using hardcoded keys, and exfiltrated to C2 servers resolved dynamically via Steam profile scraping. The operator maintains active distribution channels on Telegram, GitHub, YouTube, Discord, and Signal under the Prysmax Software brand.
Cache poisoning is a web security vulnerability in which attackers trick caching systems, such as CDNs or proxies, into storing malicious responses, serving them to other users, and causing widespread harm. Early real-world examples from platforms such as HackerOne, GitHub, and Shopify show that unvalidated headers like X-Forwarded-Host or Content-Type can trigger global redirects, denial-of-service attacks, or stored XSS across multiple domains. These foundational cases, often yielding bounties of $2,500 to $6,300, highlight risks such as method overrides in cloud storage and social media amplification via Open Graph tags.
Sponsored
If engineer access to resources means passwords, vaults, or tickets, your PAM is slowing you down. Teleport [11] removes access blockers by replacing vaulted credentials and ticket queues with short-lived, cryptographic identity and ephemeral authorization. No more standing privileges, access friction, or credential handling. Try Teleport for