Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
MI6 launched a dark web portal called Silent Courier to allow potential agents worldwide, particularly Russians, to securely share sensitive information about terrorism and hostile intelligence activities.
Steam removed the free-to-play game BlockBlasters after malware stole over $150,000 in cryptocurrency from players, including $32,000 from a Latvian streamer with stage 4 cancer raising funds.
Sponsored
Paying day rates for pen testing? You know it's a broken model.
Threat actors uploaded two malicious packages, sisaws and secmeasure, to PyPI that typosquat legitimate libraries and deliver the SilentSync RAT. This malware is downloaded from Pastebin and maintains persistence through registry keys, crontab modifications, or launch agents, depending on the operating system. SilentSync communicates with a hardcoded C2 server at 200.58.107[.]25 over HTTP and steals browser data, including credentials, history, autofill data, and cookies from Chrome, Brave, Edge, and Firefox while also enabling remote command execution and file exfiltration.
A security researcher explains how they discovered a macOS malware campaign spreading through SEO and GitHub links disguised as a legitimate app. The GitHub page appears legit, featuring a demo and an install command for Terminal. This command downloads malware and clears all xattrs. The page also hosts a dmg with an obfuscated osascript that executes a second script to remove quarantine and run stackprep.
Automaker Stellantis disclosed that a third-party service provider's platform that supports North American customers was breached. Stellantis stated that the exposed data included only basic contact information and not financial information.
Based on ZenSec's analysis of over 30 Akira ransomware incidents from 2023 to 2025, the group primarily exploits SSL VPN vulnerabilities (Cisco ASA, SonicWall, and WatchGuard) through missing MFA and unpatched CVEs, then leverages Veeam backup system vulnerabilities for privilege escalation and credential harvesting. Akira operates as a double-extortion group, stealing data via tools like WinSCP and Rclone (often within 3 hours), then encrypting systems at the hypervisor level while using AnyDesk for persistent access. The group targets backup infrastructure for destruction, publishes stolen data via Tor-based leak sites using torrent links, and demonstrates a playbook-driven approach similar to the defunct Conti ransomware operation.
Early profilers focused mainly on CPU and needed manually compiled binaries, which caused high performance overhead. Today, profiling has a lower impact and offers diverse signals that can be automatically collected continuously. OpenTelemetry introduced a new category for continuous profiling and considers adding it as a fourth pillar.
Automatically disabling compromised user accounts helps organizations reduce attack fallout. This tutorial demonstrates how to utilize GuardDuty for detecting suspicious activity, triggering an AWS Step Function to retrieve user information, and subsequently disabling the account in AWS Directory Service for Microsoft AD. The last step can also be done on a domain-joined EC2 instance if an organization doesn't use AWS Managed AD.
Sponsored
On-device AI has huge benefits, but it also creates new attack paths. Dell and Intel's new eBook [12] explains how to position your organization securely to take advantage of AI innovation at the endpoint - including risks to watch out for, attack countermeasures,
Microsoft no longer provides the vulnerable driver block list in a browsable web page, making it harder to access directly. Instead, the list is only available as a downloadable ZIP file, which complicates its use in SIEM products for lookups and other functions. This project automates the download, extraction, and parsing of the ZIP file, converting the data into CSV and JSON formats for seamless integration with SIEM and security tools.
Regal is a linter and language server for the Rego policy language.
Toolhive provides a method to quickly deploy MCP servers that run in isolated containers for added security.
Security researcher Dirk-jan Mollema found a critical flaw that combined undocumented "actor tokens" from Microsoft's legacy Access Control Service with a bug in the deprecated Azure AD Graph API. This flaw allowed complete takeover of any Microsoft Entra ID tenant with Global Admin rights. The attack exploited unsigned actor tokens that bypass security, generate no audit logs, and stay valid for 24 hours without revocation, letting attackers impersonate users. Microsoft patched the vulnerability CVE-2025-55241 within nine days of disclosure in July. The flaw highlights ongoing risks from legacy authentication systems lacking modern security controls.
The FBI warns that cybercriminals are creating fake versions of its Internet Crime Complaint Center (IC3) website to steal personal information from victims attempting to report cyber crimes. The spoofed sites use misspelled URLs, alternative domains, and poor graphics to trick users into entering sensitive data, including names, addresses, phone numbers, and banking information. Users should verify they're on the official IC3 site by ensuring the URL is exactly "www.ic3.gov" with HTTPS and avoid clicking on sponsored search results that may redirect to fraudulent sites.
AT&T's CISO states hackers use Salt Typhoon's tactics like targeting unprotected platforms, exploiting logging gaps, and using legitimate tools for "living off the land" attacks. The Chinese group's success has inspired threats to target weak spots beyond traditional security, with attackers chaining exploits due to stronger defenses, prompting innovation.
A teenage suspect linked to 2023 cyberattacks on MGM Resorts and Caesars surrendered to Las Vegas police, facing six felony charges, including extortion and identity theft.
Mozilla has introduced a new rollback feature that allows Firefox extension developers to revert to previously approved versions when critical bugs occur, with users automatically receiving the rolled-back version within 24 hours through Firefox's update mechanism.
Europol led an international operation across 18 countries using AI-driven forensic tools to analyze over 5,000 pieces of child exploitation material, resulting in the identification of 51 child victims and 60 suspects facing criminal proceedings.
Sponsored
The corporate firewall is a relic of bygone times. With employees working from coffee shops, airports, and home networks, traditional perimeter security leaves your endpoints exposed to unmanaged devices and compromised networks.
Fortra has patched a critical deserialization vulnerability (CVE-2025-10035) with a maximum CVSS score of 10.0 in the GoAnywhere Managed File Transfer software that allows attackers to execute arbitrary commands through the License Servlet. The company has urged customers to upgrade to version 7.8.4 or sustaining release 7.6.3 and recommends restricting public access to the GoAnywhere Admin Console to mitigate exploitation risks. This follows previous high-severity vulnerabilities in the same product, including an authentication bypass flaw (CVE-2024-0204) discovered in January 2024.
Trend Micro researchers have discovered a new phishing campaign that utilizes Lovable, Netlify, and Vercel to build and host vibe-coded phishing campaigns posing as CAPTCHA pages. The campaigns begin with an email carrying urgent messages such as “Password Reset Required,” which directs the user to a fake CAPTCHA. The fake CAPTCHA then redirects the user to the phishing page, which harvests their credentials. The CAPTCHA pages make the attacks seem more legitimate and filter out security tools.
The New York Blood Center (NYBCe) has confirmed that nearly 194K people had their data breached during an attack from January 20 to January 26. The breached data includes names, SSNs, driver's license, state ID numbers, bank account details, health information, and test results.
Organizations can prepare for quantum computing threats (Q-day) using post-quantum cryptography (PQC) deployed on existing hardware without needing expensive quantum technologies like quantum key distribution (QKD) or quantum random number generators (QRNG). Being “quantum ready” means systems remain secure after quantum computers can break conventional cryptography. Beware of vendor claims that quantum hardware products are necessary for quantum-resistant security. Organizations should prioritize implementing PQC algorithms on current infrastructure rather than investing in quantum hardware solutions that are neither necessary nor sufficient for protection against quantum adversaries.
AI bots can be problematic as they can use proprietary data to train models, cause performance degradation, or allow for unwanted agentic/automatic behavior. Some bots, such as Applebot, Amazonbot, and Googlebot, respect robots.txt and will obey directives that tell them not to train on a website's data. AWS WAF can offer rate-limiting rules, CAPTCHA, or honeypots for the Bot Control group to account for bots that don't respect robots.txt.
Although the eBPF Compiler Collection (BCC) can monitor bash commands, it compiles programs dynamically, so the complete Clang/LLVM toolchain must be shipped to every machine. eBPF CO-RE (Compile Once - Run Everywhere) can enable portability across different kernel versions without recompilation. This article walks through how to write an eBPF program to monitor the `readline` program to monitor bash commands.
Sponsored
Static threat feeds only skim the surface. While you're reading yesterday's news, threat actors are coordinating in closed Telegram groups and private forums that are rarely reached by threat intelligence vendors. Primary Source Collection [12] gets you inside those spaces - with real-time access to encrypted chats, invite-only communities, and adversarial planning. Read the Flashpoint whitepaper
ByteCaster is a new tool that aims to be a Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays in a single command. It supports three encryption algorithms, four encoding/obfuscation algorithms, and 14 output formats.
Troy Hunt has launched a new series of demos exploring different features of the Have I Been Pwned platform. The first demo covers domain searches.
SprearSpray is an advanced password spraying tool for Active Directory environments. It combines LDAP user enumeration with pattern-based password generation.
A cyberattack on Collins Aerospace's check-in and boarding systems disrupted operations at major European airports, including Heathrow, Brussels, and Berlin, forcing airports to rely on manual check-in procedures and causing flight delays and cancellations that continued into Sunday. Brussels Airport asked airlines to cancel half of their Sunday departing flights to mitigate disruptions. 29 total departures and arrivals were cancelled across the three main affected airports. The European Commission confirmed the incident is under investigation, though officials stated there's no evidence of a widespread or severe attack.
CloudSEK exposed a China-based operation called “ForgeCraft” that sold over 6,500 counterfeit US and Canadian driver's licenses and Social Security cards to more than 4,500 buyers, generating over $785,000 in revenue through 83 websites and using covert packaging methods to ship fake IDs hidden in everyday items. The sophisticated fake documents feature scannable barcodes, holograms, and UV markings and pose national security risks by enabling financial fraud, bypassing border checks, and potentially facilitating voter fraud. CloudSEK researchers identified the main operator's location in Xiamen, China, and shared evidence with authorities to disrupt the operation.
Sponsored
Join CTRL/ACT by Axonius - the 2-day virtual conference where you'll tackle fragmented environments, alert fatigue, AI noise, and rising
UK police arrested two teenagers, Thalha Jubair (19) and Owen Flowers (18), both members of the Scattered Spider hacking group, for their role in the August 2024 cyberattack on Transport for London that caused significant disruption and millions in losses to the UK's critical national infrastructure.
CISA has published an analysis of malware deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities.
Canadian authorities executed their largest cryptocurrency seizure in history, confiscating C$56 million ($40 million) from the unregistered TradeOgre exchange after a year-long investigation initiated by a Europol tip.
Sponsored
Hackers have exploited the same psychological blind spots since the early Internet days. Our brains are hardwired to fall for these scams - and your team is no exception.
SystemBC is a proxy botnet providing a highway for malicious traffic, with an average of 1,500 bots/day. It primarily recruits bots by compromising VPS systems with at least one vulnerability, making up over 80% of the bots. Some customers of SystemBC include REM Proxy, a Russian web-scraping service, and a Vietnamese-based proxy network.
Medical Associates of Brevard in Florida revealed that a data breach in January affected almost 247,000 patients and exposed sensitive health and personal data. The BianLian ransomware group claimed responsibility for stealing information like emails and HR documents, but it remains unclear how the stolen data has been used.
Venture firm Insight Partners suffered a ransomware attack that exposed data of over 12,000 staff and investors. The breach began in October 2024, leading to data encryption in January before being detected. The stolen data includes personal, banking, and tax details.
GitGuardian demonstrates how to automatically scan GitLab CI/CD pipeline logs for secrets using ggshield and their Bring Your Own Source initiative, addressing a critical but often overlooked attack vector where sensitive data like environment variables, API responses, and temporary credentials are exposed in build logs. The solution involves creating a custom Docker image with enhanced ggshield capabilities, configuring secure token storage via HashiCorp Vault, and implementing an automated scanning script that processes all pipeline job logs and creates incidents in the GitGuardian dashboard. This approach provides comprehensive secrets detection across the entire DevOps lifecycle, catching runtime secrets that traditional source code scanning misses while maintaining zero friction for developers.
AWS Bedrock AgentCore is a collection of tools that assist in deploying and scaling AI agents. AgentCore provides the ability to launch Code Interpreters, which run code in a sandboxed environment and can be customized to have access to AWS credentials to perform actions on AWS resources. Custom Code Interpreters cannot be protected with resource policies and only emit CloudTrail data events, presenting a tempting privilege escalation vector for attackers.
BitLocker is a full disk encryption feature for Windows that protects data at rest by encrypting full volumes. This post outlines a privilege escalation or lateral movement technique that uses Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker using remote manipulation of BitLocker registry keys to execute code under the user's context on a target host. The post also discusses detection opportunities for this attack and Sigma and Windows Defender for Endpoint queries to detect them.