Mozilla is warning of an ongoing phishing campaign targeting developers of Firefox add-ons. The browser maker urged devs to “exercise extreme caution and scrutiny” when reviewing seemingly legitim...
The LegalPwn technique works by hiding malicious code within fake legal disclaimers. According to the research, twelve major AI models were tested, and most were found to be susceptible to this for...
Executive Summary SentinelLABS and Beazley Security discovered and analyzed a rapidly evolving series of infostealer campaigns delivering the Python-based PXA Stealer. This discovery showcases a ...
Fingerprinting Malicious Infrastructure The art of fingerprinting adversary infrastructure involves identifying the attributes of an IP address and using them to build up a profile specific to the...
Executive Summary CYFIRMA Threat Intelligence has observed an ongoing malicious campaign leveraging the domain telegrampremium[.]app, which fraudulently mimics the official Telegram Premium platfo...
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2023-32256 undefined - undefinedR...
ChatGPT shared conversations are being indexed by major search engines, effectively turning private exchanges into publicly discoverable content accessible to millions of users worldwide. The issu...
Many hackers are opportunistic and often attempt to exploit security gaps to launch an attack days before a vulnerability is disclosed. According to a new report published on July 31 by GreyNoise,...
Ever look at a bit of Javascript sandboxing code and say to yourself “I know I can probably break out of that”? No? Just me? Must be a security researcher thing. As a hacker, one of the best place...
In late July 2025, Arctic Wolf observed an increase in ransomware activity targeting SonicWall firewall devices for initial access. In the intrusions reviewed, multiple pre-ransomware intrusions we...
A vulnerability that researchers call CurXecute is present in almost all versions of the AI-powered code editor Cursor and can be exploited to execute remote code with developer privileges. The se...
Cybersecurity researchers have flagged a malicious npm package that was generated using artificial intelligence (AI) and concealed a cryptocurrency wallet drainer. The package, @kodane/patch-manag...
NEW: CVE vendor-product description metric Referenceurl title GithubURL CVE-2013-10034 Kaseya - KServer ...
This research explores how large language models (LLMs) can complement, rather than replace, the efforts of malware analysts in the complex field of reverse engineering. LLMs may serve as powerful...
In July 2025, the eSentire Threat Response Unit (TRU) identified multiple sophisticated incidents believed to be attributed to the Interlock Group, a ransomware gang that has targeted organizations...
During a ransomware intrusion, we encountered a script that was filled with clear comments for what each command and function did. It was immediately, jarringly out of place, as at Huntress we typi...
Key Findings – Q2 2025 Ransomware Trends Ransomware-as-a-Service (RaaS) group disruptions: Several major ransomware groups have disappeared, leaving a fragmented ecosystem. Slight decline in public...
Overview Proofpoint has identified a cluster of activity using Microsoft OAuth application creation and redirects that lead to malicious URLs enabling credential phishing. The fake Microsoft 365 a...
Microsoft Threat Intelligence has uncovered a cyberespionage campaign by the Russian state actor we track as Secret Blizzard that has been targeting embassies located in Moscow using an adversary-i...
Introduction Over the last five years, the Democratic People’s Republic of Korea (DPRK) has transitioned from smash-and-grab cryptocurrency raids to a more covert, scalable model of economic warfar...