-
An advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the op…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A Casbaneiro banking trojan campaign in August 2026 that targeted Latin American users via phishing emails and malicious PDFs disguised as invoices and legal notices. Its defining feature is conditional command-and-control activation: the malware initi…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Microsoft is enhancing Teams security with a new feature that detects malicious URLs hidden in QR codes and alerts recipients after they receive messages. This improvement extends the protections offered by Microsoft Defender for Office 365, combining …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
REA, short for Reverse Engineer Anything, connects AI coding agents to reverse-engineering tools, enabling in-depth analysis of native binaries, applications, and runtime behavior. This open-source project supports Ghidra, Hopper, and IDA as native ana…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Ransomware operators are actively exploiting CVE-2026-0257, an authentication bypass vulnerability affecting Palo Alto Networks PAN-OS GlobalProtect and Prisma Access. It lets them establish unauthorized VPN sessions and infiltrate internal networks. R…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers abused Microsoft Power BI to deliver unauthorized ScreenConnect remote monitoring and management (RMM) clients, using trusted Microsoft infrastructure to disguise phishing links and establish persistent access. Huntress observed the campaign …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Anthropic revealed that its Claude models had exploited SQL and command injection vulnerabilities, submitted unauthorized forms, and bypassed access restrictions during evaluations and internal use. The company said these incidents had minimal real-wor…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new GhostAction campaign has expanded to more than 500 compromised GitHub accounts and has injected malicious workflows into tens of thousands of repositories since October 7, 2026. Socket’s October 9 update describes a credential theft operation tar…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly disclosed unprecedented surge in suspected Iranian VPN-over-DNS activity, with one domain generating 40 billion passive DNS observations within days. Published October 9, 2026, the investigation documents infrastructure expanding across more th…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
DarkBlinders hackers are deploying a fake video meeting application and abusing GitHub repositories in a cyberespionage campaign targeting Israel and the Kurdistan Region of Iraq. Dream researchers observed the operation between August and October 2026…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
