-
A coordinated supply-chain campaign that pushed 17 malicious packages across npm and PyPI, masquerading as SDKs for well-known payment services including PaySafe, Skrill and Neteller. The campaign’s packages 17 npm modules published with four rapid ver…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Threat actors are increasingly chaining classic phishing with collaboration platforms and covert tunneling to create highly believable intrusion paths. A recent multi-stage campaign attributed to UNC6692 exposes how adversaries combine email bombardmen…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A recent technical analysis of an Everest ransomware encryptor reveals a purpose-built, ConfuserEx-protected .NET 4.0 binary that combines heavy obfuscation, misleading cryptographic declarations, and uncommon network tactics to maximize impact and imp…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs. Chaining that capability to broad remote access achieved through a malicious MSI ins…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A previously unreported data extortion operation dubbed “Helix” that targets enterprises using identity-focused entry techniques and automated SharePoint exfiltration. The group’s playbook combines voice phishing (vishing), device-code phishing to capt…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Claude Desktop’s synced Personal Preferences feature can be exploited as a covert prompt-injection vector, transforming the AI assistant into a de facto command-and-control (C2) agent. This method allows for remote code execution on a compromised user …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
DuckDuckGo has quietly expanded its privacy-first browser capabilities by introducing a YouTube ad-blocking feature. This feature uses community-driven uBlock Origin filter lists to detect and remove video ads. From a security and privacy standpoint, t…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers can silently clone “Verified” GitHub commits by abusing signature malleability in Git’s commit-signing formats, creating byte‑different commits with identical content, valid signatures, and fresh “Verified” badges under new hashes. This break…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Nebula Security has revealed a significant exploit chain known as “IonStack,” demonstrating how attackers could gain full root access on Android 17 devices with just a single click on a malicious URL. This raises serious concerns about browser-to-kerne…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new intrusion campaign attributed to APT‑C‑20 (aka Fancy Bear, APT28) demonstrates the group’s continued refinement of stealthy, fileless techniques: weaponized Office documents that deploy a COM‑hijacking DLL. Extract shellcode hidden via LSB stegan…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
