Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT, which abuses SharePoint and Teams to steal credentials and move across networks.
Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT, which abuses SharePoint and Teams to steal credentials and move across networks.
Cybersecurity researchers have discovered a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, dubbed StubMaker, has been tracked by OpenSourceMalware and has been found to harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.
A single attacker has been scraping records from both Salesforce and ServiceNow customer portals across multiple industries for over a year.
SafePal, a hardware wallet maker, has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of approximately 39,798 customers.
Malicious actors are targeting open-source AI platform MLflow and web-based SCADA software FUXA with critical vulnerabilities.
Cybersecurity researchers have discovered a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, dubbed StubMaker, has been tracked by OpenSourceMalware and has been found to harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.
A single attacker has been scraping records from both Salesforce and ServiceNow customer portals across multiple industries for over a year.
SafePal, a hardware wallet maker, has disclosed an authorization flaw in an order-tracking plug-in that exposed the data of approximately 39,798 customers.
Malicious actors are targeting open-source AI platform MLflow and web-based SCADA software FUXA with critical vulnerabilities.
A ransomware affiliate, 'Ransom Busters', has been sending emails to victim organizations claiming to delete stolen data from ransomware groups' servers in exchange for a fee ranging from $20,000 to $60,000.
Researchers at Anthropic and EPFL have shown that AI agents can spread self-propagating payloads, dubbed 'mind viruses,' through persistent system prompt files. While no wild infections have been confirmed, the study highlights vulnerabilities in agent networks and varying susceptibility across models.
Varonis Threat Labs has disclosed three vulnerabilities in Microsoft Copilot Personal that could allow a single click on a crafted link to silently pull data from connected apps and other information available to the victim's Copilot session.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting Ray to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
GitLab has released security updates to address a critical vulnerability impacting its Community Edition (CE) and Enterprise Edition (EE) software.
Security researchers have discovered a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call.
MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access, and prompt injection, highlighting the need for robust security measures to protect sensitive data.
Kaspersky researchers have discovered new components in the Cavern command-and-control framework used by Iranian nation-state hackers, expanding its communication capabilities and allowing it to blend in with legitimate traffic.
New stories are published through the day as reporting is confirmed. The homepage lists the most recent items first.
Every story carries a named source attribution. Our methodology page sets out which document types we treat as primary and how we handle estimates.
Each story carries a named byline. Author pages collect everything that writer has filed for this site.
Corrections are logged on a dedicated page with a date and a plain description of what changed, rather than edited in silently.