Malicious X Ad and ConsentFix Attack Target Mac and Windows Users
Attackers are exploiting a verified X ad to deliver Mac malware and using a new ConsentFix technique to steal Microsoft 365 account tokens.
The Latest
Attackers Use Microsoft Teams Voice Calls to Deploy EtherRAT Malware
Attackers impersonate corporate IT support via Microsoft Teams voice calls to trick employees into installing the EtherRAT remote access trojan,…
New LONGLEASH Malware Expands Chinese APT’s Relay Network
Chinese APT group UAT-7810 deploys LONGLEASH, DOGLEASH, and JARLEASH malware to compromise networking devices and expand a relay network used…
Open Source Nebula Tool Brings AI Assistance to Penetration Testing Workflows
The Nebula platform integrates large language models directly into the penetration tester's command line interface, enabling automated vulnerability assessments and…
Dialogflow CX Flaw Enables Persistent Chatbot Injection Attacks
Researchers uncovered a Dialogflow CX vulnerability that lets attackers inject persistent malicious code, potentially exfiltrating conversations and enabling phishing campaigns.
Undocumented Backdoor Discovered in Tenda Router Firmware
CERT/CC warns that an unpatched backdoor in multiple Tenda router models grants full admin access without requiring a valid username.
Global IT Firm Accenture Reveals Data Theft After Cybercriminal Posts Stolen Code for Sale
The theft of source code and access credentials follows previous security incidents involving the same threat actor and the LockBit…
GitLost Attack Shows How GitHub Issues Can Leak Private Repositories Through AI Agents
A single GitHub Issue can force an AI agent to leak private repository data by exploiting a prompt injection flaw…
Anthropic Removes Hidden Data Marker from Claude Code After Researcher Discovery
An independent researcher discovered a function in Claude Code's JavaScript bundle that covertly encoded user time zone data, prompting Anthropic…
Windows 11 26H2 to Activate Enterprise Backup Setting by Default
Microsoft will enable its Windows settings backup tool by default on eligible enterprise devices starting with Windows 11 version 26H2,…
Device Code Flow Exploit Lets Attackers Hijack Microsoft Accounts via Real Login Page
Attackers are exploiting Microsoft's Device Authorization Grant feature to steal account tokens without using a fake login page, bypassing traditional phishing warnings.
QuimaRAT Cross-Platform Trojan Offers Extensive Modular Attack Toolset
The Java-based trojan uses a modular architecture with encrypted plugins that can be dynamically loaded and updated from its command-and-control…
PHP Runtime Flaws Open Door to Service Disruption Attacks
Two newly disclosed PHP vulnerabilities enable attackers to crash web services through TLS handling errors and memory corruption in the…
Coordinated Takedown Cuts NetNut Botnet Infrastructure
Law enforcement and industry partners seized domains and disabled backend infrastructure used by the NetNut residential proxy botnet, cutting off…
Spotlight
New Cavern Malware Framework Targets Israeli IT and Government Networks
Iranian state hackers are using a modular C2 framework called Cavern to infiltrate Israeli organizations through compromised IT supply chains.
RustDuck Botnet’s Rust Overhaul Targets Routers and Servers for DDoS Attacks
The RustDuck botnet uses a two-stage infection chain and sophisticated evasion techniques to hijack routers and servers for DDoS attacks, while its operators are actively rewriting the malware in Rust.
MCP Config File in Amazon Q Developer Opens Path to Credential Theft
A repository-carried config file in Amazon Q Developer could execute commands with a developer's live cloud session, but a patch now requires explicit user consent before MCP servers launch.
WhatsApp Username Feature Carries Privacy Risks Experts Warn
Consumer advocates warn that reusing Instagram or Facebook usernames on WhatsApp can link identities across Meta's platforms and increase social engineering risks.
Features
OpenSSH 10.4 Patches Memory Exhaustion and Host Key Flaw
The new release closes a remote memory exhaustion attack vector and adds experimental post quantum signature support while breaking some…
FIFA World Cup Phishing Chain Uses Auth Bypass and Geo Cloaking to Steal Card Data
Unit42 discovered a layered phishing chain that uses authentication passing emails and geo cloaked redirectors to steal personal and payment…
Pure Data Theft Extortion Costs US Government Entity $1 Million Payout
A small US county paid a $1 million ransom in Bitcoin to prevent the leak of stolen data, marking a…
Optimized Performance and Streamlined Tool Access Define New Parrot OS Release
The update shifts focus from expanding the toolset to refining system performance and usability for penetration testing workflows.
Fake Clipboard Manager Targets macOS Users with Stealthy Data Theft
PamStealer uses a Rust based binary and native macOS APIs to evade detection while stealing passwords, clipboard data, and browser…
Linux Kernel Bug Grants Root Privileges on Servers and Android Phones
The CVE-2026-46242 kernel flaw exploits a race condition and use-after-free in the epoll subsystem, affecting everything from cloud servers to…
