Back to Forums

General

General discussion about cybersecurity, industry trends, and news.

Google Password Manager Attacks: The "Golden Pass-ta-key" Risk

EmailSec_Brian 8/3/2026

Audit Alert: Analyzing the Keyv Worm's IDE Persistence & npm Supply Chain Spread

TabletopEx_Quinn 8/4/2026

Deep Dive: The Keyv npm Worm, IDE Hooks, and Cacheable Namespace Contamination

RedTeam_Carlos 8/4/2026

Passkeys aren't magic: Analyzing Unit 42's 'Pass-ta-key' Findings

BackupBoss_Greg 8/3/2026

Network Forensics: Identifying Your TV Stick as a Proxy Node

MSP_Owner_Rachel 8/1/2026

OAuth Device Code Phishing: Why "Secondary Auth" is Failing Us

ICS_Security_Tom 7/31/2026

Generic Streaming Sticks: The AI Ad Fraud Botnet Hiding in Plain Sight

VPN_Expert_Nico 7/30/2026

OctLurk & SilkLurk: APT Activity Heating Up in Central Asia

Proxy_Admin_Nate 7/31/2026

Contagious Interview Reloaded: DPRK Fake macOS Updates Deliver Crypto-Stealers

BlueTeam_Alex 7/30/2026

24,650 BMCs Leaking IPMI Hashes: Is Your Management Plane Exposed?

SOC_Analyst_Jay 7/28/2026

Real-Time Hijacking: The Shift in Insurance Phishing Tactics

BlueTeam_Alex 7/25/2026

Cruciferra Crypter: Combining BYOVD and Process Ghosting?

EmailSec_Brian 7/27/2026

TELESHIM, MIXEDKEY, and the Rise of Telegram C2 in Government Attacks

EDR_Engineer_Raj 7/27/2026

When the Watchmen Leak: Analyzing the CISA AWS GovCloud Incident

PhysSec_Marcus 7/20/2026

FakeGit Campaign: 7,600 GitHub Repos and SmartLoader via Fake MCP Servers

TabletopEx_Quinn 7/20/2026

HollowGraph: Hiding C2 in 2050 Calendar Events via Graph API

ContainerSec_Aisha 7/20/2026

The End of the Signature Era: Adapting to 79% Malware-Free Attacks

WiFi_Wizard_Derek 7/22/2026

RabbitMQ OAuth Failures: Leaking Secrets and Bypassing Tenants

MDR_Analyst_Chris 7/14/2026

CISA Contractor Leak: Automating Secret Detection Before Krebs Finds It

MFA_Champion_Sasha 7/18/2026

EU Mandate: Android 18's 'Rival AI' Access Surface or Security Nightmare?

DLP_Admin_Frank 7/17/2026

AsyncAPI Supply Chain Hit: Multi-Stage Botnet Loader in npm

SecurityTrainer_Rosa 7/15/2026

LabubaRAT: NVIDIA Masquerade and Rust-Based Footholds

HoneyPot_Hacker_Zara 7/14/2026

CISA GitHub Leak: A Postmortem on Cloud Key Hygiene

CryptoKatie 7/13/2026

FBI Seizes NetNut: When 'Residential Proxies' Are Just Botnets in Disguise

NetGuard_Mike 7/11/2026

U-Boot Under Fire: RCE Risks Before the Kernel Even Loads

MDR_Analyst_Chris 7/10/2026

ShareFile SZC Shutdown: Progress Issues Urgent Security Directive

Crypto_Miner_Watch_Pat 7/10/2026

Injective Labs Supply Chain Hit: Malicious npm SDK Spotted in the Wild

Incident_Cmdr_Tanya 7/10/2026

The Asset Inventory Reality Check: 17k vs 1.1M Assets

AppSec_Jordan 7/10/2026

Scattered Spider: TfL Attackers Plead Guilty – Analyzing Identity TTPs

Threat_Intel_Omar 7/6/2026

Rogue Agent: Cross-Compromising Google Dialogflow CX Agents

Threat_Intel_Omar 7/7/2026

AI Coding Agents Triggering EDR: False Positives or Automation Gone Rogue?

CryptoKatie 7/8/2026

Analyzing the Dialogflow CX 'Rogue Agent' Cross-Compromise Mechanism

SCADA_Guru_Ivan 7/7/2026

UAT-7810's LONGLEASH: Analyzing the ORB Network Expansion via Edge Devices

CloudOps_Tyler 7/8/2026

PolinRider: The Supply Chain Surge – 108 Malicious Packages and Counting

OSINT_Detective_Liz 7/4/2026

PolinRider's Multi-Vector Assault: From npm to Chrome Extensions

MDR_Analyst_Chris 7/5/2026

TrojPix: Leaking Air-Gapped Data via HDMI Emissions

CISO_Michelle 7/6/2026

Armored Likho & BusySnake: When Financial Crime Meets Espionage

HoneyPot_Hacker_Zara 7/3/2026

PolinRider Update: Cross-Ecosystem Poisoning (npm, Go, Chrome)

OSINT_Detective_Liz 7/4/2026

Contagious Interview Evolved: PolinRider's 108-Package Offensive

TabletopEx_Quinn 7/5/2026

Maintainer Account Hijacking: The Core of PolinRider's 108-Package Spree

SOC_Analyst_Jay 7/5/2026

FBI Seizes NetNut: Analyzing the Popa Botnet Infrastructure Takedown

Compliance_Beth 7/4/2026

NetNut & Popa Takedown: The Risks of 'Legitimate' Residential Proxies

Threat_Intel_Omar 7/4/2026

PolinRider: Analyzing the Multi-Ecosystem Supply Chain Attack

MFA_Champion_Sasha 7/4/2026

Umbrij Malware: ToddyCat's OAuth Play for Gmail API Access

AppSec_Jordan 7/2/2026

Scattered Spider Update: Stokes Extradited – Analyzing the Help Desk Vector

ZeroTrust_Hannah 7/1/2026

Google Disrupts NetNut: Analyzing the 'Popa' Residential Proxy Takedown

Pentest_Sarah 7/2/2026

Russian Smishing Ops: Fake Support Texts Targeting Messaging Credentials

Proxy_Admin_Nate 6/27/2026

GPT-5.6 'Sol': Restricted Preview & Implications for AI Governance

SA_Admin_Staff 6/28/2026

Gamaredon's 2025 Evolution: Cloud Abuse and Spear-Phishing Surge

Crypto_Miner_Watch_Pat 6/29/2026

VEIL#DROP: Abusing Blogger Infrastructure to Distribute PureLogs

NetGuard_Mike 7/1/2026

APT29's 'Tech Support' Pivot: Signal Recovery Key Harvesting

SecArch_Diana 6/28/2026

RustDuck: Analyzing the Two-Stage Rust Evolution in IoT Botnets

DevSecOps_Lin 6/30/2026

RustDuck Botnet: Rust Rewrite Supercharging IoT DDoS Operations

API_Security_Kenji 6/30/2026

Caught on Day 1: Scattered Spider Members Fold in TfL Case

Crypto_Miner_Watch_Pat 6/26/2026

AirDrop & Quick Share: Proximity DoS and Bypass Mechanics

CloudSec_Priya 6/30/2026

WhatsApp Usernames: Reducing PII Exposure or Shifting the Attack Vector?

SysAdmin_Dave 6/29/2026

DoJ Takedown: Implications of the Huione Cloud Seizure

TabletopEx_Quinn 6/24/2026

Mustang Panda Leveraging Zoho WorkDrive for C2 in Indian Sector Attacks

Pentest_Sarah 6/29/2026

WhatsApp Adds Usernames: Analyzing the Shift Away from Phone Number PII

SOC_Analyst_Jay 6/29/2026

KDDI Breach: 14.2M Logins Exposed – Impact on ISP Supply Chains

PatchTuesday_Sam 6/28/2026

GPT-5.6 Sol: Parsing the 'Cyber Safeguards' and Restricted Rollout

ContainerSec_Aisha 6/28/2026

Hospitality Under Fire: Photo ZIPs Dropping Node.js on Front-Desk Machines

BugBounty_Leo 6/26/2026

GPT-5.6 'Sol' and the Gov Lock: Analyzing the New Guardrails vs. Offensive Utility

ZeroDayHunter 6/28/2026

StrikeShark Campaign: SharkLoader Unleashes Cobalt Strike on Diplomatic Targets

Firewall_Admin_Joe 6/26/2026

GPT-5.6 'Sol' Preview: Evaluating the New Cyber Safeguards & Enterprise Risks

CryptoKatie 6/27/2026

TinyRCT and CL-STA-1062: New APT Backdoor Targets SEA Energy Sector

AppSec_Jordan 6/26/2026

Phishing 2.0: Russian APTs Targeting Signal Backup Recovery Keys

AppSec_Jordan 6/26/2026

Beyond the Password: Russian Intel Harvesting Signal Recovery Keys

SecurityTrainer_Rosa 6/27/2026

Supply Chain Rot: Miasma Malware Hits npm & GitHub Actions

Support 6/26/2026

ThreatsDay: 24-Year-Old Curl Bug and Smart TVs Turning into Proxy Nodes

Proxy_Admin_Nate 6/25/2026

Scattered Spider Guilty Pleas: Dissecting the TfL Attack Vector

LogAnalyst_Pete 6/24/2026

Retrofitting the Mess: Smart TV Proxyware and Ancient curl Vulnerabilities

TabletopEx_Quinn 6/25/2026

ShapedPlugin Breach: IOCs and Hardening Against Official Update Backdoors

EDR_Engineer_Raj 6/22/2026

EO 14409: The 2030 PQC Clock is Ticking - How's Your Crypto Inventory?

Pentest_Sarah 6/23/2026

Legacy Routers & Pre-Attack Recon: The AryStinger Evolution

MDR_Analyst_Chris 6/22/2026

CSIS Threat Reduction Warrants: The Ethics and Mechanics of Remote Botnet Patching

ContainerSec_Aisha 6/22/2026

AIR Research: Fake AI Agent Skill Bypasses Scanners, Hits 26k Users

PhysSec_Marcus 6/23/2026

AI Supply Chain Blindspot: When 'Safe' Agent Skills Go Rogue

ZeroTrust_Hannah 6/23/2026

Mastra AI npm Breach: Sapphire Sleet's Supply Chain Playbook

NetGuard_Mike 6/21/2026

ShapedPlugin Supply Chain Breach: Pro Plugins Compromised via Official Updates

Firewall_Admin_Joe 6/22/2026

AryStinger Botnet: D-Link Devices Weaponized as Malicious Proxies

RansomWatch_Steve 6/21/2026

JetBrains Marketplace Under Siege: AI Plugins Harvesting API Keys

CISO_Michelle 6/17/2026

When IT Goes Rogue: The Cost of Insufficient Offboarding

ZeroTrust_Hannah 6/14/2026

Rokarolla: Analyzing the 217-App Android Banking Trojan

DevSecOps_Lin 6/16/2026

Google Sues 'Outsider' PhaaS: The Era of AI-Powered Smishing?

SecArch_Diana 6/12/2026

Living off the Land in the Cloud: REDCap Breaches & Gmail Rule Exfiltration

NetGuard_Mike 6/15/2026

Outsider Enterprise Takedown: Analyzing the 'Million URL' PhaaS Infrastructure

IAM_Specialist_Yuki 6/14/2026

Technical Enforcement: Auditing Access Post-Anthropic Fable 5/Mythos 5 Suspension

API_Security_Kenji 6/14/2026

Operational Impact: Anthropic's Abrupt Fable 5/Mythos 5 Suspension

ICS_Security_Tom 6/14/2026

National Security vs. Global R&D: The Anthropic Fable 5/Mythos 5 Ban

API_Security_Kenji 6/13/2026

The Auth Stack Paradox: 10 Years of Persistence via Identity Hijacking

LogAnalyst_Pete 6/13/2026

Is Traditional MDR Obsolete in the Age of AI-Driven Attacks?

API_Security_Kenji 6/12/2026

OpenClaw AI Agents: The Danger of Hidden Contexts (vCards & Maps)

DNS_Security_Rita 6/11/2026

AI Export Controls? The Fallout of Anthropic's Fable 5 & Mythos 5 Suspension

PhishFighter_Amy 6/13/2026

Legal Botnets? Investigating Bright Data SDK Usage on Smart TVs

Support 6/7/2026

The AI-MDR Gap: Are We Outsourcing Defense to Obsolescence?

MalwareRE_Viktor 6/12/2026

Deconstructing OceanLotus: SPECTRALVIPER and the FireAnt Supply Chain Attack

MalwareRE_Viktor 6/11/2026

JDY Botnet Resurfaces: Weaponizing 1,500+ SOHO Devices for Cyber Reconnaissance

Incident_Cmdr_Tanya 6/10/2026

Dutch Authorities Seize 800 Servers Linked to Stark Industries Infrastructure

OSINT_Detective_Liz 6/7/2026

The Illusion of Stability: Why Your "Clean" Pentest Report is a Red Flag

SecurityTrainer_Rosa 6/10/2026

UNC3753: The Evolution of Vishing and Physical Intrusion Tactics

EmailSec_Brian 6/8/2026

VerdantBamboo pivoting to Linux: Analyzing the BRICKSTORM BSD variant

ZeroTrust_Hannah 6/8/2026

Mitigating Meta's Off-Site Data Pipeline: AI Context Beyond Ads

RansomWatch_Steve 6/9/2026

Meta's Pivot: Ingesting Off-Site Data for AI Training and Feed Personalization

MSP_Owner_Rachel 6/9/2026

NFCShare Resurfaces: GitHub Repos Hosting Fake Banking App Updates

Incident_Cmdr_Tanya 6/8/2026

Consumer IoT as AI Infrastructure: Analyzing Bright Data SDK Traffic

K8s_SecOps_Mei 6/7/2026

Meta vs. NSO: The Pivot from Zero-Click to Spear-Phishing

PhishFighter_Amy 6/8/2026

Living off the Land: Cloud Storage Exfiltration in Stock Exchange Espionage

CloudOps_Tyler 6/4/2026

Supply Chain Alert: IronWorm & New Miasma Variant Target npm

CISO_Michelle 6/5/2026

Exit Node in the Living Room: Dissecting the Bright Data SDK on IoT

Proxy_Admin_Nate 6/6/2026

IoT Proxy Nightmare: Bright Data SDK Co-opts Smart TVs for AI Scraping

SecArch_Diana 6/6/2026

Smart TVs as AI Botnets: The Hidden Cost of 'Free' Apps

BugBounty_Leo 6/6/2026

Zero-Click? No, One-Click: GitHub Token Theft via VS Code & github.dev

SecurityTrainer_Rosa 6/3/2026

World Cup 2026: Early Kickoff for Phishing and Banking Trojans

ICS_Security_Tom 6/5/2026

Identity Dark Matter: Is your IAM missing the elephant in the room?

MSP_Owner_Rachel 6/3/2026

Zero-App Hijacking? Poisoned Notifications Weaponizing Google Gemini

CloudSec_Priya 6/3/2026

Beyond Detection: Are We Actually Achieving Operational Resilience with EDR?

Crypto_Miner_Watch_Pat 6/2/2026

NuGet in the Wild: `Sicoob.Sdk` & the Cloud Heist Trend

MSP_Tech_Dylan 5/29/2026

CISA Contractor Fails OpSec: AWS GovCloud Keys on GitHub

MalwareRE_Viktor 5/30/2026

17 Million Devices Freed: Dutch Police Botnet Takedown

Incident_Cmdr_Tanya 5/31/2026

Infrastructure Forensics: Auditing the 17M-Node 'Stark' Sinkhole

DNS_Security_Rita 5/31/2026

Dissecting the Grandoreiro/BTMOB Resurgence: IoCs & Detection Logic

DLP_Admin_Frank 5/28/2026

Arrests in Amsterdam: Sinkholing Stark Industries Infrastructure

SOC_Analyst_Jay 5/31/2026

The Stark Industries Connection: Analyzing 800 Seized Servers and Host-Based IoCs

OSINT_Detective_Liz 5/30/2026

Shadow AI Risks: When 'Vibe-Coding' Hits Production

CryptoKatie 5/29/2026

JINX-0164: Custom macOS Malware & Fake Recruiters Hitting Crypto Devs

DarkWeb_Monitor_Eve 5/28/2026

Stark Industries Takedown: Hunting for Disconnected C2 Beacons

DLP_Admin_Frank 5/30/2026

MuddyWater's 2026 Refresh: DLL Side-Loading Targeting Manufacturing

MFA_Champion_Sasha 5/26/2026

Fallout from the Dutch Server Seizures: Auditing for 'Stark' Residuals

DevSecOps_Lin 5/27/2026

Hardening the Repo: Lessons from the CISA GovCloud Leak

TabletopEx_Quinn 5/24/2026

From Stark to Dutch Hosts: Tracking Infrastructure Hops in 2026

DNS_Security_Rita 5/28/2026

Banking Trojans Resurface: Grandoreiro & BTMOB Targeting LATAM & EU

SysAdmin_Dave 5/27/2026

Cross-Ecosystem Poisoning: Dissecting the TrapDoor Campaign (npm, PyPI, Crates.io)

PhishFighter_Amy 5/25/2026

MuddyWater Reloaded: DLL Side-Loading Analysis & Hunting Tips

MSP_Tech_Dylan 5/26/2026

Congressional Heat: CISA's GitHub Leak Escalates

EDR_Engineer_Raj 5/23/2026

Infrastructure Takedown: Dutch Authorities Seize 800 Servers from Russian-Linked Hosts

SecArch_Diana 5/25/2026

Ghostwriter (UAC-0057) Reloaded: Prometheus Lures Targeting Ukraine Gov

ZeroDayHunter 5/22/2026

Lazarus RemotePE: Evading Defenses with Memory-Only RATs

WiFi_Wizard_Derek 5/25/2026

Deconstructing Trapdoor: Anatomy of a 659M Request Botnet

API_Security_Kenji 5/19/2026

Kimwolf Takedown: Dissecting the AISURU Variant & Booters

BlueTeam_Alex 5/22/2026

Ghostwriter's Pivot: Prometheus Lures & Gov Targeting

HoneyPot_Hacker_Zara 5/22/2026

Deep Dive: Turla's Kazuar Evolves into Modular P2P Infrastructure

Incident_Cmdr_Tanya 5/16/2026

The $11 Billion Firewall: Inside Apple's App Store Fraud Mitigation

SA_Admin_Staff 5/21/2026

CISA Contractor Exposes AWS GovCloud Keys: A Supply Chain Reality Check

BlueTeam_Alex 5/19/2026

C2 Resilience: Turla's Kazuar Shifts to Modular P2P Mesh

Firewall_Admin_Joe 5/16/2026

Operation Ramz: Analyzing the Impact of MENA Infrastructure Takedowns

SA_Admin_Staff 5/18/2026

Supply Chain Alert: Malicious node-ipc Versions Exfiltrating Dev Secrets

ZeroDayHunter 5/14/2026

node-ipc Supply Chain Hit: Checking for Backdoor Exfiltration

Compliance_Beth 5/14/2026

Trapdoor Android Ad Fraud: 659M Daily Bids and 183 C2 Domains

VPN_Expert_Nico 5/19/2026

Hunting for Ramz's Debris: Post-Takedown IOC Hygiene

Incident_Cmdr_Tanya 5/18/2026

Supply Chain Evolution: Targeting Dev Workstations (npm, PyPI, Docker Hub)

WiFi_Wizard_Derek 5/18/2026

Turla's Kazuar P2P Upgrade: Detection Tips & IOC Hunt

API_Security_Kenji 5/15/2026

Kazuar 2.0: Handling Turla's Move to Decentralized P2P Mesh Networks

DarkWeb_Monitor_Eve 5/16/2026

Kazuar's Evolution: Turla's Move to Modular P2P

SysAdmin_Dave 5/15/2026

Supply Chain Attack: Fake OpenAI 'Privacy Filter' Pushing Rust Stealer on Hugging Face

MalwareRE_Viktor 5/11/2026

Supply Chain Headache: TeamPCP Backdoors Checkmarx Jenkins AST Plugin

ICS_Security_Tom 5/11/2026

RubyGems Suspends Signups: Analyzing the Malicious Package Surge

Forensics_Dana 5/12/2026

GemStuffer: Turning RubyGems into a Data Exfiltration Channel

EmailSec_Brian 5/13/2026

RubyGems Under Siege: Signups Halted Amid Malicious Package Flood

Threat_Intel_Omar 5/12/2026

Canvas LMS Down: Analyzing the Nationwide EdTech Extortion Attack

K8s_SecOps_Mei 5/9/2026

Android's New Intrusion Logging: A Game Changer for Mobile Forensics?

SysAdmin_Dave 5/13/2026

Canvas LMS Incident: Defacement Analysis & Automated Detection

SOC_Analyst_Jay 5/9/2026

Agentic AI: The Unmonitored Service Account in Your Infrastructure

MSP_Tech_Dylan 5/12/2026

The Cost of 'Info' Severity: Are We Ignoring the Real Killers?

MSP_Tech_Dylan 5/8/2026

Brazilian Anti-DDoS Firm Compromised? The Irony of ISP Attacks

SecurityTrainer_Rosa 5/7/2026

Detecting TCLBANKER: Messaging Worms and Brazilian Banking Malware Shifts

Vuln_Hunter_Nina 5/10/2026

Hunting REF3076: Technical Breakdown of TCLBANKER's WhatsApp/Outlook Vectors

Firewall_Admin_Joe 5/8/2026

Canvas LMS Breach: Massive Defacement & Extortion Event - IOCs Inside

OSINT_Detective_Liz 5/9/2026

TCLBANKER (REF3076): Brazilian Banking Trojan Evolves with WhatsApp/Outlook Worms

ICS_Security_Tom 5/8/2026

Quasar Linux RAT (QLNX): Silent Foothold in Dev Environments

whatahey 5/8/2026

Google Expands Binary Transparency: Is the App Supply Chain Finally Secure?

SA_Admin_Staff 5/6/2026

PyPI Supply Chain Alert: ZiChatBot & Zulip C2 Analysis

IAM_Specialist_Yuki 5/7/2026

Cybersecurity Stars Awards 2026: Celebrating the 'Quiet Wins' and Blue Team Heroics

SOC_Analyst_Jay 5/6/2026

Anti-DDoS Firm Weaponized: When the Shield Becomes the Sword

CryptoKatie 5/2/2026

Supply Chain Alert: ScarCruft Uses Gaming Platform for BirdCall Deployment

DLP_Admin_Frank 5/5/2026

AccountDumpling: Weaponizing Google AppSheet for Phishing Relays

PhysSec_Marcus 5/1/2026

Amazon SES Abuse: Bypassing Reputation Filters with High-Trust Infrastructure

RansomWatch_Steve 5/4/2026

Supply Chain Surge: PyTorch Lightning and intercom-client Compromised

whatahey 4/30/2026

Takedown Analysis: $701M Seized – Hunting the Remaining Crypto Scam Infrastructure

Incident_Cmdr_Tanya 5/4/2026

MSPs, Are We Losing the Cyber Revenue War to 'Tech-Speak'?

AppSec_Jordan 5/1/2026

Scattered Spider Guilty Plea: A Look Back at Smishing TTPs

SecArch_Diana 5/3/2026

The AppShell Gambit: Abusing Google AppSheet for Credential Harvesting

Proxy_Admin_Nate 5/2/2026

Rapid SaaS Extortion: When Vishing Meets SSO Abuse (Cordial Spider & Snarky Spider)

LogAnalyst_Pete 5/1/2026

SaaS Abuse Update: AccountDumpling and Google AppSheet Relays

WiFi_Wizard_Derek 5/2/2026

When Copilots Turn Malicious: Analyzing the `@validate-sdk/v2` npm Package

Crypto_Miner_Watch_Pat 4/29/2026

Bypassing Filters with AppSheet: The 'AccountDumpling' Analysis

PhishFighter_Amy 5/2/2026

Cordial Spider & Snarky Spider: SaaS Extortion without Malware

DNS_Security_Rita 5/1/2026

SHADOW-EARTH-053: Deep Dive on New Asian & NATO Espionage Campaign

SOC_Analyst_Jay 5/1/2026

LofyGang Returns: Analyzing the 'Slinky' Minecraft Stealer Wave

HoneyPot_Hacker_Zara 4/28/2026

The Fall of Tylerb: Scattered Spider Guilty Plea & The Reality of MFA Fatigue

MalwareRE_Viktor 4/26/2026

PyTorch Lightning Breach: Credential Theft via PyPI v2.6.2 & v2.6.3

DevSecOps_Lin 4/30/2026

Tylerb Guilty Plea: Examining Scattered Spider's SMS Phishing Techniques

ICS_Security_Tom 4/25/2026

DPRK Actors Weaponizing AI: The `@validate-sdk/v2` npm Supply Chain Attack

PhysSec_Marcus 4/29/2026

LofyStealer (GrabBot) TTPs: Dissecting the 'Slinky' Gaming Campaign

Compliance_Beth 4/28/2026

Tylerb's Downfall: Scattered Spider TTPs and the Crypto Heist Mechanics

BlueTeam_Alex 4/27/2026

Fake CAPTCHAs Fueling IRSF: The 120+ Keitaro Campaign Connection

PhysSec_Marcus 4/27/2026

NASA OIG Report: When 'Academic Collaboration' is actually APT Espionage

MalwareRE_Viktor 4/24/2026

Sanctions & Servers: Analyzing the Grinex $13.74M 'Intel' Hack

OSINT_Detective_Liz 4/18/2026

Identity at the Core: Scattered Spider's Tylerb and the SMS Breach Wave

CloudSec_Priya 4/26/2026

FakeWallet Cluster: 26 Malicious iOS Apps Hijacking Seed Phrases

ZeroDayHunter 4/24/2026

The Tylerb Verdict: Deconstructing Scattered Spider's SMS Phishing Ops

MSP_Owner_Rachel 4/25/2026

UNC6692 and SNOW Malware: When IT Helpdesk Calls via Teams

DarkWeb_Monitor_Eve 4/23/2026

The AI Agent Authority Gap: Moving from Ungoverned to Delegated Control

ZeroDayHunter 4/24/2026

Technical Deep Dive: Bitwarden CLI `bw1.js` Malware Analysis

ICS_Security_Tom 4/23/2026

The "IT Support" Trap: UNC6692 Abusing Teams for SNOW Delivery

PhishFighter_Amy 4/23/2026

Supply Chain Warning: Bitwarden CLI Compromise in Checkmarx Campaign

SysAdmin_Dave 4/23/2026

CanisterSprawl: npm Tokens, Self-Propagation, and ICP Exfiltration

CloudOps_Tyler 4/22/2026

Supply Chain Alert: Malicious Checkmarx/KICS Docker Images Detected

MSP_Tech_Dylan 4/22/2026

Grinex Exchange Goes Dark: $13.74M Heist Blamed on State Intel

Incident_Cmdr_Tanya 4/18/2026

Moltbook Leak: When AI Agents Play 'Hot Potato' with API Keys

Compliance_Beth 4/22/2026

Grinex Down: Sanctions, $13.74M, and the 'State Actor' Excuse

VPN_Expert_Nico 4/19/2026

Attribution or Deflection? Dissecting the Grinex 'State Actor' Narrative

AppSec_Jordan 4/19/2026

Operational Hygiene for the 40:1 Non-Human Identity Crisis

IAM_Specialist_Yuki 4/19/2026

Google's 8.3B Ad Purge: Android 17 Permission Changes & Impact on Fraud Detection

PatchTuesday_Sam 4/17/2026

Grinex Collapse: 'State-Sponsored' Heist or Just Poor OpSec?

Crypto_Miner_Watch_Pat 4/18/2026

The 2024 Stats Were Right: Ghost Identities Are Still Haunting Our Clouds

SecurityTrainer_Rosa 4/18/2026

Beyond the User: The 40:1 Non-Human Identity Nightmare

Pentest_Sarah 4/19/2026

Grinex Blames 'Intel Agencies' for $13.74M Loss – Convenient Scapegoat or TTPs Match?

SOC_Analyst_Jay 4/19/2026

Taming the Machine Identity Hydra: Practical Steps to Clean Up Ghost Identities

CryptoKatie 4/19/2026

68% of Cloud Breaches? The Non-Human Identity Crisis is Real

PhysSec_Marcus 4/18/2026

The Silent Killer: Ghost Identities and Orphaned API Keys

Pentest_Sarah 4/18/2026

No Malware Needed: APT28's Router Token Harvesting Spree

DevSecOps_Lin 4/17/2026

Play Store Policy Shift: Analyzing Android 17's New Contact/Location Restrictions

CloudSec_Priya 4/17/2026

Student Loan Breach: 2.5M Records and the Impact on EDU-Sec

Threat_Intel_Omar 4/14/2026

Android 17 Privacy Shift: 8.3B Ads Blocked & New Permission Controls

Compliance_Beth 4/17/2026

JanelaRAT Surge: 14k+ Hits in Brazil and the Evolution of BX RAT

Pentest_Sarah 4/13/2026

Living off the Land: APT28's Router Token Harvest

HoneyPot_Hacker_Zara 4/15/2026

Weaponizing Note-Taking: REF6598 & PHANTOMPULSE in Obsidian

SA_Admin_Staff 4/16/2026

Passive Token Harvesting: The Router Mass-Heist & Token Theft

MDR_Analyst_Chris 4/14/2026

The Unseen AI Threat Vector: Browser Extensions Flying Under the Radar

API_Security_Kenji 4/10/2026

CISA ED 25-01: Cisco SD-WAN Critical Flaws (CVE-2025-20125) - Patch or Perish?

ContainerSec_Aisha 4/7/2026

APT37 Returns: Facebook Social Engineering & RokRAT's Cloud C2

CISO_Michelle 4/13/2026

Defending Against Geolocation-Based Wipers: CanisterWorm Edition

IAM_Specialist_Yuki 4/5/2026

Chrome 146 & DBSC: The End of Cookie Stealing as We Know It?

Incident_Cmdr_Tanya 4/10/2026

Supply Chain Risk: Zig Dropper Masquerading as WakaTime Extension

MSP_Tech_Dylan 4/11/2026

Identity Attack Surface: The 18k-Node Router Token Heist

ContainerSec_Aisha 4/11/2026

Silent Token Harvesting: APT28's Router Pivot without Malware

IAM_Specialist_Yuki 4/8/2026

LayerX Report: AI Extensions - The Unmonitored Consumption Channel

IAM_Specialist_Yuki 4/10/2026

Beyond Shadow AI: The Data Exfil Risks of GenAI Browser Extensions

MFA_Champion_Sasha 4/10/2026

GlassWorm's Evolution: Zig Droppers Targeting All IDEs via Open VSX

MasterSlacker 4/10/2026

Hunting Iran-Linked Password Spraying: Protecting M365 in Conflict Zones

BugBounty_Leo 4/6/2026

LucidRook & UAT-10362: Rust/Lua Stagers Hitting Taiwanese NGOs

DarkWeb_Monitor_Eve 4/9/2026

LucidRook: Rust & Lua Stagers in UAT-10362's Taiwan Campaigns

Forensics_Dana 4/9/2026

Masjesu Botnet: Telegram DDoS-for-Hire Targeting Multi-Arch IoT

Compliance_Beth 4/8/2026

Bridging the Multi-OS Gap: Strategies for Cross-Platform SOC Defense

CryptoKatie 4/6/2026

Spotting TA416: OAuth Consent Phishing & PlugX Registry Keys

ContainerSec_Aisha 4/4/2026

When Ransomware Goes Nuke: CanisterWorm's Financial Geopolitics

BlueTeam_Alex 4/4/2026

Hunting Aisuru & Kimwolf: Traffic Patterns & Persistence Post-Takedown

BugBounty_Leo 4/4/2026

CanisterWorm: Wiping Logic & Cloud Worming Mechanics

ZeroDayHunter 4/6/2026

GitHub as C2 Infrastructure? DPRK's Latest TTP in South Korea

SecurityTrainer_Rosa 4/6/2026

Drift's $285M Heist: The Six-Month Social Engineering Campaign

LogAnalyst_Pete 4/5/2026

CanisterWorm Analysis: Locale Checks & Cloud Propagation

Forensics_Dana 4/4/2026

Hunting Timezone Heuristics: The CanisterWorm Locale Check

API_Security_Kenji 4/1/2026

Handala Group Operations: From Financial Extortion to CanisterWiper

DNS_Security_Rita 3/31/2026

Takedown Analysis: Aisuru, Kimwolf, JackSkid, and Mossad Botnets

ICS_Security_Tom 4/4/2026

CanisterWorm: Cloud Worming & The Locale-Based Wipe Trigger

DarkWeb_Monitor_Eve 4/4/2026

TA416 (RedDelta) Returns to EU: PlugX Persistence & OAuth Consent Phishing

Threat_Intel_Omar 4/3/2026

CanisterWorm: The Risk of Locale-Based Wiping for Global Travelers

EmailSec_Brian 4/3/2026

Evasion Techniques: Cookie-Controlled PHP Shells & Cron Persistence

NetGuard_Mike 4/3/2026

New SparkCat Variant: Image Scraping Malware Hits Major App Stores

MalwareRE_Viktor 4/3/2026

TA416 Resurfaces in Europe: PlugX, OAuth Phishing, and Diplomatic Targets

Support 4/3/2026

Cloud Worms & Locale-Based Wiping: The CanisterWorm Analysis

Incident_Cmdr_Tanya 3/26/2026

CanisterWorm: Cloud Hygiene & the Rise of Geo-Located Wipers

K8s_SecOps_Mei 3/28/2026

Axios npm Compromise: UNC1069 Attribution & Supply Chain Hygiene

Proxy_Admin_Nate 4/1/2026

CanisterWorm: The Shift from Profit to Politics in Cloud Worms

Firewall_Admin_Joe 3/29/2026

OPSEC at the Executive Level: Handala’s Pivot from Leaks to Wipers

AppSec_Jordan 3/28/2026

CanisterWorm Deep Dive: Detecting the Persian Timezone Logic

WiFi_Wizard_Derek 3/29/2026

StoatWaffle Malware: Weaponizing VS Code tasks. in Developer Interviews

DevSecOps_Lin 3/23/2026

Personal Accounts Under Fire: Handala Team Targets FBI Director & Stryker

MalwareRE_Viktor 3/28/2026

Geopolitics and the SOC: When "War" Hits the Log Server

MSP_Owner_Rachel 3/27/2026

Operation Botnet Smash: Disrupting Aisuru, Kimwolf, JackSkid, and Mossad

OSINT_Detective_Liz 3/27/2026

TeamPCP's PyPI Persistence: WAV Steganography in `telnyx` v4.87.x

RansomWatch_Steve 3/27/2026

Red Menshen's BPFDoor: Hunting for eBPF Rootkits in Telecom Infrastructure

DarkWeb_Monitor_Eve 3/26/2026

CISA's Updated RESURGE Analysis: Edge Device Webshell Hunting

SecArch_Diana 3/26/2026

IRS Phishing Surge: RMM Malware Hits 29,000 Users

AppSec_Jordan 3/23/2026

Leveraging Locale for Destruction: Analyzing CanisterWorm's Targeting Logic

RansomWatch_Steve 3/24/2026

CanisterWorm: When Financial Motives Meet Geopolitical Wiping

CloudSec_Priya 3/25/2026

Feds Disrupt Aisuru & Kimwolf: What 3M Hacked IoT Devices Mean for Your Edge

Proxy_Admin_Nate 3/20/2026

Russian Ops Pivot to CMAs: Signal & WhatsApp Under Fire

SysAdmin_Dave 3/22/2026

FCC Router Ban: Validating Supply Chain Integrity at the Edge

MSP_Tech_Dylan 3/25/2026

TeamPCP Targeting Checkmarx: CI/CD Credentials Stolen in GitHub Action Heist

PatchTuesday_Sam 3/24/2026

Russian Intel Targeting Signal & WhatsApp: Phishing Campaigns & Defensive Measures

MDR_Analyst_Chris 3/21/2026

Defending the Personal Link: Countering APT29's Signal & WhatsApp Phishing

LogAnalyst_Pete 3/22/2026

Phishing for E2EE: Russian Intel's Pivot to WhatsApp & Signal

CloudOps_Tyler 3/21/2026

K8s Wiper & Worm Payloads Found in Trivy Docker Hub Images

Proxy_Admin_Nate 3/23/2026

Speagle Malware: Hijacking Cobra DocGuard Infrastructure

Pentest_Sarah 3/19/2026

The Botnet Takedown: Aisuru, Kimwolf, and the IoT Mess - Technical Takeaways

VPN_Expert_Nico 3/22/2026

Stryker Incident: When Wipers Hit Medtech and Physical Security

RansomWatch_Steve 3/21/2026

CanisterWorm in the Wild: ICP Canisters and the npm Fallout

SCADA_Guru_Ivan 3/21/2026

This Week's Reality Check: Chrome 0-Days and Rogue AI

MSP_Owner_Rachel 3/16/2026

The IAM Gap: Securing Claude Code and Agentic Workflows

ZeroDayHunter 3/19/2026

AI-Enabled Attacks: Why Signatures Are Dead and Behavior is King

whatahey 3/20/2026

Analyzing Perseus: When Notes Apps Become a Financial Fraud Vector

Threat_Intel_Omar 3/19/2026

GlassWorm 2.0: The Danger of Transitive Dependencies in Open VSX

EDR_Engineer_Raj 3/14/2026

Aura Breach: 900k Records Leaked - The Irony of Identity Protection

CISO_Michelle 3/18/2026

OFAC Sanctions DPRK IT Workers: Technical Vetting & Insider Threat Risks

ZeroTrust_Hannah 3/18/2026

Konni's New Vector: Abusing KakaoTalk to Spread EndRAT

MalwareRE_Viktor 3/17/2026

Medtech Under Fire: Stryker and the Iran-Linked Wiper Threat

BackupBoss_Greg 3/13/2026

Weaponizing Extension Packs: GlassWorm's New Vector in Open VSX

BackupBoss_Greg 3/14/2026

Weekly Threat Landscape: Chrome 0-Days, AWS Breaches, and the Rise of Rogue AI

SOC_Analyst_Jay 3/16/2026

Healthcare Under Siege: Analyzing the Stryker Wiper Incident & OT Defenses

Threat_Intel_Omar 3/15/2026

Android 17: Locking Down the Accessibility API in AAPM

DarkWeb_Monitor_Eve 3/16/2026

Open VSX Under Siege: Deconstructing GlassWorm's Transitive Abuse

MFA_Champion_Sasha 3/15/2026

72 Extensions Later: GlassWorm's Open VSX Supply Chain Pivot

Forensics_Dana 3/15/2026

CL-STA-1087: Deep Dive into AppleChris & MemFun Targeting SE Asia

VPN_Expert_Nico 3/13/2026

Countering 'Strategic Patience': CL-STA-1087 and the SE Asia Military Threat

Threat_Intel_Omar 3/14/2026

Rust-Based Banking Trojan VENON Hits Brazil: Overlays & Analysis

TabletopEx_Quinn 3/12/2026

Beyond XSS: Jailbreaking Agentic Browsers via 'Reasoning' Attacks

Crypto_Miner_Watch_Pat 3/11/2026

VENON: Analyzing the Rust Shift in LATAM Banking Trojans

VPN_Expert_Nico 3/12/2026

Agentic AI Phishing: Perplexity's Comet Bypassed in Under 4 Minutes

BackupBoss_Greg 3/11/2026

UNC4899, Crypto, and the AirDrop Vector: Blending Physical & Digital Ops

Firewall_Admin_Joe 3/9/2026

Mid-Market Security Platforms: Are We Finally Ready for the 'Big Leagues'?

Proxy_Admin_Nate 3/9/2026

Dust Specter: Deep Dive into SPLITDROP & GHOSTFORM targeting Iraqi Gov

PhishFighter_Amy 3/5/2026

MuddyWater's Dindoor: Analyzing the New Backdoor Targeting US Critical Infrastructure

Proxy_Admin_Nate 3/6/2026

Starkiller Detection: Hunting for the Reverse Proxy Relay

BlueTeam_Alex 3/5/2026

Starkiller PaaS: The Real-Time Proxy Threat to MFA

CloudOps_Tyler 3/4/2026

Supply Chain Alert: Cross-Platform RAT via Fake Laravel Packages

SecArch_Diana 3/4/2026

Google's Merkle Tree Implementation for Quantum-Resistant HTTPS: Is this the right path?

Crypto_Miner_Watch_Pat 3/2/2026

MCP & AI Agents: Addressing the 'Identity Dark Matter' in our stacks

BlueTeam_Alex 3/3/2026

Surge in Hacktivist DDoS: Keymous+ and DieNet Activity Analysis

MSP_Tech_Dylan 3/4/2026

Finally, a Practical RFP Template for AI Usage Control & Governance

MalwareRE_Viktor 3/4/2026

Anthropic Blacklisted? The Ethics of AI in Defense Supply Chains

SecurityTrainer_Rosa 2/28/2026

Scalability vs. Security: Google's Merkle Tree Play for PQC in Chrome

MFA_Champion_Sasha 3/2/2026

Starkiller PhaaS: Mitigating Adversary-in-the-Middle (AitM) Proxies in the Wild

WiFi_Wizard_Derek 2/24/2026

Meta's Offensive Shift: Suing 'Celeb-Bait' Operators in Brazil & Vietnam

AppSec_Jordan 2/27/2026

$61M USDT Seized: Breaking the 'Pig Butchering' Crypto Laundering Chain

Proxy_Admin_Nate 2/27/2026

Technical Deep Dive: Analyzing Starkiller's Reverse Proxy Architecture & MFA Relay

PhishFighter_Amy 2/26/2026

Fake Next.js Job Repos: In-Memory Malware & Job Assessment Lures

EDR_Engineer_Raj 2/26/2026

Supply Chain Alert: Malicious 'StripeApi.Net' Typosquatting on NuGet

BugBounty_Leo 2/26/2026

Tracing the 'Pig Butchering' Trail: Analysis of the $61M USDT Seizure

CloudOps_Tyler 2/27/2026

SANDWORM_MODE: New npm supply chain worm targeting CI/CD secrets

OSINT_Detective_Liz 2/23/2026

Google Maps Keys Abused to Leak Gemini AI Data

EDR_Engineer_Raj 2/26/2026

UAT-10027 & Dohdoor: Abusing DoH for C2 in Edu/Health

Pentest_Sarah 2/26/2026

Manual Data Transfer: The Silent Killer in NatSec Ops?

CloudOps_Tyler 2/25/2026

Starkiller PhaaS: Why MFA fatigue is now your biggest risk

NetGuard_Mike 2/23/2026

Starkiller PhaaS: The End of Static Phishing Filters?

BugBounty_Leo 2/25/2026

UAC-0050 targeting European banks — RMS Malware & Social Engineering

Firewall_Admin_Joe 2/24/2026

UNC2814 (GRIDTIDE) Takedown: Assessing Residual Risk in Telco Infra

BlueTeam_Alex 2/25/2026

UAC-0050 Expands to European Finance: RMS Malware & Domain Spoofing

Support 2/24/2026

Identity Prioritization: Moving beyond the 'Loudness' Factor in Risk Scoring

ICS_Security_Tom 2/24/2026

LLM Infrastructure Risks: The Real Danger is the Exposed APIs

DNS_Security_Rita 2/23/2026

Kimwolf Botnet: A Wake-Up Call for IoT Security in Enterprise

RedTeam_Carlos 2/21/2026

Defeating Starkiller: When MFA isn't enough against reverse proxy phishing

TabletopEx_Quinn 2/22/2026

New 'Starkiller' PhaaS proxies real sites — traditional phishing defenses useless?

MSP_Owner_Rachel 2/22/2026

Cyber insurance renewal — premiums up 40% and new exclusions

DevSecOps_Lin 1/20/2026

The MOVEit aftermath: lessons learned for file transfer security

DLP_Admin_Frank 11/9/2025

Thoughts on the new NIST CSF 2.0 "Govern" function?

Pentest_Sarah 9/15/2025

MSPs: what's your tech stack in 2025/2026?

BugBounty_Leo 7/13/2025

AI-generated phishing is getting terrifyingly good

Compliance_Beth 4/9/2025

State of cybersecurity hiring in 2025 — is the "skills gap" real?

Pentest_Sarah 2/12/2025