Back to Forums

General

General discussion about cybersecurity, industry trends, and news.

Technical Deep Dive: Bitwarden CLI `bw1.js` Malware Analysis

ICS_Security_Tom 4/23/2026

The "IT Support" Trap: UNC6692 Abusing Teams for SNOW Delivery

PhishFighter_Amy 4/23/2026

Supply Chain Warning: Bitwarden CLI Compromise in Checkmarx Campaign

SysAdmin_Dave 4/23/2026

UNC6692 and SNOW Malware: When IT Helpdesk Calls via Teams

DarkWeb_Monitor_Eve 4/23/2026

Sanctions & Servers: Analyzing the Grinex $13.74M 'Intel' Hack

OSINT_Detective_Liz 4/18/2026

CanisterSprawl: npm Tokens, Self-Propagation, and ICP Exfiltration

CloudOps_Tyler 4/22/2026

Supply Chain Alert: Malicious Checkmarx/KICS Docker Images Detected

MSP_Tech_Dylan 4/22/2026

Grinex Exchange Goes Dark: $13.74M Heist Blamed on State Intel

Incident_Cmdr_Tanya 4/18/2026

Moltbook Leak: When AI Agents Play 'Hot Potato' with API Keys

Compliance_Beth 4/22/2026

Grinex Down: Sanctions, $13.74M, and the 'State Actor' Excuse

VPN_Expert_Nico 4/19/2026

Attribution or Deflection? Dissecting the Grinex 'State Actor' Narrative

AppSec_Jordan 4/19/2026

Operational Hygiene for the 40:1 Non-Human Identity Crisis

IAM_Specialist_Yuki 4/19/2026

Google's 8.3B Ad Purge: Android 17 Permission Changes & Impact on Fraud Detection

PatchTuesday_Sam 4/17/2026

Grinex Collapse: 'State-Sponsored' Heist or Just Poor OpSec?

Crypto_Miner_Watch_Pat 4/18/2026

The 2024 Stats Were Right: Ghost Identities Are Still Haunting Our Clouds

SecurityTrainer_Rosa 4/18/2026

Beyond the User: The 40:1 Non-Human Identity Nightmare

Pentest_Sarah 4/19/2026

Grinex Blames 'Intel Agencies' for $13.74M Loss – Convenient Scapegoat or TTPs Match?

SOC_Analyst_Jay 4/19/2026

Taming the Machine Identity Hydra: Practical Steps to Clean Up Ghost Identities

CryptoKatie 4/19/2026

68% of Cloud Breaches? The Non-Human Identity Crisis is Real

PhysSec_Marcus 4/18/2026

The Silent Killer: Ghost Identities and Orphaned API Keys

Pentest_Sarah 4/18/2026

No Malware Needed: APT28's Router Token Harvesting Spree

DevSecOps_Lin 4/17/2026

Play Store Policy Shift: Analyzing Android 17's New Contact/Location Restrictions

CloudSec_Priya 4/17/2026

Student Loan Breach: 2.5M Records and the Impact on EDU-Sec

Threat_Intel_Omar 4/14/2026

Android 17 Privacy Shift: 8.3B Ads Blocked & New Permission Controls

Compliance_Beth 4/17/2026

JanelaRAT Surge: 14k+ Hits in Brazil and the Evolution of BX RAT

Pentest_Sarah 4/13/2026

Living off the Land: APT28's Router Token Harvest

HoneyPot_Hacker_Zara 4/15/2026

Weaponizing Note-Taking: REF6598 & PHANTOMPULSE in Obsidian

SA_Admin_Staff 4/16/2026

Passive Token Harvesting: The Router Mass-Heist & Token Theft

MDR_Analyst_Chris 4/14/2026

The Unseen AI Threat Vector: Browser Extensions Flying Under the Radar

API_Security_Kenji 4/10/2026

CISA ED 25-01: Cisco SD-WAN Critical Flaws (CVE-2025-20125) - Patch or Perish?

ContainerSec_Aisha 4/7/2026

APT37 Returns: Facebook Social Engineering & RokRAT's Cloud C2

CISO_Michelle 4/13/2026

Defending Against Geolocation-Based Wipers: CanisterWorm Edition

IAM_Specialist_Yuki 4/5/2026

Chrome 146 & DBSC: The End of Cookie Stealing as We Know It?

Incident_Cmdr_Tanya 4/10/2026

Supply Chain Risk: Zig Dropper Masquerading as WakaTime Extension

MSP_Tech_Dylan 4/11/2026

Identity Attack Surface: The 18k-Node Router Token Heist

ContainerSec_Aisha 4/11/2026

Silent Token Harvesting: APT28's Router Pivot without Malware

IAM_Specialist_Yuki 4/8/2026

LayerX Report: AI Extensions - The Unmonitored Consumption Channel

IAM_Specialist_Yuki 4/10/2026

Beyond Shadow AI: The Data Exfil Risks of GenAI Browser Extensions

MFA_Champion_Sasha 4/10/2026

GlassWorm's Evolution: Zig Droppers Targeting All IDEs via Open VSX

MasterSlacker 4/10/2026

Hunting Iran-Linked Password Spraying: Protecting M365 in Conflict Zones

BugBounty_Leo 4/6/2026

LucidRook & UAT-10362: Rust/Lua Stagers Hitting Taiwanese NGOs

DarkWeb_Monitor_Eve 4/9/2026

LucidRook: Rust & Lua Stagers in UAT-10362's Taiwan Campaigns

Forensics_Dana 4/9/2026

Masjesu Botnet: Telegram DDoS-for-Hire Targeting Multi-Arch IoT

Compliance_Beth 4/8/2026

Bridging the Multi-OS Gap: Strategies for Cross-Platform SOC Defense

CryptoKatie 4/6/2026

Spotting TA416: OAuth Consent Phishing & PlugX Registry Keys

ContainerSec_Aisha 4/4/2026

When Ransomware Goes Nuke: CanisterWorm's Financial Geopolitics

BlueTeam_Alex 4/4/2026

Hunting Aisuru & Kimwolf: Traffic Patterns & Persistence Post-Takedown

BugBounty_Leo 4/4/2026

CanisterWorm: Wiping Logic & Cloud Worming Mechanics

ZeroDayHunter 4/6/2026

GitHub as C2 Infrastructure? DPRK's Latest TTP in South Korea

SecurityTrainer_Rosa 4/6/2026

Drift's $285M Heist: The Six-Month Social Engineering Campaign

LogAnalyst_Pete 4/5/2026

CanisterWorm Analysis: Locale Checks & Cloud Propagation

Forensics_Dana 4/4/2026

Hunting Timezone Heuristics: The CanisterWorm Locale Check

API_Security_Kenji 4/1/2026

Handala Group Operations: From Financial Extortion to CanisterWiper

DNS_Security_Rita 3/31/2026

Takedown Analysis: Aisuru, Kimwolf, JackSkid, and Mossad Botnets

ICS_Security_Tom 4/4/2026

CanisterWorm: Cloud Worming & The Locale-Based Wipe Trigger

DarkWeb_Monitor_Eve 4/4/2026

TA416 (RedDelta) Returns to EU: PlugX Persistence & OAuth Consent Phishing

Threat_Intel_Omar 4/3/2026

CanisterWorm: The Risk of Locale-Based Wiping for Global Travelers

EmailSec_Brian 4/3/2026

Evasion Techniques: Cookie-Controlled PHP Shells & Cron Persistence

NetGuard_Mike 4/3/2026

New SparkCat Variant: Image Scraping Malware Hits Major App Stores

MalwareRE_Viktor 4/3/2026

TA416 Resurfaces in Europe: PlugX, OAuth Phishing, and Diplomatic Targets

Support 4/3/2026

Cloud Worms & Locale-Based Wiping: The CanisterWorm Analysis

Incident_Cmdr_Tanya 3/26/2026

CanisterWorm: Cloud Hygiene & the Rise of Geo-Located Wipers

K8s_SecOps_Mei 3/28/2026

Axios npm Compromise: UNC1069 Attribution & Supply Chain Hygiene

Proxy_Admin_Nate 4/1/2026

CanisterWorm: The Shift from Profit to Politics in Cloud Worms

Firewall_Admin_Joe 3/29/2026

OPSEC at the Executive Level: Handala’s Pivot from Leaks to Wipers

AppSec_Jordan 3/28/2026

CanisterWorm Deep Dive: Detecting the Persian Timezone Logic

WiFi_Wizard_Derek 3/29/2026

StoatWaffle Malware: Weaponizing VS Code tasks. in Developer Interviews

DevSecOps_Lin 3/23/2026

Personal Accounts Under Fire: Handala Team Targets FBI Director & Stryker

MalwareRE_Viktor 3/28/2026

Geopolitics and the SOC: When "War" Hits the Log Server

MSP_Owner_Rachel 3/27/2026

Operation Botnet Smash: Disrupting Aisuru, Kimwolf, JackSkid, and Mossad

OSINT_Detective_Liz 3/27/2026

TeamPCP's PyPI Persistence: WAV Steganography in `telnyx` v4.87.x

RansomWatch_Steve 3/27/2026

Red Menshen's BPFDoor: Hunting for eBPF Rootkits in Telecom Infrastructure

DarkWeb_Monitor_Eve 3/26/2026

CISA's Updated RESURGE Analysis: Edge Device Webshell Hunting

SecArch_Diana 3/26/2026

IRS Phishing Surge: RMM Malware Hits 29,000 Users

AppSec_Jordan 3/23/2026

Leveraging Locale for Destruction: Analyzing CanisterWorm's Targeting Logic

RansomWatch_Steve 3/24/2026

CanisterWorm: When Financial Motives Meet Geopolitical Wiping

CloudSec_Priya 3/25/2026

Feds Disrupt Aisuru & Kimwolf: What 3M Hacked IoT Devices Mean for Your Edge

Proxy_Admin_Nate 3/20/2026

Russian Ops Pivot to CMAs: Signal & WhatsApp Under Fire

SysAdmin_Dave 3/22/2026

FCC Router Ban: Validating Supply Chain Integrity at the Edge

MSP_Tech_Dylan 3/25/2026

TeamPCP Targeting Checkmarx: CI/CD Credentials Stolen in GitHub Action Heist

PatchTuesday_Sam 3/24/2026

Russian Intel Targeting Signal & WhatsApp: Phishing Campaigns & Defensive Measures

MDR_Analyst_Chris 3/21/2026

Defending the Personal Link: Countering APT29's Signal & WhatsApp Phishing

LogAnalyst_Pete 3/22/2026

Phishing for E2EE: Russian Intel's Pivot to WhatsApp & Signal

CloudOps_Tyler 3/21/2026

K8s Wiper & Worm Payloads Found in Trivy Docker Hub Images

Proxy_Admin_Nate 3/23/2026

Speagle Malware: Hijacking Cobra DocGuard Infrastructure

Pentest_Sarah 3/19/2026

The Botnet Takedown: Aisuru, Kimwolf, and the IoT Mess - Technical Takeaways

VPN_Expert_Nico 3/22/2026

Stryker Incident: When Wipers Hit Medtech and Physical Security

RansomWatch_Steve 3/21/2026

CanisterWorm in the Wild: ICP Canisters and the npm Fallout

SCADA_Guru_Ivan 3/21/2026

This Week's Reality Check: Chrome 0-Days and Rogue AI

MSP_Owner_Rachel 3/16/2026

The IAM Gap: Securing Claude Code and Agentic Workflows

ZeroDayHunter 3/19/2026

AI-Enabled Attacks: Why Signatures Are Dead and Behavior is King

whatahey 3/20/2026

Analyzing Perseus: When Notes Apps Become a Financial Fraud Vector

Threat_Intel_Omar 3/19/2026

GlassWorm 2.0: The Danger of Transitive Dependencies in Open VSX

EDR_Engineer_Raj 3/14/2026

Aura Breach: 900k Records Leaked - The Irony of Identity Protection

CISO_Michelle 3/18/2026

OFAC Sanctions DPRK IT Workers: Technical Vetting & Insider Threat Risks

ZeroTrust_Hannah 3/18/2026

Konni's New Vector: Abusing KakaoTalk to Spread EndRAT

MalwareRE_Viktor 3/17/2026

Medtech Under Fire: Stryker and the Iran-Linked Wiper Threat

BackupBoss_Greg 3/13/2026

Weaponizing Extension Packs: GlassWorm's New Vector in Open VSX

BackupBoss_Greg 3/14/2026

Weekly Threat Landscape: Chrome 0-Days, AWS Breaches, and the Rise of Rogue AI

SOC_Analyst_Jay 3/16/2026

Healthcare Under Siege: Analyzing the Stryker Wiper Incident & OT Defenses

Threat_Intel_Omar 3/15/2026

Android 17: Locking Down the Accessibility API in AAPM

DarkWeb_Monitor_Eve 3/16/2026

Open VSX Under Siege: Deconstructing GlassWorm's Transitive Abuse

MFA_Champion_Sasha 3/15/2026

72 Extensions Later: GlassWorm's Open VSX Supply Chain Pivot

Forensics_Dana 3/15/2026

CL-STA-1087: Deep Dive into AppleChris & MemFun Targeting SE Asia

VPN_Expert_Nico 3/13/2026

Countering 'Strategic Patience': CL-STA-1087 and the SE Asia Military Threat

Threat_Intel_Omar 3/14/2026

Rust-Based Banking Trojan VENON Hits Brazil: Overlays & Analysis

TabletopEx_Quinn 3/12/2026

Beyond XSS: Jailbreaking Agentic Browsers via 'Reasoning' Attacks

Crypto_Miner_Watch_Pat 3/11/2026

VENON: Analyzing the Rust Shift in LATAM Banking Trojans

VPN_Expert_Nico 3/12/2026

Agentic AI Phishing: Perplexity's Comet Bypassed in Under 4 Minutes

BackupBoss_Greg 3/11/2026

UNC4899, Crypto, and the AirDrop Vector: Blending Physical & Digital Ops

Firewall_Admin_Joe 3/9/2026

Mid-Market Security Platforms: Are We Finally Ready for the 'Big Leagues'?

Proxy_Admin_Nate 3/9/2026

Dust Specter: Deep Dive into SPLITDROP & GHOSTFORM targeting Iraqi Gov

PhishFighter_Amy 3/5/2026

MuddyWater's Dindoor: Analyzing the New Backdoor Targeting US Critical Infrastructure

Proxy_Admin_Nate 3/6/2026

Starkiller Detection: Hunting for the Reverse Proxy Relay

BlueTeam_Alex 3/5/2026

Starkiller PaaS: The Real-Time Proxy Threat to MFA

CloudOps_Tyler 3/4/2026

Supply Chain Alert: Cross-Platform RAT via Fake Laravel Packages

SecArch_Diana 3/4/2026

Google's Merkle Tree Implementation for Quantum-Resistant HTTPS: Is this the right path?

Crypto_Miner_Watch_Pat 3/2/2026

MCP & AI Agents: Addressing the 'Identity Dark Matter' in our stacks

BlueTeam_Alex 3/3/2026

Surge in Hacktivist DDoS: Keymous+ and DieNet Activity Analysis

MSP_Tech_Dylan 3/4/2026

Finally, a Practical RFP Template for AI Usage Control & Governance

MalwareRE_Viktor 3/4/2026

Anthropic Blacklisted? The Ethics of AI in Defense Supply Chains

SecurityTrainer_Rosa 2/28/2026

Scalability vs. Security: Google's Merkle Tree Play for PQC in Chrome

MFA_Champion_Sasha 3/2/2026

Starkiller PhaaS: Mitigating Adversary-in-the-Middle (AitM) Proxies in the Wild

WiFi_Wizard_Derek 2/24/2026

Meta's Offensive Shift: Suing 'Celeb-Bait' Operators in Brazil & Vietnam

AppSec_Jordan 2/27/2026

$61M USDT Seized: Breaking the 'Pig Butchering' Crypto Laundering Chain

Proxy_Admin_Nate 2/27/2026

Technical Deep Dive: Analyzing Starkiller's Reverse Proxy Architecture & MFA Relay

PhishFighter_Amy 2/26/2026

Fake Next.js Job Repos: In-Memory Malware & Job Assessment Lures

EDR_Engineer_Raj 2/26/2026

Supply Chain Alert: Malicious 'StripeApi.Net' Typosquatting on NuGet

BugBounty_Leo 2/26/2026

Tracing the 'Pig Butchering' Trail: Analysis of the $61M USDT Seizure

CloudOps_Tyler 2/27/2026

SANDWORM_MODE: New npm supply chain worm targeting CI/CD secrets

OSINT_Detective_Liz 2/23/2026

Google Maps Keys Abused to Leak Gemini AI Data

EDR_Engineer_Raj 2/26/2026

UAT-10027 & Dohdoor: Abusing DoH for C2 in Edu/Health

Pentest_Sarah 2/26/2026

Manual Data Transfer: The Silent Killer in NatSec Ops?

CloudOps_Tyler 2/25/2026

Starkiller PhaaS: Why MFA fatigue is now your biggest risk

NetGuard_Mike 2/23/2026

Starkiller PhaaS: The End of Static Phishing Filters?

BugBounty_Leo 2/25/2026

UAC-0050 targeting European banks — RMS Malware & Social Engineering

Firewall_Admin_Joe 2/24/2026

UNC2814 (GRIDTIDE) Takedown: Assessing Residual Risk in Telco Infra

BlueTeam_Alex 2/25/2026

UAC-0050 Expands to European Finance: RMS Malware & Domain Spoofing

Support 2/24/2026

Identity Prioritization: Moving beyond the 'Loudness' Factor in Risk Scoring

ICS_Security_Tom 2/24/2026

LLM Infrastructure Risks: The Real Danger is the Exposed APIs

DNS_Security_Rita 2/23/2026

Kimwolf Botnet: A Wake-Up Call for IoT Security in Enterprise

RedTeam_Carlos 2/21/2026

Defeating Starkiller: When MFA isn't enough against reverse proxy phishing

TabletopEx_Quinn 2/22/2026

New 'Starkiller' PhaaS proxies real sites — traditional phishing defenses useless?

MSP_Owner_Rachel 2/22/2026

Cyber insurance renewal — premiums up 40% and new exclusions

DevSecOps_Lin 1/20/2026

The MOVEit aftermath: lessons learned for file transfer security

DLP_Admin_Frank 11/9/2025

Thoughts on the new NIST CSF 2.0 "Govern" function?

Pentest_Sarah 9/15/2025

MSPs: what's your tech stack in 2025/2026?

BugBounty_Leo 7/13/2025

AI-generated phishing is getting terrifyingly good

Compliance_Beth 4/9/2025

State of cybersecurity hiring in 2025 — is the "skills gap" real?

Pentest_Sarah 2/12/2025