Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Cisco SD-WAN zero-day CVE-2026-20245 was exploited months before disclosure: Mandiant reveals how a malicious CSV file ...

Multiple testing locations and it still wasn't completely clear.

ESET researchers analyzed the 2025 activity of Webworm, a China-aligned APT group that started out targeting organizations in Asia, but has recently shifted its focus to Europe. Even though this is ...

Microsoft Threat Intelligence has disclosed details of a cyberattack carried out by a threat actor tracked as Storm-2949, which escalated from a targeted identity compromise into a large-scale breach ...

A threat actor has launched a campaign to clean up environments infected by the infamous TeamPCP hacking group and deploy its own malicious tools, SentinelOne reports. Active since late April, the ...

Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release ...

An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet. "A purpose ...

The campaign is stealing credentials from unpatched servers at scale, due to “neglect and efficiency,” says analyst, and the damage 'could be absolute.' An apparent security lapse has allowed ...

Claude Code 好用，但风控越来越严。IP 不对、环境特征像 VPS、遥测数据出卖你——封号只是时间问题。 Cloud CLI Proxy ...

For more than a year, a Russian-speaking threat actor targeted human resource (HR) departments with malware that delivers a new EDR killer named BlackSanta. Described as "sophisticated," the campaign ...

A campaign exploiting multiple software vulnerabilities to steal system data and store it in a cloud-based security platform has been uncovered by cybersecurity researchers. Investigators found that a ...