SectionResearch
New techniques, papers and threat intelligence.
Empire Market Co-Founder Gets 40 Years for Dark Web Drug and Fraud Empire
Raheim Hamilton was sentenced to four decades in federal prison for co-running Empire Market, a dark web marketplace that processed $430 million…
Global Coalition Seizes Hacking Tools Tied to China’s Flax Typhoon Operator
Agencies from six countries disrupted infrastructure behind Integrity Technology Group, the Beijing firm that armed Chinese state hackers with scanning and phishing…
16 Malicious Firefox Extensions Impersonate Rabby, OKX Wallets to Steal Crypto Keys
Researchers identified 16 fake Firefox extensions posing as crypto wallet tools that intercept recovery phrases and private keys during wallet import flows.
ClickFix Attacks Get Stealthier With DNS and Cache Tricks
Attackers behind ClickFix social engineering campaigns are now stashing malicious payloads in DNS TXT records and browser pre-fetch caches, making the early…
Iranian National Linked to Mabna Institute Hacking Spree Extradited from Montenegro
Amir Barati, accused of helping run an Iran-backed campaign that stole 31 terabytes of academic data from universities worldwide, was handed over…
Over 500,000 Live Credentials Found Exposed Across Public GitHub Repos
Truffle Security scanned 224 million public GitHub repositories and found more than a million exposed credentials, with over 543,000 still active, including…
Signal Completes Rollout of Encrypted Local Backups to iOS and Desktop
Version 8.30 brings on-device, end-to-end encrypted backup support to iOS, Linux, macOS, and Windows, wrapping up a year-long project that began on…
Dutch Police Arrest Amsterdam Man in ShinyHunters Investigation
Authorities confirmed the arrest of a 24-year-old Amsterdam man, identified by researchers as previously convicted hacker Pepijn van der Stap, amid a…
MacSync macOS Stealer Now Hides Commands in Public iCloud Calendars
A new MacSync variant abuses public iCloud calendar event descriptions to smuggle shell commands and fetch next-stage payloads, while a new Finder-spoofing…
New Process Parameter-Poisoning Trick Lets Malware Slip Past EDR
Researchers detail a process injection technique that tampers with initialization structures instead of calling the Windows APIs most EDR products monitor, letting…
TrustSink Attack Lets Rogue Entra MFA Providers Steal Passwords Post-Compromise
Varonis Threat Labs details TrustSink, a technique where attackers with privileged Entra access register a rogue external MFA provider to harvest passwords…
New ChainScript RAT Spreads via ClickFix Lures, Uses Polygon for C2
Researchers have identified a previously undocumented RAT called ChainScript that abuses ClickFix-style social engineering and rotates command-and-control infrastructure through the Polygon blockchain.