SectionResearch
New techniques, papers and threat intelligence.
Malicious npm Packages Dodge Install-Script Defenses by Hiding in Runtime Code
A campaign centered on the fake 'indexed-btree' package shows attackers bypassing npm's new lifecycle-script protections by embedding malware inside a library's normal…
North Korean WaterPlum Hackers Hit 30,000 Devices, Stole $10.7M in Crypto
A joint advisory from US, Japanese, Australian, and German authorities details how the Contagious Interview campaign used fake job offers and malicious…
CISA Issues Guidance on Using Cyber Decoys to Catch Attackers Early
The agency's new playbook shows critical infrastructure operators how to deploy honeypots, honeytokens, and other decoy systems to detect intruders using legitimate…
FamousSparrow’s New SparroWocky Backdoor Hits Latin American Governments
ESET researchers tracked the China-linked espionage group deploying a heavily obfuscated new backdoor against government targets across Latin America for over a…
BambooToken Malware Abuses MQTT Protocol to Control Windows and Linux Hosts
A cross-platform malware family active since 2023 is using the IoT messaging protocol MQTT for stealthy command-and-control, hitting mobile app backends, law…
Five Alleged Black Axe Leaders Extradited to US on Fraud Charges
US prosecutors say the men ran a decade-long romance scam and advance fee fraud operation from Cape Town, part of the notorious…
DDRop Attack Defeats Intel TDX and AMD SEV-SNP Memory Encryption
A newly disclosed hardware attack called DDRop can silently drop memory writes in confidential computing environments, tricking processors into trusting stale encrypted…
UK Man, 68, Jailed Over $1.3M Illegal IPTV Streaming Operation
A City of London Police investigation found Milan Ibrahim ran an 80-server pirate IPTV service that pulled in nearly £1 million by…
Brave Adds Disposable Email Aliases to Cut Cross-Site Tracking
Brave 1.94 introduces Email Aliases, letting users generate forwarding addresses that hide their real inbox from websites and limit exposure after data…
Attackers Turn npm Mirrors Into Free Hosting for Phishing Redirects
Threat actors are uploading npm packages that contain nothing but a fake Cloudflare verification page, letting mirrors like UNPKG and npmmirror serve…
Former NSA Director Paul Nakasone Launches National Security Advisory Firm
Retired General Paul Nakasone, who led the NSA and U.S. Cyber Command until 2024, has founded the Nakasone Group to advise governments,…
Truffle Security Finds Thousands of Live AWS Keys Exposed Across Public Repos
A four-year sweep by Truffle Security uncovered over 9,300 still-valid AWS access keys, including hundreds tied to corporate accounts with full administrative…