SectionResearch
New techniques, papers and threat intelligence.
Windows Named Pipes: A Trusted-Looking Interface That Often Isn’t
Security researchers warn that Windows named pipes, widely used for local interprocess communication, are frequently misconfigured in ways that let unprivileged or…
Supply-Chain Malware Turns Android Car Head Units Into Proxy Botnet Nodes
Kaspersky links the MoYu group, previously tied to BadBox, to a new infection chain hijacking DoFun automotive head units for ad fraud…
TikTok to Pay $400 Million Settling US Child Privacy Lawsuit
The Justice Department says ByteDance-owned TikTok will pay $400 million to resolve a 2024 lawsuit alleging violations of federal child privacy protections,…
Three Banking Trojans, Three Continents: Manic, Grandoreiro, and ToxicPanda 2.0 Escalate
Researchers this week detailed three distinct banking trojan campaigns, ranging from a new Android threat hitting Ukraine to an updated Grandoreiro variant…
14 Trojanized npm Packages Deliver AI-Powered RedC2 4.0 Linux Backdoor
Researchers found npm packages posing as calendar and streak-tracking utilities that quietly drop an AI-assisted Linux implant called RedC2 4.0 onto developer…
Democrats Ask GAO to Probe Fallout From CISA Staffing Cuts
House lawmakers want the Government Accountability Office to examine how losing nearly a third of CISA's workforce has affected the agency's ability…
Defense Contractors More Confident in CMMC Scores, Less Able to Prove Them
Two new surveys of the defense industrial base show rising self-attested SPRS scores and rising confidence, but a shrinking share of contractors…
New Manic Android Malware Relays Stolen Data Through Nearby Infected Phones
A newly documented Android trojan called Manic combines banking fraud, spyware, and remote control, and can bounce stolen data between nearby infected…
AmnesiaStealer Malware Hijacks macOS Browser Sessions in Real Time
A new macOS infostealer spread via ClickFix lures clones victims' Chromium browser profiles and lets attackers remotely drive authenticated sessions through a…
Ukraine Takes Down 94 Fraudulent Call Centers in Nationwide Sweep
A joint operation by Ukrainian police, security services, and German law enforcement dismantled dozens of scam call centers running fake investment platforms…
‘Jewelbug’ Hackers-for-Hire Mix State Espionage With Crypto Theft
Researchers say a threat group tracked as Jewelbug ran both nation-state espionage operations and financially motivated cryptocurrency heists through the same web-based…
City-Forum Campaign Targets Salesforce, ServiceNow in Long-Running Data Theft Operation
A data theft campaign dubbed City-Forum has been quietly targeting Salesforce and ServiceNow environments across multiple industries since at least March 2025,…