Hackers have found a way to weaponize ordinary Notion notifications to steal employee credentials. The group DOUBLOON DREDGER creates fake executive accounts, sends out document-sharing invitations, and routes victims through a chain of PDF...
Malware doesn’t necessarily need to communicate with an attacker’s server to remain under their control. Researcher Dominic Reichel discovered a previously unknown Windows backdoor called Sleepwalker, which sits silently in memory and waits for...
An ordinary-looking message from corporate IT support on Microsoft Teams can end in a stolen Windows password and full access to a company’s internal network. Researchers at Expel discovered a new malware family called...
The malicious software known as Hydra Remote empowers an attacker to generate a covert desktop environment on an infected computer. Crucially, this secondary workspace remains entirely invisible to the legitimate device owner. The attacker...
For months, the group calling itself BLACKNET-00 marketed itself almost as a turnkey cyberweapon supplier, capable of attacking factories, power plants, and water supply systems. After examining actual samples of its tools, researchers discovered...
Security experts unearthed dozens of counterfeit Firefox extensions. These malicious add-ons masqueraded as cryptocurrency wallets and standard utilities. Some programs appeared innocuous for months. Following an update, they transformed into sinister tools. They actively...
The notorious banking trojan ToxicPanda has resurfaced in a significantly more formidable iteration. ToxicPanda 2.0 now possesses the capability to pilfer PINs from banking and cryptocurrency applications. It intercepts smartphone lock passwords with alarming...
Victims of ransomware attacks are now facing an entirely new scheme: shortly after an attack, an unknown company reaches out, already aware of the stolen data, and offers – for a fee – to...
Security specialists at Zscaler have unearthed a novel backdoor dubbed C2Looper, which malicious actors presumably deploy as a precursor to devastating ransomware assaults. This pernicious software enables adversaries to establish a clandestine foothold within...
Hackers have begun exploiting a critical Windows vulnerability that allows remote code execution on a target computer without requiring an account or any user interaction whatsoever. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)...
The Medusa threat group has attacked more than 500 U.S. critical infrastructure organizations since June 2021. As recently as February 2025, American authorities had counted just over 300 confirmed victims, meaning the roster of...
The Clop threat group is likely using a purpose-built web shell to steal data from PTC Windchill and FlexPLM servers. The malware is engineered specifically around Windchill’s internal architecture: it connects to the application...
