In early 2025, a developer named Jay Gibson (name changed for security reasons) received a chilling notification on his personal iPhone: Apple had warned him that his device had been the target of a...
A malicious file was discovered in the downloads section of Xubuntu.org, the official website of the Ubuntu distribution featuring the Xfce desktop environment. The counterfeit installer, disguised as “Xubuntu — Safe Downloader,” was designed...
The Israeli company NSO Group, best known for developing the Pegasus spyware, has officially lost its right to interact with WhatsApp and its users. A U.S. federal court has granted Meta’s lawsuit, imposing a...
Microsoft has revoked more than two hundred digital certificates that had been exploited in attacks involving the Rhysida ransomware. These signatures were used to distribute malicious builds disguised as legitimate Microsoft Teams installers, within...
Synacktiv researchers have documented a novel GNU/Linux rootkit, LinkPro, uncovered during an investigation into an AWS infrastructure compromise. The intrusion began with exploitation of a vulnerable Jenkins server, after which the threat actors deployed...
Researchers at Trend Micro have documented a large-scale operation codenamed ZeroDisco, in which attackers weaponized a critical flaw in Cisco’s SNMP implementation (CVE-2025-20352, CVSS 9.0) to implant rootkits and execute arbitrary code on network...
Several extensions for Visual Studio Code, distributed via the open OpenVSX repository, have been found to contain malicious code aimed at cryptocurrency theft and the compromise of developers’ machines. The campaign is attributed to...
McAfee researchers have reported a renewed campaign by the banking trojan Astaroth, which has begun abusing GitHub as a resilient channel for delivering configuration data. By leveraging a legitimate platform in this way, attackers...
Since the beginning of October, GreyNoise analysts have been tracking one of the largest and most coordinated waves of attacks targeting remote access services across the United States. According to their findings, since October...
The notorious Aisuru botnet continues to grow in destructive power — it now commands over 300,000 infected IoT devices, the majority of which are located within networks operated by major U.S. providers such as...
The ClayRat espionage campaign is evolving rapidly and increasingly targeting Android users. According to Zimperium, the malware is spreading actively among Russian users via fake websites and Telegram channels, disguising itself as popular applications...
Attackers have begun abusing the DFIR tool Velociraptor to stage ransomware deployments of LockBit and Babuk. Cisco Talos attributes these campaigns to a cluster known as Storm-2603, believed to operate from China. Analysts report...
