Servers for developing AI applications have become vaults of valuable secrets, accessible through a single unprotected request. Attackers have begun exploiting the critical vulnerability CVE-2026-0768 in Langflow to extract OpenAI and AWS keys, administrator...
An ordinary-looking message from corporate IT support on Microsoft Teams can end in a stolen Windows password and full access to a company’s internal network. Researchers at Expel discovered a new malware family called...
Researchers have uncovered a network of malicious extensions inside the official Microsoft Edge store. These add-ons masqueraded as useful tools and operated for years alongside legitimate extensions. Disguised as ad blockers, weather widgets, video...
FortiBleed began as mass password guessing. Then it grew into an attack chain, where hijacked firewalls gathered fresh credentials for the next breach. A new timeline shows that the published FortiGate password database was...
AD CS LOLBAS Toolkit Native Windows toolkit for AD CS enumeration and exploitation. Everything runs through built-in OS components (certreq.exe, certutil.exe, PowerShell AD module, .NET Framework) – no third-party tools needed(other than RSAT). Build...
An oversight within a security remediation has inadvertently carved a novel path for exploitation. While the developers successfully neutralized the remote code execution flaw weaponized by the APT28 collective, they left behind a secondary...
A solitary click upon a purported “error rectification” within a browser may precipitate the absolute compromise of a computational architecture, and the nascent “DeepLoad” malware vividly illustrates the velocity of this subversion. Executing a...
Within a specimen of malicious software, initially misidentified as the infamous Vidar infostealer, an entirely disparate narrative has been unearthed. Lurking beneath this misattribution was a nascent instrument for data exfiltration, subsequently christened the...
Phishing bombardments have long possessed the acumen to meticulously forge correspondence from colossal brands; however, contemporary digital marauders are increasingly eschewing orthodox counterfeit landing pages in favor of ushering their quarry into a chat...
The pursuit of a corporate VPN client across the digital expanse can culminate in the catastrophic exfiltration of credentials. The orchestration of a campaign by the cybercriminal syndicate designated Storm-2561 starkly illuminates the terrifying...
Following the dismantling of the Lumma Stealer infrastructure in 2025, the landscape of data-stealing malicious software began to shift precipitously. Emerging and established instruments swiftly encroached upon the resulting vacuum, while a fierce struggle...
An electronic missive imploring the recipient to “sign a document” or “authenticate an account” may not invariably lead to a fabricated domain, but rather to an entirely legitimate Microsoft or Google address. It is...
