Collaborate Disseminate
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to … Continue reading Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026.
SafeDep verified 353 poisoned versions across 79 package names … Continue reading Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
Cybersecurity researchers have disclosed details of an active, multi-wave campaign that employs social engineering lures themed around Adobe and Zoom software updates, business document reviews, and system maintenance utilities to stealthily deploy Rem… Continue reading Fake Adobe and Zoom Updates Install ScreenConnect for Persistent Remote Access
The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise.
That assumption is starting to break.
Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat… Continue reading When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted
Google deleted three AI agent workflows from its Agent Development Kit (ADK) Python repository. Pillar Security showed that a public GitHub issue could manipulate a triage agent into triggering a privileged code-fixing agent.
The researchers said the … Continue reading Google Deletes 3 ADK AI Workflows After Malicious GitHub Issue Could Trigger Privileged Agent
cPanel has patched a flaw that let an authenticated hosting customer execute SQL in the database’s root context, crossing the privilege boundary between a cPanel account and the server’s administrative database identity. It shipped in a targeted securi… Continue reading New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root
A new Russian loader-as-a-service (LaaS) codenamed DOUBLECUP has been using ClickFix lures as a way to stage malware-laced PNG images in victims’ browser cache and ultimately deliver CountLoader and a previously undocumented remote access trojan called… Continue reading DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild.
The vu… Continue reading CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chin… Continue reading 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Malware running as an ordinary user on a Windows machine can sign into a victim’s passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim’s screen.
Unit 42 detailed three attack paths against Chrome’s Google… Continue reading Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts