Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 3,686 stories synthesized.
ESET's latest APT activity report reveals China-aligned groups increasingly using adversary-in-the-middle techniques and targeting Latin America, while Iran's MuddyWater boosts internal spearphishing and North Korea expands operations to Uzbekistan.
A new SEO poisoning campaign on Bing targets users searching for ManageEngine OpManager, delivering Bumblebee malware that leads to Akira ransomware deployment within 44 hours.
Jenkins released a security advisory on October 29, 2025, addressing 10 vulnerabilities across multiple plugins, including high-severity SAML replay and XXE issues.
Trend Micro details the Active Water Saci campaign, which uses malicious ZIP files and PowerShell scripts to hijack WhatsApp Web sessions, harvest contacts, and spread malware with sophisticated C&C control.
ESET researchers have uncovered a new wave of Operation DreamJob attacks by North Korea-linked Lazarus group targeting three European defense companies, including UAV manufacturers, to steal drone technology.
Agenda (Qilin) ransomware has been observed deploying a Linux binary on Windows hosts by abusing WinSCP and Splashtop Remote, evading Windows-centric EDR and targeting backup infrastructure.
ESET researchers report that SnakeStealer, an infostealer first seen in 2019 in 2019, has become the most detected infostealer in the first half of 2025, accounting for nearly 20% of global infostealer detections.
GitLab released versions 18.5.1, 18.4.3, and 18.3.5 on October 22, 2025, fixing a critical runner hijack vulnerability and three denial-of-service flaws.
China-linked threat groups Earth Estries and Earth Naga are collaborating through a 'Premier Pass-as-a-Service' model where one group acts as an access broker, handing compromised networks to the other for continued exploitation.
Vidar Stealer 2.0, a complete rewrite in C with multithreaded data theft, bypasses Chrome's AppBound encryption and shows a sharp spike in campaigns since its October 2025 release.
A targeted doxxing campaign leaked personal details of five alleged Lumma Stealer operators, causing a sharp decline in malware activity and migration of customers to rival infostealers.
Trend Micro researchers uncovered Operation Zero Disco, an attack campaign exploiting CVE-2025-20352 to deploy Linux rootkits on Cisco switches.
A large-scale RondoDox botnet campaign is exploiting over 50 vulnerabilities across 30+ vendors, including flaws from Pwn2Own contests, targeting routers, DVRs, and CCTV systems globally.
An attacker published 84 malicious versions of TanStack npm packages on May 11, 2026, as part of the ongoing Mini Shai-Hulud campaign, stealing credentials and installing a dead-man's switch that wipes the local disk if a stolen GitHub token is revoked.
Volexity reveals that China-aligned threat actor UTA0388 has been using OpenAI's ChatGPT to assist in spear-phishing campaigns and malware development, targeting organizations across North America, Asia, and Europe since June 2025.
Trend Micro researchers found Azure Storage Account credentials embedded in signed DLLs of an Axis Communications plugin for Autodesk Revit, enabling potential supply-chain attacks.
GitLab released versions 18.4.2, 18.3.4, and 18.2.8 on October 8, 2025, fixing four vulnerabilities including a high-severity authorization bypass in GraphQL mutations and a denial-of-service flaw.
Trend Micro Research outlines a step-by-step attack chain showing how AI chatbots can be exploited as backdoors, from initial probing to data exfiltration.
Trend Micro uncovers Water Saci campaign spreading SORVEPOTEL infostealer via WhatsApp, hijacking active sessions to propagate and steal financial credentials.
ESET researchers have uncovered two previously undocumented Android spyware families, ProSpy and ToSpy, that impersonate Signal and ToTok to steal sensitive data from users in the UAE.
The DFIR Report details a May 2024 intrusion by the Lunar Spider initial access group that began with a single click on a malicious JavaScript file masquerading as a tax form and persisted for nearly two months.
ESET research reveals DeceptiveDevelopment, a North Korea-aligned threat actor using fake job offers and AI-enhanced fake job offers and synthetic identities to target software developers in the cryptocurrency and Web3 sectors.
Trend Micro Research has identified LockBit 5.0 in the wild with Windows, Linux, and ESXi variants, featuring heavy obfuscation, cross-platform targeting, and improved evasion techniques.