Stories cluster related articles into a single narrative, linked to the underlying CVEs and affected products. 6,128 stories synthesized.
Agenda (Qilin) ransomware has been observed deploying a Linux binary on Windows hosts by abusing WinSCP and Splashtop Remote, evading Windows-centric EDR and targeting backup infrastructure.
ESET researchers report that SnakeStealer, an infostealer first seen in 2019 in 2019, has become the most detected infostealer in the first half of 2025, accounting for nearly 20% of global infostealer detections.
China-linked threat groups Earth Estries and Earth Naga are collaborating through a 'Premier Pass-as-a-Service' model where one group acts as an access broker, handing compromised networks to the other for continued exploitation.
GitLab released versions 18.5.1, 18.4.3, and 18.3.5 on October 22, 2025, fixing a critical runner hijack vulnerability and three denial-of-service flaws.
Vidar Stealer 2.0, a complete rewrite in C with multithreaded data theft, bypasses Chrome's AppBound encryption and shows a sharp spike in campaigns since its October 2025 release.
A targeted doxxing campaign leaked personal details of five alleged Lumma Stealer operators, causing a sharp decline in malware activity and migration of customers to rival infostealers.
Trend Micro researchers uncovered Operation Zero Disco, an attack campaign exploiting CVE-2025-20352 to deploy Linux rootkits on Cisco switches.
A large-scale RondoDox botnet campaign is exploiting over 50 vulnerabilities across 30+ vendors, including flaws from Pwn2Own contests, targeting routers, DVRs, and CCTV systems globally.
An attacker published 84 malicious versions of TanStack npm packages on May 11, 2026, as part of the ongoing Mini Shai-Hulud campaign, stealing credentials and installing a dead-man's switch that wipes the local disk if a stolen GitHub token is revoked.
Volexity reveals that China-aligned threat actor UTA0388 has been using OpenAI's ChatGPT to assist in spear-phishing campaigns and malware development, targeting organizations across North America, Asia, and Europe since June 2025.
Trend Micro researchers found Azure Storage Account credentials embedded in signed DLLs of an Axis Communications plugin for Autodesk Revit, enabling potential supply-chain attacks.
GitLab released versions 18.4.2, 18.3.4, and 18.2.8 on October 8, 2025, fixing four vulnerabilities including a high-severity authorization bypass in GraphQL mutations and a denial-of-service flaw.
Trend Micro Research outlines a step-by-step attack chain showing how AI chatbots can be exploited as backdoors, from initial probing to data exfiltration.
Trend Micro uncovers Water Saci campaign spreading SORVEPOTEL infostealer via WhatsApp, hijacking active sessions to propagate and steal financial credentials.
ESET researchers have uncovered two previously undocumented Android spyware families, ProSpy and ToSpy, that impersonate Signal and ToTok to steal sensitive data from users in the UAE.
The DFIR Report details a May 2024 intrusion by the Lunar Spider initial access group that began with a single click on a malicious JavaScript file masquerading as a tax form and persisted for nearly two months.
ESET research reveals DeceptiveDevelopment, a North Korea-aligned threat actor using fake job offers and AI-enhanced fake job offers and synthetic identities to target software developers in the cryptocurrency and Web3 sectors.
Trend Micro Research has identified LockBit 5.0 in the wild with Windows, Linux, and ESXi variants, featuring heavy obfuscation, cross-platform targeting, and improved evasion techniques.
GitLab released versions 18.4.1, 18.3.3, and 18.2.7 on September 25, 2025, fixing multiple security issues including a critical cross-site scripting vulnerability (CVE-2025-9642) and two denial-of-service flaws.
A critical vulnerability in Microsoft Entra ID (formerly Azure AD) allows attackers to obtain Global Admin privileges in any tenant via specially crafted Actor tokens, with no patch yet available.
A breach at Salesloft's AI chatbot provider Drift cascaded through the supply chain, exposing data from over 700 organizations including Palo Alto Networks, Cloudflare, and Zscaler.
Trend Micro Research has published a detailed analysis of how attackers can compromise LLMs through poisoned training data, malicious LoRA adapters, and trojan model files, highlighting the growing supply-chain risks in AI.
Trend Micro researchers found that Wondershare RepairIt hardcoded write-capable cloud credentials in its binary, exposing user photos, AI models, and signed executables to supply-chain attacks.
A malware campaign targeting Latin America, primarily Colombia, uses oversized SVG files impersonating the judicial system to deliver AsyncRAT via DLL sideloading.