A previously undetectable Linux backdoor called GhostPenguin was exposed by AI-driven threat hunting. The C++ malware uses RC5-encrypted UDP for stealthy, multi-threaded C2 operations.

The Shanya Crypter (VX Crypt) is a new PaaS used by Akira/Medusa to bypass EDR. It deploys a kernel driver attack to kill security products and uses PEB manipulation for stealth.

A college student is selling access to 5,200+ gov/edu sites via the undetectable Beima PHP Webshell. The custom backdoor allows full RCE and fuels a growing cybercrime freelancing marketplace.

A malicious Go package typosquat (bpoorman/uuid) operated for four years, using a hidden Valid function to silently encrypt and exfiltrate sensitive data to dpaste.com.

Chinese APT Silver Fox is using a Cyrillic false flag in an SEO poisoning campaign impersonating Microsoft Teams. The attack installs ValleyRAT for espionage and financial fraud.

Evolved ClayRat spyware uses Accessibility Services to install a keylogger and lockscreen bypass. It leverages self-defense (blocking uninstallation) and screen recording for comprehensive surveillance.

A unique Android banking trojan, FvncBot, targets mBank (Poland) customers. It uses HVNC and H.264 to stream screens and performs web-inject attacks via FCM/WebSocket C2.

The JS#SMUGGLER campaign uses "Junk Code" JavaScript and fileless PowerShell executed via mshta.exe to bypass EDR. This multi-stage attack silently installs the NetSupport RAT.

A new C-compiled RAT, CastleRAT, uses Steam Community pages to hide its C2. The malware deploys advanced features like UAC Bypass, screen capture, and clipboard hijacking for espionage.

Despite takedown, LockBit 5.0 resurges as a cross-platform threat. The new variant blinds Windows Event Tracing (ETW), uses Invisible Mode for stealth encryption, and overwrites free disk space.

Responding to user complaints, Windows 11 Build 26220 adds a setting to disable AI actions in the File Explorer context menu, reducing significant UI clutter.

The Exact Recon → Bug → Report Flow That Still Pays in 2025

Guía completa sobre la vulnerabilidad API8:2023 (Security Misconfiguration): Ejemplos, metodología de detección y mitigación esencial.

Hi Vipul from The Hacker’s Log here 👋 Today we’re diving into one of the most powerful bug bounty techniques that still works beautifully

There is a point in your life as an operator, builder, or diagnostician where you stop “looking at a place” and start “reading it.” The…

These will be helpful in your journey

The Iranian threat group MuddyWater has intensified its cyber-espionage operations with the deployment of a new malicious program

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), in its newly issued mobile communications guidelines, has delivered a

Portugal has expanded its legal framework in the realm of digital security, formally establishing protections for good-faith specialists

The new release of Tiny Core Linux illustrates just how far the philosophy of minimalism can be taken