Bem vindo a parte dois de como burlar filtros de segurança contra XSS, caso não saiba sobre XSS recomendo ler a primeira parte que tem…

Unit 42 reveals homograph phishing attacks exploiting visually similar characters to bypass defenses and deceive users. AI is amplifying this threat, making malicious emails highly convincing.

Artificial intelligence has come a long way in content moderation, but recent research has revealed a subtle yet powerful vulnerability…

Researchers found that Gemini models interpret invisible Unicode "Tag" characters as commands, allowing attackers to trick AI agents into implanting backdoors.

A decade-old browser flaw, "BiDi Swap," allows attackers to craft deceptive URLs for phishing. The bug, found by Varonis, exploits mixed-text direction.

Researchers at FireTail have discovered the resurrection of an old-class flaw — ASCII Smuggling — now resurfacing in

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.

The BiDi Swap attack exploits flaws in Unicode's bidirectional text rendering to make malicious URLs look legitimate, tricking users and bypassing browser security.

Making text readable for humans, but not for AI.

GlassWorm resurfaced, infecting 3 new VS Code extensions on OpenVSX. The worm uses invisible Unicode and Solana blockchain C2 to steal credentials and spread via AI-generated malicious commits on GitHub.

The Glassworm campaign targeting popular Visual Studio Code extensions has entered yet another phase — researchers are now