Elastic exposed Chinese threat actors exploiting public ASP.NET machine keys to deploy TOLLBOOTH IIS backdoor and HIDDENDRIVER kernel rootkit. The malware performs stealthy SEO cloaking.

Group-IB exposed MuddyWater using NordVPN to send phishing emails that deliver the Phoenix v4 backdoor. The malware steals credentials via a custom Chromium stealer disguised as a calculator.

SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.

Vidar 2.0, fully rewritten in C, is a multithreaded infostealer that bypasses Chrome's AppBound encryption via memory injection to steal crypto wallets and credentials. Its adoption spikes as Lumma declines.

CISA issued an alert for a Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-11534) in Raisecom RAX701-GC routers, allowing unauthenticated root shell via SSH. The vendor has not yet responded with a patch.

A sophisticated Lumma Infostealer MaaS campaign targets users with pirated software installers. It uses NSIS/AutoIt scripts, Process Hollowing, and MEGA cloud to steal credentials from browsers and crypto wallets.

First, I spent two days understanding the target and taking notes on things like:

This entity exposed an unsecured server containing certified documents, passports, ID cards, and debit cards belonging to 63,564 customers.

Cisco Packet Tracer

Un deep dive en Next.js, Drizzle ORM y Docker para crear una experiencia de usuario inmersiva, segura y de alto rendimiento. Esta es la…

I am looking forward to a stellar discussion about ransomware!

Phase Labs Team
22nd October 2025

Haii! Ini cuma sekedar dokumentasi agar writer tidak lupa dengan fungsi Attack Type yang ada di Burp Intruder. Bassicaly ada 4, yaitu…

Cybersecurity is an ever-growing field which will be around in some capacity or another for a very long time. There are a few main…

We’ve got Wazuh up and running. Enter Sysmon — a highly granular and metadata-rich Windows system tool that provides the forensic detail…

Minecraft remains one of the most cherished games available, but it has a significant issue to deal with. cracked servers allow players and…

Imagine waking up to ‘No Service’ on your phone.  Minutes later, your email, crypto wallet, and social accounts are gone. Someone else now…

A new self-propagating worm, GlassWorm, hides code in VS Code extensions using invisible Unicode and uses Solana blockchain for its "unkillable" C2.

Evilginx, a security research tool designed to bypass MFA, was adopted by groups like Scattered Spider and used in the $100M MGM Resorts breach.

Homeland Security issued the first known warrant compelling OpenAI to disclose a ChatGPT user's identity based on specific prompts in a CSAM investigation.

A new report details a surge in AI-driven ransomware (like FunkLocker) across APJ, fueled by Chinese underground services processing billions in illicit funds.