Zimperium found 760+ Android apps exploiting NFC/HCE to steal payment data. The malware impersonates 20 banks across Russia, Poland, and Brazil, using Telegram for criminal coordination.

Researchers at Arctic Wolf Labs have uncovered an extensive cyber espionage campaign by UNC6384, a Chinese-affiliated threat actor, targeting European diplomatic entities across Hungary, Belgium, …

In a recent blog post, Google revealed that “in the last 12 months, fraudsters have used advanced AI tools to create more convincing schemes, resulting in over $400 billion in stolen funds globall…

Researchers at Gen Threat Labs have identified two new toolsets in active use by North Korean state-sponsored groups, underscoring the regime’s continued investment in advanced cyber-espionage and…

ASEC confirmed Kinsing is exploiting Apache ActiveMQ RCE (CVE-2023-46604) to deploy XMRig cryptominer. The group now integrates Sharpire, Cobalt Strike, and Meterpreter for advanced post-exploitation.

Silent Push found AdaptixC2, an open-source pen-testing framework, is now used by Russian cybercriminals and Akira RaaS. The developer's Russian-language activity suggests strong ties to the threat ecosystem.

Cyfirma exposed Android/BankBot-YNRK, a Trojan cloning Indonesia’s Digital ID app to steal credentials and crypto assets. It uses anti-emulation checks and JobScheduler for persistent device takeover.

Cybereason exposed Tangerine Turkey, a VBScript worm that spreads via USB drives. It uses LOLBins (printui.exe) and Windows Defender exclusions to deploy the XMRig cryptominer for profit.

Perplexity AI licenses Getty Images' visual archives to integrate visuals into search with proper attribution, marking a strategic shift in AI copyright battles.

Elastic patched a Critical EoP flaw (CVE-2025-37736) in ECE (v3.8.3/4.0.3) where the readonly user can create admin users and inject new API keys by bypassing authorization checks.

Here’s a little tip for testing XSS in chatbot instances; when you inject an XSS payload as a user message and it doesn’t execute, don’t…

A brutally honest look at why we’re all terrible at protecting our digital lives

Nothing wrong with adding a few more bodies to the pile.

When securing a website, many focus on the obvious security aspects such as HTTPS, regular updates, and reputable hosting providers. But…

I. SSRF with blacklist-based input filter

I. DOM XSS via client-side prototype pollution

Untuk kalian yang ngaku pengen jadi hacker, pernah dengar istilah BAC atau Broken Access Control?

From Chapter 13 Trustee Court Attendant to Beauty Boss: How I Built the American Dream (Before It Was Stolen) Part One: The Beginning - When Dreams Were Still Safe By Krystal N. Pereyra, Licensed …

When I first started building web apps that needed to connect with third-party APIs Google, GitHub, Twitter I thought all I needed was an…

Threat intelligence isn’t just collecting IOCs from Twitter feeds. It’s about transforming raw data into actionable insights that guide…

A Memory Analysis Challenge Using Volatility 2.6.