Over 50,000 Microsoft Azure AD user records from the aviation industry were exposed due to a misconfigured, unauthenticated API, revealing sensitive data and posing major risks.

A new AMOS macOS stealer variant is using typo-squatted Spectrum domains in a clever cross-platform social engineering campaign. Stay vigilant!

A fileless AsyncRAT campaign, dubbed "Clickfix," targets German-speaking users, luring them into executing obfuscated PowerShell payloads via fake verification prompts.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

As families across India prepare to celebrate Raksha Bandhan, cybercriminals are also gearing up — not with gifts, but with fraudulent campaigns designed to steal money and personal data. In a rec…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

A new Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and enterprise apps. The Loader-as-a-Service model saw a 230% spike this summer.

The Morte botnet campaign is exploiting command injection flaws to hijack SOHO routers and IoT devices for mining and Mirai-style attacks. The operation grew by 230% this summer.

Crack the code with me through CloudSEK’s thrilling CTF challenge! From sneaky Telegram bots to crafty GraphQL hacks and MFA bypasses, this…

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Author: Akash Gupta

This CTF consisted of four challenges—one focused on scripting and three based on web exploitation. The write-up below explains how each…

CHALLENGE-1

Complete walkthrough of Nitro, Bad Feedback, Triangle, and Ticket with detailed exploitation techniques

As tax season approaches, a sophisticated cyber-espionage campaign is targeting Indian organizations with highly convincing phishing lures. While initially mistaken for a familiar adversary, a new…

The RondoDoX botnet has resurfaced with a potent new arsenal, shifting its sights from simple routers to enterprise-grade web frameworks. A new intelligence report from CloudSEK details a sprawlin…

The notorious MuddyWater APT group has overhauled its arsenal, ditching its traditional scripting tools for a sophisticated new weapon built to evade detection. In a new report released by CloudSE…

The Iranian threat collective MuddyWater has intensified its offensives against organizations across the Middle East, deploying a sophisticated

CloudSEK exposes "RedLineCyber," an impostor hijacking crypto clipboards on Discord. This stealthy malware drains wallets without a C2 server.