Wordfence exposed a Magecart campaign using a rogue WooCommerce plugin to hide skimmer code in a fake PNG image. The malware uses an AJAX backdoor to maintain access and steal customer cards.

Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.

XLab exposed RPX_Client, a new PolarEdge malware that turns IoT/router devices into a global ORB proxy network. The ELF binary uses XOR to encrypt config and spreads across 40 countries.

Unit 42 exposed Airstalk, a suspected nation-state malware that abuses VMware AirWatch (MDM) APIs for a covert C2 dead drop. The tool is used to steal credentials and browser data in supply chain attacks.

Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.

Progress patched a High-severity DoS flaw (CVE-2025-10932) in MOVEit Transfer’s AS2 module. The vulnerability allows unauthenticated attackers to exhaust server resources. Patch to v2025.0.3 immediately.

Meta description: Become a sharper bug hunter. This professional guide by Monu Jangra (Certified Penetration Tester, LPT Master, CPENT…

“Discovery is the jigsaw — exploitation is finishing the picture.”

The photo looks clean. You cropped it, tweaked the lighting, maybe ran a filter. You think it’s anonymous. You post it.

Selama bertahun-tahun, banyak yang percaya bahwa iOS adalah sistem operasi paling aman di dunia mobile. Tapi apakah itu masih relevan di…

Protecting your money online has never been more important — here’s how to stay safe in the digital age.

Artificial intelligence (AI) has always carried an aura of invincibility. We trust it to recognize faces, drive cars, filter spam, and even…

By: Travis Ray Caverhill

“The skills I honed defending systems unexpectedly became my tools for creation.”

Threat hunting sounds exciting in theory, but how do you actually do it? In this post, I’ll break down the complete threat hunting process…

This month was all about agent security getting real. We saw multiple prompt-to-RCE paths, MCP ecosystem abuses, AI browsers falling for…

“fristileaks 1.3” is published by satoshi_nakamura.

After my internship ended, I thought I would land a job in cybersecurity pretty soon. I had worked hard, months of late nights, labs, CTFs…

Ahoy fellow hunters🏹,

New high score!