Windows — Medium

Introduction :

How to integrate ReconFTW with KaliGPT (or an LLM-assisted workflow) Short version: use ReconFTW to produce structured output, then feed…

A Critical (CVSS 9.0) flaw in W3 Total Cache (CVE-2025-9501) allows unauthenticated attackers to execute arbitrary PHP code via a crafted comment. 1M+ sites are at risk. Update to v2.8.13.

The DOJ announced five guilty pleas and $15M in crypto forfeiture seized from APT38. Facilitators helped North Korean IT workers fraudulently earn $2.2M from 136 US companies to fund the DPRK regime.

Israel disclosed SpearSpecter: an IRGC-IO espionage campaign using weeks-long WhatsApp social engineering and search-ms/WebDAV abuse to deploy the fileless TAMECAT PowerShell backdoor with Discord/Telegram C2.

Jamf exposed DigitStealer, an advanced macOS infostealer that checks for Apple M2+ chips. It uses Cloudflare Pages for delivery, JXA for stealth, and modifies Ledger Live to steal crypto wallets via DNS TXT C2.

Researchers at Palo Alto Networks Unit 42 have uncovered two expansive and interconnected malware campaigns active throughout 2025, both designed to mass-distribute Gh0st RAT variants to Chinese-s…

eSentire’s Threat Response Unit (TRU) has uncovered a widespread malware operation leveraging a deceptive social-engineering technique known as ClickFix to deliver a newly rebranded version of the…

Elastic exposed Dragon Breath APT's new RoningLoader malware. It uses PPL abuse and a signed kernel driver (ollama.sys) to disable Windows Defender and inject a modified gh0st RAT for espionage.

CISA/Europol updated their advisory on Akira Ransomware, confirming $244M in profits. The group now encrypts Nutanix AHV VMs and performs data exfiltration in just two hours via VPN flaws.

Fallos en autenticación, gestión de tokens JWT y mitigación. Detección de ataques de persistencia y fuerza bruta.

If you’ve ever popped a shell on a Windows network without firing a single exploit — chances are, you’ve witnessed the dark magic of NTLM…

A writeup for “Shock and Silence” on TryHackMe.

This alert walkthrough covers the full investigation of EventID 235, where a SQL Injection attempt was detected. Below is an enhanced and…

IAAA Failures

Most cybersecurity “labs” stop at screenshots and theory.

Let’s jump right into it. Below are some simple checklists that every individual or business should follow. These fundamentals help protect…

Learn how the web works, common website security risks, and protections for a safer internet.

It always happens the same way.