Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today.
Um relatório da empresa de cibersegurança Check Point Software identificou cerca de 7 mil sites falsos da Amazon feitos nos últimos meses. A tendência é de que as páginas sejam usadas para aplicar golpes durante o Prime Day, período de ofertas da varejista. Minha conta da Amaz…
Two members of the 'Scattered Spider' cybercrime group pleaded guilty to hacking the Transport for London (TfL) systems in 2024. [...]
Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts. Every skill security scanner the firm tested it against marked it safe. The payload …
LastPass announced that hackers accessed customer data from its Salesforce environment after stealing the company's OAuth tokens in the Klue supply chain attack earlier this month. [...]
SocGholish uses traffic distribution systems (TDSs) to provide initial access into victims' networks for cybercrime groups such as the notorious Evil Corp.
The threat actors engineered a Golang-based sniffer to target 430,000 FortiGate firewalls and identify 110 million credentials in the ongoing global campaign.
Phishing, BEC, and account takeover attacks continue to overwhelm security teams with alerts and investigations. This webinar explores how behavioral AI can help automate detection and response workflows, reducing alert fatigue and improving operational efficiency. [...]
Microsoft researchers warn of a new dual-action cryptocurrency clipper (CryptoBandits Malware) spreading through USB devices to alter wallet addresses and steal crypto assets.
Uma nova campanha maliciosa está usando anúncios falsos no Google para distribuir um malware chamado OXLOADER, criado para instalar o ladrão de informações CastleStealer em computadores Windows. Segundo os pesquisadores, os indícios apontam para um grupo provavelmente falante de …
A botnet AryStinger infectou cerca de 4,3 mil roteadores antigos para criar uma rede global usada por criminosos em atividades de reconhecimento, ocultação de tráfego e apoio a ataques contra outros alvos. A campanha foi documentada pela QiAnXin XLab e mira principalmente roteado…
Every weapon begins as an extension of the hand that holds it. The spear lengthened the reach of the arm. The bow sent the point flying without the throw. The rifle placed a man's death a quarter mile beyond his sight, and the aircraft carried that death across oceans. At each tu…
Learn how AI, deepfakes, synthetic identities and fraud-as-a-service may reshape iGaming risk, and what security teams can do to detect future threats in 2027.
Uma nova campanha de malware está se espalhando pelo WhatsApp e mirando usuários de Windows em vários países, incluindo o Brasil. O ataque usa mensagens enviadas a partir de contas reais comprometidas, o que aumenta a chance de a vítima confiar no remetente. A ameaça foi observad…
Two teenagers face sentencing after admitting to a massive Scattered Spider cyberattack that hit Transport for London (TfL) and US healthcare networks.
Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan (RAT). The list of identified packages, is below - aes-decode-runner-pro (145 downloads) postcss-minify-selector (256 downloads) po…
Direct messages sent via WhatsApp are being used to distribute malicious Visual Basic Script (VBScript) files that lead to the installation of legitimate Remote Monitoring and Management (RMM) software. Per findings from Kaspersky, the active campaign is targeting users of Whats…
An ongoing malware campaign is targeting WhatsApp users in multiple countries with deceptive messages that push VBScript files, leading to remote system access. [...]
The JaredFromSubway Ethereum MEV (Maximal Extractable Value) bot suffered a $15 million loss after an attacker manipulated the opportunity-detection logic by creating fake cryptocurrency trading opportunities. [...]
A Tata Electronics, subsidiária do conglomerado indiano Tata Sons e fornecedora da cadeia de suprimentos da Apple e Tesla, confirmou hoje (22) ter sofrido um ataque cibernético após o grupo World Leaks publicar mais de 200 mil arquivos na dark web, incluindo documentos relacionad…
