credential theft

The npm JavaScript ecosystem has once again been rocked by a coordinated malware campaign, this time targeting both cross-platform and Windows-specific environments through widely trusted packages. The incident, centered around the highly popular "is" package and several linting tools associated...

Interlock ransomware has quickly ascended from a little-known name in late 2024 to a top-tier threat that’s been hammering organizations across North America and Europe through 2025. While other ransomware groups have faltered or faded, Interlock actors show a relentless willingness to innovate...

Britain’s cybersecurity landscape is once again in sharp focus after confirmation that the UK’s National Cyber Security Centre (NCSC) has detected a “limited number” of domestic victims in the recent Microsoft hack campaign. While not on the scale of some prior, sweeping incidents, the attack...

In recent developments, cybersecurity researchers have uncovered a sophisticated phishing toolkit named PoisonSeed, designed to circumvent the robust protections offered by FIDO2 authentication. This malicious tool targets users of Microsoft 365, Google Workspace, and Okta by redirecting their...

The UK National Cyber Security Centre (NCSC) has formally attributed the 'Authentic Antics' malware attacks to APT28, also known as Fancy Bear, a threat actor linked to Russia's military intelligence service (GRU). This sophisticated malware campaign targets Microsoft 365 users, aiming to steal...

In an era where enterprise networks are under increasing threat from ever-more sophisticated adversaries, Microsoft’s introduction of delegated Managed Service Accounts (dMSAs) in Windows Server 2025 was heralded as a transformational leap for Windows security. Promising to eradicate a host of...

A critical vulnerability in DotNetNuke (DNN), catalogued as CVE-2025-52488, has placed the spotlight on the complex interplay of Windows file system operations, .NET behavior, and subtle Unicode normalization pitfalls. Although DNN is recognized for its robust enterprise-ready architecture and...

NTLM relay attacks, once thought to be a relic of the past, have re-emerged as a significant threat in modern Active Directory environments. Despite years of research and incremental security improvements, most enterprise domains remain susceptible to these attacks, creating wide-reaching risks...

The cybersecurity landscape has never been more volatile, and few recent warnings have reflected this more acutely than the joint Fact Sheet released by the Cybersecurity and Infrastructure Security Agency (CISA) in collaboration with the Federal Bureau of Investigation (FBI), the Department of...

In recent months, the cybersecurity landscape has been rocked by a rapidly escalating campaign in which cybercriminals have weaponized TeamFiltration, a penetration testing tool, to orchestrate massive attacks on Office 365 accounts. According to incident data and credible analyses from leading...

A new chapter in the ongoing battle for cloud security unfolded recently, as researchers disclosed a brazen and remarkably methodical campaign that has compromised over 80,000 user accounts spanning hundreds of organizations. The abuse of penetration testing tools—originally intended as shields...

A staggering wave of panic has rippled across the United States in the wake of what experts are calling one of the largest security breaches in digital history. More than 184 million passwords—alongside user emails and other sensitive personal data—have potentially been exposed, implicating some...

A massive data breach has triggered shockwaves throughout the cybersecurity landscape, with over 184 million passwords reportedly leaked and some of the world’s most prominent technology brands implicated. This incident is distinguished not only by its monumental scale but also by the...

The rapid evolution of cybercrime has brought forth a new era of sophisticated phishing operations, with attackers now leveraging complex “Phishing-as-a-Service” (PhaaS) platforms to target lucrative enterprise networks. One such operation, identified in research as Storm-1575 and more widely...

Phishing attacks continue to evolve, leveraging not only increasingly sophisticated social engineering techniques but also the legitimate tools and platforms users trust every day. The most recent wave of attacks, as publicized by cybersecurity researchers and industry reports, reveals that...

In the still-expanding digital landscape of 2024, another catastrophic cybersecurity incident has emerged, sending shockwaves across the United States and beyond. Over 184 million passwords, along with associated email addresses and critical login links, have been exposed in a sweeping data...

Phishing attacks are evolving at a rapid pace, becoming increasingly sophisticated, and exploiting trusted platforms in ways that challenge even tech-savvy users. Recently, cybersecurity researchers uncovered a troubling new scam leveraging Google Apps Script—a legitimate Google service—to...

As phishing threats continue to evolve, attackers are leveraging increasingly sophisticated methods that use legitimate cloud platforms to disguise their malicious campaigns. Recent research has uncovered a worrying trend: the abuse of Google Apps Script as a vehicle for launching convincing...

The recent disclosure of vulnerability CVE-2025-24071 in Microsoft’s Windows File Explorer serves as a stark reminder of how legacy systems and seemingly innocuous user actions can become the gateway to significant cyber threats. Affecting Windows 11 (23H2) and earlier versions that support...

Microsoft Windows users across the globe are facing a new and insidious threat that exploits a trusted channel—genuine purchase notification emails from Microsoft itself. In a sophisticated campaign first discovered by the security research team at Kaspersky, attackers are leveraging real...