Researchers detail JS#SMUGGLER, a multi-stage web attack using JavaScript, HTA, and PowerShell to deploy NetSupport RAT on ...

This week’s ThreatsDay Bulletin covers USB malware, fake crypto scams, CastleRAT, new cyber laws, and falling ransomware ...

Holiday peaks trigger sharp rises in credential-stuffing and account-takeover attempts; layered controls and strong password ...

Researchers detail FvncBot, SeedSnatcher, and a stronger ClayRat that widen Android data theft and device control tactics.

Active exploits target Sneeit plugin CVE-2025-6389 and ICTBroadcast CVE-2025-2611, enabling RCE, backdoors, and Frost DDoS ...

GTG-1002 shows how AI can scale intrusions fast. Here’s why static OAuth trust is risky for SaaS and how to verify apps and tokens nonstop.

MuddyWater’s UDPGangster malware uses macro phishing & UDP channels for remote control, data theft, payload delivery in ...

More than 30 security flaws in AI-powered IDEs allow data leaks and remote code execution, showing major risks in modern ...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday formally added a critical security flaw impacting ...

A zero-click browser attack uses polite email instructions to trigger agents that delete real files from Google Drive.

Critical XXE flaw CVE-2025-66516 affects multiple Apache Tika modules, exposing systems and requiring urgent updates.

AWS reports China-linked groups Earth Lamia and Jackpot Panda rapidly attacking the critical React2Shell CVE-2025-55182 RCE ...