Tag: threat
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…
-
Critical RCE flaw allows full takeover of n8n AI workflow platform
Tags: ai, api, attack, authentication, cloud, credentials, data, email, exploit, flaw, leak, LLM, password, rce, remote-code-execution, threat, vulnerabilityformWebhook function used by n8n Form nodes to receive data doesn’t validate whether the Content-Type field of the POST request submitted by the user is set to multipart/form-data.Imagine a very common use case in which n8n has been used to build a chat interface that allows users to upload files to the system, for example,…
-
NDSS 2025 Automatic Insecurity: Exploring Email Auto-configuration In The Wild
Tags: attack, conference, credentials, cyber, email, Internet, network, technology, threat, vulnerabilitySession 8A: Email Security Authors, Creators & Presenters: Shushang Wen (School of Cyber Science and Technology, University of Science and Technology of China), Yiming Zhang (Tsinghua University), Yuxiang Shen (School of Cyber Science and Technology, University of Science and Technology of China), Bingyu Li (School of Cyber Science and Technology, Beihang University), Haixin Duan (Tsinghua…
-
In 2026, Hackers Want AI: Threat Intel on Vibe Hacking & HackGPT
Cybercriminals are increasingly using AI to lower the barrier to entry for fraud and hacking, shifting from skill-based to AI-assisted attacks known as “vibe hacking.” Flare examines how underground forums promote AI tools, jailbreak techniques, and so-called “Hacking-GPT” services that promise ease rather than technical mastery. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/in-2026-hackers-want-ai-threat-intel-on-vibe-hacking-and-hackgpt/
-
Neue Ransomware-Bedrohung zielt auf deutsche Unternehmen
Tags: backup, ciso, cloud, cyberattack, encryption, extortion, firewall, germany, infrastructure, intelligence, network, ransomware, threat, tool, vmware, vulnerabilityDer Ransomware-Dienst Ransomhouse nutzt jetzt eine komplexe Dual-Schlüssel-Verschlüsselung und automatisierte Angriffe auf VMware ESXi.Sicherheitsexperten haben kürzlich festgestellt, dass die Ransomware-Gruppe Jolly Scorpius ihren RaaS-(Ransomware as a Service)-Dienst Ransomhouse massiv verbessert hat. Wie das Threat-Intelligence-Team von Palo Alto Networks berichtet, nutzt die Gruppe jetzt ein fortschrittliches duales Verschlüsselungssystem.Die Angriffe basieren auf einer aktualisierten Version des Verschlüsselungs-Trojaner…
-
Lack of MFA is Common Thread in Vast Cloud Credential Heist
An emerging threat actor that goes by Zestix used an assortment of infostealers to obtain credentials and breach file-sharing instances of approximately 50 enterprises. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/lack-mfa-common-thread-vast-cloud-credential-heist
-
International Threats: Themes for Regional Phishing Campaigns
Cofense Intelligence relies on over 35 million trained employees from around the world, therefore a considerable number of analyzed campaigns are written in languages other than English. This report covers from May 2023 to May 2025 and focuses on the overall themes of campaigns in the top five most commonly seen languages besides English that…
-
Hackers actively exploit critical RCE flaw in legacy D-Link DSL routers
Attackers are exploiting a critical flaw (CVE-2026-0625) in old D-Link DSL routers that allows remote command execution. Threat actors are actively exploiting a critical RCE flaw, tracked as CVE-2026-0625 (CVSS score of 9.3), in legacy D-Link DSL routers. The vulnerability is an improper neutralization of special elements used in an OS Command (‘OS Command Injection’),…
-
Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing
Threat actors engaging in phishing attacks are exploiting routing scenarios and misconfigured spoof protections to impersonate organizations’ domains and distribute emails that appear as if they have been sent internally.”Threat actors have leveraged this vector to deliver a wide variety of phishing messages related to various phishing-as-a-service (PhaaS) platforms such as Tycoon 2FA,” the First…
-
MFA Failure Enables Infostealer Breach At 50 Enterprises
Threat actor “Zestix” was able to breach around 50 firms using infostealers because they lacked multi-factor authentication First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mfa-failure-infostealer-breach-50/
-
Dark Web Intelligence: How to Leverage OSINT for Proactive Threat Mitigation
Staying one step ahead of cybercriminals requires a proactive approach. Integrating dark web intelligence into your open-source intelligence (OSINT) gives you an early view of emerging threats. As security expert Daniel Collyer says, dark web intelligence is “an essential part of a good OSINT strategy,” it’s the information that’s invisible on the surface web. Open-source intelligence is when you take all the publicly available data and turn it..…
-
Securing the Knowledge Layer: Enterprise Security Architecture Frameworks for Proprietary Data Integration With Large Language Models
A practical overview of security architectures, threat models, and controls for protecting proprietary enterprise data in retrieval-augmented generation (RAG) systems. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/01/securing-the-knowledge-layer-enterprise-security-architecture-frameworks-for-proprietary-data-integration-with-large-language-models/
-
The Shift Left of Boom: Making Cyberthreat Prevention Practical Again
The old saying ‘prevention is better than cure’ has lost value in today’s cybersecurity industry. Instead, security teams are advised to assume that the business has been breached and focus on threat detection, investigation, response and recovery. However, during cyber incident postmortems, it is not uncommon to find that the business owned the tool that would have protected it against the breach……
-
Google Warns of High-Risk WebView Vulnerability That Breaks Security Controls
Google released Chrome versions 143.0.7499.192/.193 on January 6, 2026, to patch a high-severity vulnerability in WebView that could allow attackers to bypass important security policies. The flaw, tracked as CVE-2026-0628, represents a significant threat to users whose browsers rely on WebView’s policy enforcement framework to block malicious content. Attribute Details CVE ID CVE-2026-0628 Severity High…
-
8 things CISOs can’t afford to get wrong in 2026
Tags: access, advisory, ai, attack, automation, awareness, breach, business, ciso, cloud, communications, compliance, control, cyber, cyberattack, cybersecurity, data, data-breach, defense, dora, encryption, finance, firmware, GDPR, healthcare, identity, incident response, india, infrastructure, injection, insurance, intelligence, iot, jobs, law, malicious, monitoring, network, privacy, ransom, regulation, resilience, risk, saas, scam, service, software, strategy, supply-chain, tactics, technology, theft, threat, tool, training, update, vulnerability, zero-trust“Identity and access controls for AI agents and AI platforms are one of the most important areas of concern for CISOs,” says Jason Stading, director at global technology research and advisory firm ISG. “Right now, permissions and access rights for AI are a black box in many areas. We will see a major push over…
-
Automated data poisoning proposed as a solution for AI theft threat
Tags: ai, breach, business, cyber, data, encryption, framework, intelligence, LLM, malicious, microsoft, resilience, risk, risk-management, technology, theft, threatKnowledge graphs 101: A bit of background about knowledge graphs: LLMs use a technique called Retrieval-Augmented Generation (RAG) to search for information based on a user query and provide the results as additional reference for the AI system’s answer generation. In 2024, Microsoft introduced GraphRAG to help LLMs answer queries needing information beyond the data on…
-
Seceon Launches aiBAS360: AI-Powered Breach Attack Simulation Platform Enables Organizations to Test Defenses Against Real-World APTs and Threat Actors
New Platform Features MITRE ATT&CK Framework Mapping and is Now Available Within OTM Platform as well as in aiSIEM-CGuard 2.0; Global Webinar Series Underway to Showcase Capabilities to MSSP Partners Worldwide WESTFORD, Mass., Jan. 6, 2026 /PRNewswire/, Seceon Inc., a global leader in AI/ML-driven cybersecurity solutions, today announced the general availability of aiBAS360, its innovative Breach First…
-
Threats to Critical Infrastructure Expected to Intensify
Geopolitics Puts OT at Greater Risk From Nation States, Criminals and Hacktivists. Attacks against critical infrastructure are expected to increase in scope and intensity including hacks on operational technology systems. State actors are now looking for ways to cause damage and disrupt operations, rather than simply steal secrets, according to cybersecurity experts. First seen on…
-
New D-Link flaw in legacy DSL routers actively exploited in attacks
Threat actors are exploiting a recently discovered command injection vulnerability that affects multiple D-Link DSL gateway routers that went out of support years ago. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-d-link-flaw-in-legacy-dsl-routers-actively-exploited-in-attacks/
-
Is GenAI Leaving Two-Thirds of Security Teams Behind?
Security teams have a singular goal: detect and stop threats from disrupting business. Attackers change tactics and networks evolve constantly, but defenders are the ones who will always bear the burden. Businesses are heavily adopting AI to become more efficient, scale, and augment the human workforce, yet defenders must figure out how to secure any..…
-
CloudEyE MaaS Downloader and Cryptor Infects Over 100,000 Users Globally
ESET Research has uncovered a significant surge in CloudEye malware detections, with a 30-fold increase in the second half of 2025. The security firm detected more than 100,000 infection attempts over the six months, signaling a widespread threat affecting organizations globally. CloudEyE operates as a Malware-as-a-Service (MaaS) downloader and cryptor designed to conceal and deploy…
-
Threat Actors Exploit Office Assistant to Deliver Malicious Mltab Browser Plugin
A sophisticated malware campaign has been discovered exploiting Office Assistant, a widely used AI-powered productivity software in China, to distribute a malicious browser plugin that hijacks user traffic and exfiltrates sensitive information. The RedDrip Team from QiAnXin Technology’s Threat Intelligence Center uncovered this operation, which has been active since at least May 2024 and has…
-
Threat Actors Exploit Commodity Loader in Targeted Email Campaigns Against Organizations
Cyble Research and Intelligence Labs (CRIL) has identified a sophisticated, multi-stage attack campaign deploying a shared commodity loader across multiple threat actor groups. The operation demonstrates advanced operational security and represents a significant threat to manufacturing and government organizations in Italy, Finland, and Saudi Arabia. The campaign combines precision targeting with cutting-edge evasion techniques, utilizing…