Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks By Bill Toulas June 1, 2026 06:14 PM A threat actor tracked as DriveSurge has been operating large-scale malware distribution…
…Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not…
…Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not…
… WithSecure notes that while GreyVibe activity is consistent with a nation-state operation, the threat actor "lacked the level of sophistication and operational discipline typically associated with mature nation-state actors." Furthermore, the PhantomRelay malware has been seen in cybercrime activit… …
…single external Teams chat moved the operator from cold outreach to a persistent foothold in under five minutes.” The campaign has been active since at least April 2026, with KongTuke rotating through…
…Despite an international law enforcement operation disrupting the Tycoon2FA phishing platform in March, the malicious operation was rebuilt on new infrastructure and quickly returned to regular activity levels. Earlier this month, Abnormal…
…authentication for Docker and Kubernetes services, following least-privilege principles, and avoiding storing secrets in plaintext. The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real…
… Infrastructure analysis suggests that the hackers follow a partially decentralized operational model, in which multiple clusters share similar certificate-generation patterns and tooling but target distinct victim sets. …
…Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not…
… Next, they accessed OneDrive and SharePoint in Microsoft 365, searching for VPN configurations and IT operational files, looking for remote access details that could help with lateral movement from the cloud into the endpoint network. “In one instance, Storm-2949 used the OneDrive web interface to … …