Whats The Hax?

This month in security with Tony Anscombe – July 2026 edition 2d ago Beyond the screenshot: Why you should verify what you see 3d ago Forgotten UEFI shims undermining Secure Boot 19d ago ESET Threat Report H1 2026 25d ago Cyber readiness for SMBs: Getting the basics right 30d ago This month in security with Tony Anscombe – June 2026 edition 33d ago Inside the inbox: Why cybercriminals want to break into your email account 34d ago SMB cyber readiness: the road to resilience starts here 37d ago Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances 38d ago ESET takes part in Operation Endgame to disrupt Amadey and Stealc 39d ago Killing me gently: Inside Gentlemen’s EDR killer framework 45d ago Protecting legacy OT systems against modern cyberthreats 46d ago FishMonger’s arsenal upgraded: SprySOCKS for Windows 47d ago EvilTokens: A phishing attack that doesn’t steal your password 48d ago OceanLotus: From external espionage to domestic targeting 52d ago Unpacking SMB cyber-readiness – and what makes or breaks it 53d ago Cybercriminals: the 'auditors' you never hired 54d ago Lessons for life: Why children’s data is a long-term identity risk 60d ago This month in security with Tony Anscombe – May 2026 edition 65d ago ESET APT Activity Report Q4 2025–Q1 2026 66d ago

Network Anomaly Detection in KATA 2d ago An analysis of how Network Anomaly Detection (NAD) rules work within Kaspersky Anti Targeted Attack, using Kerberoasting and DNS tunneling attacks as examples. OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia 3d ago Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging. Toy Ghouls’ new toy: the GenieLocker ransomware 3d ago Kaspersky experts dissect GenieLocker: new custom ransomware variants for Windows, Linux, and ESXi systems. We found this family in attacks by Toy Ghouls, a financially motivated extortion group. Mirage Kitten targets Middle East and Africa region with new malware 5d ago Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools. A new extortion cocktail: office printers, small ransoms, and BitLocker 12d ago We cover two recent cases of BitLocker extortion using RDP, MSSQL, RMM tools, web shells, and printers. The story includes TTPs and recommendations. New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery 12d ago Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses. HelloNet campaign: new malicious modules launched through the ViPNet update system 17d ago We identified targeted infection attempts against large Russian organizations using the ViPNet update system (a software suite for creating secure networks). GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration 17d ago Two-phase attacks with the GoSerpent backdoor, Stowaway RAT, ThumbcacheService and other tools aim to steal data from government entities in Southeast Asia. OkoBot: new sophisticated malware framework targets cryptocurrency users 18d ago Kaspersky GReAT experts dissect the new OkoBot campaign targeting cryptocurrency users. This complex framework employs TookPS, exfiltrates seed phrases, monitors Chromium-based browsers, and installs various malware strains, including the R... Threat landscape for industrial automation systems. Q1 2026 26d ago This report contains industrial threat statistics for Q1 2026, including industrial threat distribution by type, source, region and industry.

Max-severity Exchange server flaw under active exploitation by Kremlin hackers 2d ago New warnings that Russian operatives are targeting the emails of US nuclear scientists and defense contractors 9d ago Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes 10d ago US and allies say Russian hackers stole emails without social engineering 10d ago The United States and more than a dozen allied nations said on Thursday that Russian hackers stole emails from users of ​the Zimbra email program without having to fool them into opening ‌an attachment or clicking a link. If you pay a hacker’s ransom, chances are that they’ll come back for more 11d ago Proofpoint Research Finds 65% of Organizations Affected by Ransomware Say AI Made Attacks More Effective 11d ago Global study reveals that AI is amplifying phishing, impersonation and credential theft, transforming ransomware into a human-centric extortion problem 40% OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 19d ago Hackers find a new trick to collect Microsoft Entra user data without raising red flags 20d ago Suspected Chinese snoops caught breaking into universities' Roundcube mailservers 25d ago Proofpoint researcher tells The Reg: 'We estimate the total volume of targets would be a few dozen' New Cargo Theft Surge: From Lobster Heists To Bourbon Warehouse Scams 32d ago Cargo theft is evolving with cybercrime. Learn how organized crime is hijacking shipments—from a $400,000 lobster theft to a $500,000 bourbon heist—and what needs to be done.

Iran War’s Secondary Effects Shape 2026 US Violent Extremism 3d ago Dealing with AI-Generated Extortion 3d ago Ransomware is the Scoreboard 9d ago TAG-195 Upgrades MaaS Ecosystem with Modular Tools 10d ago Modern Attack Vectors | Recorded Future 11d ago Threat Hunting: A Guide | Recorded Future 13d ago Tracking Advanced Persistent Threat Groups | Recorded Future 16d ago AI Has Enhanced Iran’s Asymmetric Playbook During the 2026 Conflict 17d ago The Shift: A New Era of AI Regulation 18d ago The FBI Warned About Fake Permit Fees. The Harder Question Is Where the Money Goes. | Recorded Future 19d ago June 2026 CVE Landscape 23d ago RiskX interview video featuring Colin Mahony and Mastercard's Aditi Sawhney 24d ago The Threat Isn’t the Frontier Model 25d ago Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool 32d ago Where Expertise Meets Algorithm: The Insikt Group® Intelligence Edge 38d ago Evaluating Mexico’s New Cybersecurity Plan 38d ago FortiBleed Campaign Exposing Credentials for 73,932 FortiGate Systems 39d ago The Purchase Scam Tactic Headed for the World Cup | Recorded Future 40d ago State Digital Surveillance Risk Landscape 46d ago The Intelligence No One Else Has: Inside Recorded Future’s Proprietary Collection Engine 47d ago

Why the Open Secure AI Alliance Matters: Open Frontier Models, Open Deployment Flexibility 3d ago Tracking Over 35,000 Fake Sites in the 2026 World Cup Scam Wave 4d ago The Signs Were There: What the First Autonomous Ransomware Case Confirms 9d ago 13M+ Emails Sent in Tech Support Scam Targeting Users, Organizations in Japan 10d ago Inside the OpenAI – Hugging Face Incident: The AI Breach With No Human Attacker Behind It 10d ago Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure 10d ago Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass 11d ago Volume Is Not Risk: Making Sense of the 'Vulnpocalypse' 12d ago Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet 19d ago TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry 34d ago From Langflow to Monero: Inside CVE-2026-33017 Cryptominer 40d ago PeopleSoft PeopleTools Pre-Authentication RCE: A PSIGW SSRF Chain That Executes Inside the JVM 45d ago Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign 46d ago Governing Claude Enterprise in Environments Where Inline Controls Can't Go 51d ago GenAI Is Both Hunter and Hunted at Pwn2Own Berlin 2026 53d ago Old WinRAR Flaw Fuels Attacks on Ukraine: How Unmanaged Software Keeps the Door Open 55d ago Pwn2Own Berlin 2026: On the Ground With TrendAI™ ZDI's Biggest AI Showdown Yet 62d ago Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet 68d ago Analyzing Void Dokkaebi’s Cython-Compiled InvisibleFerret Malware 72d ago One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign 73d ago

Forgotten UEFI shims undermining Secure Boot 19d ago ESET Threat Report H1 2026 25d ago Cyber readiness for SMBs: Getting the basics right 30d ago This month in security with Tony Anscombe – June 2026 edition 33d ago Inside the inbox: Why cybercriminals want to break into your email account 34d ago SMB cyber readiness: the road to resilience starts here 37d ago Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances 38d ago ESET takes part in Operation Endgame to disrupt Amadey and Stealc 39d ago Killing me gently: Inside Gentlemen’s EDR killer framework 45d ago Protecting legacy OT systems against modern cyberthreats 46d ago FishMonger’s arsenal upgraded: SprySOCKS for Windows 47d ago EvilTokens: A phishing attack that doesn’t steal your password 48d ago OceanLotus: From external espionage to domestic targeting 52d ago Unpacking SMB cyber-readiness – and what makes or breaks it 53d ago Cybercriminals: the 'auditors' you never hired 54d ago Lessons for life: Why children’s data is a long-term identity risk 60d ago This month in security with Tony Anscombe – May 2026 edition 65d ago ESET APT Activity Report Q4 2025–Q1 2026 66d ago What to consider before asking an AI chatbot for health advice 67d ago BTMOB: A stealthy RAT burrowing deep into Android devices 68d ago Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise 72d ago Webworm: New burrowing techniques 74d ago The quest for greater tech independence 75d ago Why geopolitical turmoil is a gift for scammers, and how to stay safe 79d ago FrostyNeighbor: Fresh mischief and digital shenanigans 80d ago Eyes wide open: How to mitigate the security and privacy risks of smart glasses 83d ago Fake call logs, real payments: How CallPhantom tricks Android users 87d ago Fixing the password problem is as easy as 123456 87d ago A rigged game: ScarCruft compromises gaming platform in a supply-chain attack 89d ago This month in security with Tony Anscombe – April 2026 edition 94d ago The calm before the ransom: What you see is not all there is 100d ago GopherWhisper: A burrow full of malware 101d ago New NGate variant hides in a trojanized NFC payment app 103d ago What the ransom note won’t say 104d ago That data breach alert might be a trap 107d ago Supply chain dependencies: Have you checked your blind spot? 108d ago Recovery scammers hit you when you’re down: Here’s how to avoid a second strike 114d ago As breakout time accelerates, prevention-first cybersecurity takes center stage 117d ago Digital assets after death: Managing risks to your loved one’s digital estate 123d ago This month in security with Tony Anscombe – March 2026 edition 124d ago RSAC 2026 wrap-up – Week in security with Tony Anscombe 128d ago A cunning predator: How Silver Fox preys on Japanese firms this tax season 128d ago Virtual machines, virtually everywhere – and with real security gaps 130d ago Cloud workload security: Mind the gaps 131d ago Move fast and save things: A quick guide to recovering a hacked account 135d ago EDR killers explained: Beyond the drivers 136d ago Face value: What it takes to fool facial recognition 142d ago Cyber fallout from the Iran war: What to have on your radar 143d ago

Student Loan Breach Exposes 2.5M Records 1432d ago 2.5 million people were affected, in a breach that could spell more trouble down the line. Watering Hole Attacks Push ScanBox Keylogger 1433d ago Researchers uncover a watering hole attack likely carried out by APT TA423, which attempts to plant the ScanBox JavaScript-based reconnaissance tool. Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms 1434d ago Over 130 companies tangled in sprawling phishing campaign that spoofed a multi-factor authentication system. Ransomware Attacks are on the Rise 1437d ago Lockbit is by far this summer’s most prolific ransomware group, trailed by two offshoots of the Conti group. Cybercriminals Are Selling Access to Chinese Surveillance Cameras 1437d ago Tens of thousands of cameras have failed to patch a critical, 11-month-old CVE, leaving thousands of organizations exposed. Twitter Whistleblower Complaint: The TL;DR Version 1439d ago Twitter is blasted for security and privacy lapses by the company’s former head of security who alleges the social media giant’s actions amount to a national security risk. Firewall Bug Under Active Attack Triggers CISA Warning 1440d ago CISA is warning that Palo Alto Networks’ PAN-OS is under active attack and needs to be patched ASAP. Fake Reservation Links Prey on Weary Travelers 1441d ago Fake travel reservations are exacting more pain from the travel weary, already dealing with the misery of canceled flights and overbooked hotels. iPhone Users Urged to Update to Patch 2 Zero-Days 1444d ago Separate fixes to macOS and iOS patch respective flaws in the kernel and WebKit that can allow threat actors to take over devices and are under attack. Google Patches Chrome’s Fifth Zero-Day of the Year 1445d ago An insufficient validation input flaw, one of 11 patched in an update this week, could allow for arbitrary code execution and is under active attack.