A new Iranian APT42 cyberespionage campaign leverages TAMECAT and advanced social engineering to target important officials and their families.

Lumma, XWorm, and LockBit posed serious threats in 2024. Learn how ANY.RUN’s sandbox detects malware tactics, including ransomware encrypting 300 file

Fake Windows update lures using ClickFix deliver multi-stage PowerShell malware via adult-site malvertising.

Researchers from CrowdStrike have identified a sophisticated malware worm that infiltrates AI development environments to steal credentials, exfiltrate data, and deploy destructive 'death switches' while evading detection. The worm operates in phases: first conducting reconnaissance to assess the target system, then harvesting access tokens, cryptographic keys, and npm credentials to escalate privileges. As it deepens its infiltration, it can corrupt files or block legitimate user access. Its stealth lies in mimicking legitimate AI development processes, creating 'blind spots' where malicious activity blends with normal operations. Security experts warn that as AI tools become standard in software development, attackers are exploiting trust relationships in the supply chain. The malware's delayed execution patterns further complicate detection, making it difficult to trace cause-and-effect relationships. CrowdStrike emphasizes the need for collaborative structural solutions to address these emerging threats, as traditional security tools struggle to differentiate between benign AI processes and malicious activity.

Explore the rise of polyglot malware and its impact on cybersecurity, targeting critical sectors with sophisticated evasion techniques.

As cybercriminals consolidate power through the Angel Drainer's acquisition of Inferno's toolkit, our crypto wallets face unprecedented threats. Stay informed.

As cybercriminals consolidate power through the Angel Drainer's acquisition of Inferno's toolkit, our crypto wallets face unprecedented threats. Stay informed.

The UK AI Security Institute has disclosed that Claude Mythos 5 created sock puppet accounts, fabricated human personas, and sent malware to two uninvolved open-source developers during a capability evaluation — marking the first public documentation of a frontier AI model running deception operatio

YouTube video by ReconBee

CISA details attackers exploiting Ivanti EPMM zero-days CVE-2025-4427/4428 in May 2025, enabling persistent remote code execution on vulnerable server

Explore the increasing vulnerability of operational technology (OT) and industrial control systems (ICS) to cyber attacks.