A sophisticated AsyncRAT malware campaign is leveraging DLL sideloading techniques alongside legitimate ScreenConnect remote access software to establish persistent, stealthy access to compromised systems. Attackers are exploiting trusted application processes to load malicious DLLs, evading traditi
A sophisticated phishing toolkit named ARToken is actively targeting Microsoft 365 users by exploiting OAuth’s legitimate Device Authorization Flow (Device Code Flow). The panel automates token theft through adversary-in-the-middle attacks, enabling attackers to bypass multi-factor authentication, c
The CitrixBleed vulnerability (CVE-2023-4966) affecting Citrix NetScaler ADC and Gateway appliances has been actively exploited within 24 hours of public disclosure. This critical session hijacking flaw allows unauthenticated attackers to steal valid session tokens and bypass multifactor authenticat
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-21298, a critical Microsoft SharePoint Server vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. This deserialization flaw allows authenticated attackers to execute arbitrary code remotely on vulner
The FortiBleed vulnerability (CVE-2024-23113) is being actively exploited by INC Ransom and Lynx ransomware groups to steal credentials from vulnerable Fortinet devices. This critical authentication bypass flaw affects FortiOS SSL-VPN and allows attackers to extract session tokens and authentication
The Court of Justice of the European Union (CJEU) has upheld a €4.1 billion antitrust fine against Google for abusing its Android market dominance. The ruling highlights serious concerns about Google’s control over user data access, app installation restrictions, and the security implications of its
The Department of Homeland Security (DHS) has confirmed a security breach of the Homeland Security Information Network (HSIN), a critical platform used by federal, state, local, and private sector entities to share sensitive information. The breach potentially exposed communications, operational dat
Cybercriminals are exploiting human psychology and Microsoft 365’s OAuth consent mechanisms through sophisticated social engineering attacks dubbed “ConsentFix” and “ClickFix.” These attacks bypass multi-factor authentication (MFA) entirely by tricking users into granting malicious OAuth application
Threat actors are abusing the legitimate VLC Media Player executable to sideload malicious DLL files and deploy ValleyRAT, a sophisticated remote access trojan. By exploiting DLL search order hijacking, attackers use a genuine VLC component (vlc.exe) alongside a weaponized libvlc.dll to establish pe
The advanced persistent threat (APT) actor ToddyCat has deployed a sophisticated new malware variant called Umbrij that exploits OAuth authentication to access Gmail accounts through legitimate Google APIs. This technique allows attackers to bypass traditional email security controls and exfiltrate