Mistic, a newly discovered backdoor, is being deployed in ransomware intrusion chains as a persistent access mechanism. This sophisticated malware combines advanced evasion techniques, encrypted command-and-control (C2) communications, and modular capabilities to maintain long-term access to comprom
Russian authorities continue using Cellebrite’s mobile forensic tools to extract data from activists’ devices despite the Israeli company’s contract termination. A recent case involving a human rights activist demonstrates that Russia’s existing stockpile of Cellebrite equipment remains operational,
A popular Chrome browser extension with over 10 million installations has been discovered containing dormant code injection capabilities that could execute arbitrary scripts on user browsers. The ad blocker, which appears legitimate on the surface, includes obfuscated functions that allow remote cod
A critical vulnerability lurking in cURL for 25 years has finally been patched, affecting an estimated 30 billion devices worldwide. This long-standing flaw impacted one of the most widely deployed software libraries in existence, embedded in everything from smartphones and IoT devices to enterprise
A sophisticated Adversary-in-the-Middle (AiTM) phishing kit targeting AWS Management Console users has been discovered in active campaigns. The kit intercepts authentication sessions in real time, capturing usernames, passwords, and multi-factor authentication (MFA) codes to hijack AWS accounts even
A critical vulnerability (CVE-2026-11374) in ManageEngine AD360’s Single Sign-On implementation allows attackers to predict authentication tokens, potentially gaining unauthorized access to integrated identity management systems. The flaw affects AD360 versions prior to build 6402 and enables attack
Recent research exposes critical flaws in Large Language Model (LLM) defense architectures through “role confusion” attacks, where prompt injections manipulate AI systems into misinterpreting instructions and security boundaries. The paper demonstrates how current safeguards fail when attackers expl
Brazil’s national emergency alert system was breached in a suspected cyberattack, sending fraudulent emergency notifications to millions of mobile devices nationwide. The unauthorized alert falsely warned citizens of an imminent threat, causing widespread panic and confusion. Authorities have launch
Google has released Gemini 3.5 Flash with computer use capabilities that enable autonomous AI agents to interact directly with systems, applications, and interfaces. While these features unlock powerful automation possibilities, they introduce significant security risks including unauthorized system
Artificial intelligence is fundamentally disrupting cybersecurity operations by discovering vulnerabilities faster than traditional security frameworks can handle. Organizations face an unprecedented challenge: AI-powered tools are identifying thousands of potential weaknesses daily, overwhelming ex