A sophisticated botnet dubbed “Popa” has been traced back to Paragon Solutions, a publicly-traded Israeli surveillance technology firm. The botnet infected thousands of devices across multiple countries, deploying commercial spyware under the guise of legitimate operations. This revelation exposes t
A critical vulnerability in FIFA’s streaming infrastructure could have allowed attackers to remotely hijack World Cup broadcast streams, potentially exposing millions of viewers to malicious content. The flaw, discovered in the content delivery system, enabled unauthorized access to streaming server
TeamPCP, a sophisticated threat actor group, has weaponized the software industry’s obsession with rapid deployment cycles to execute widespread attacks. By exploiting the security gaps inherent in rushed development processes, inadequate testing, and minimal security reviews, the group has compromi
Microsoft has unveiled a sophisticated malware campaign distributing “Clipper” malware through USB-based LNK file worms that communicate with command-and-control servers over the Tor network. The malware intercepts cryptocurrency transactions by replacing wallet addresses in the clipboard, redirecti
The notorious hacktivist group TeamPCP exploited the “move fast and break things” mentality pervading open-source development to orchestrate a sophisticated supply chain attack. By targeting understaffed maintainers and leveraging rushed merge practices, the group injected malicious code into popula
A security researcher discovered a vulnerability in Google’s infrastructure but was denied a bug bounty reward despite Google acknowledging the flaw with “Nice catch!” The issue remains unpatched months later, raising questions about tech giants’ vulnerability disclosure programs and their commitmen
Competitive intelligence platform Klue suffered an OAuth token breach that exposed Salesforce customer data in connection with the widespread ‘Icarus’ attack campaign. Threat actors exploited compromised OAuth credentials to access sensitive sales and customer relationship data stored in connected S
Organizations accumulate security debt by deferring vulnerability remediation, creating compounding risk over time. The most critical subset—exposed vulnerabilities accessible from the internet or within critical attack paths—demands immediate prioritization. This article examines how to identify, c
DragonForce ransomware operators have weaponized Microsoft Teams as a covert communication channel to hide malware activity from security monitoring tools. By abusing the legitimate collaboration platform’s traffic, attackers successfully blend command-and-control communications within normal busine
A telecommunications company has been found granting new employees sudo-level administrative access to production databases containing unencrypted customer personally identifiable information (PII). This egregious security failure violates fundamental access control principles, exposing millions of