Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords
TrustSink, a post-compromise credential-phishing technique that abuses Microsoft Entra External Authentication Methods (EAMs) to place a rogue password promp...
general
20 articles
Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $...
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Infostealer malware is increasingly becoming the bridge between a compromised developer workstation and an enterprise cloud environment, with Lumma, RedLine,...
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service princ...
Measuring the Value of SecOps; BH Interviews with Fortra, Helmet, Above, & Keeper - Christopher Crowley, Josh Davies, Kaushik Shanadi, Tricia Howard, Darren Guccione - ESW #478
U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
U.S.
Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts
A former U.S.
Operation Master Exploits GlobalProtect CVE-2026-0257 and Deploys AdaptixC2 Across Enterprise Networks
“Operation Master,” an end-to-end cybercrime operation that combined GlobalProtect VPN exploitation, web-application attacks, credential theft, data monetiza...
Citrix Patches Critical Zero Days Under Active Exploitation
Citrix has confirmed exploitation of two critical zero-day RCE bugs
LinkedIn tests a way for connections to verify your work history
LinkedIn is testing a way for members to verify the work and education history of people they know. The platform prompts verified members to confirm that the...
US soldier gets 70 months in prison for extorting 10 tech, telecom firms
A former U.S.
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug
Citrix has released patches for the critical NetScaler vulnerabilities tracked as CVE-2026-88771 and CVE-2026-88772. The post Citrix Confirms 2 NetScaler Zer...
New Python Infostealer Targets 17 Browsers to Steal Passwords, Cards and Session Cookies
A Python-based information stealer that targets data from 17 Chromium-based browsers, alongside Firefox, to harvest saved credentials, payment-card details, ...
CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
The U.S.
12 Best Cloud Encryption Solutions Compared (2026): Features & Pricing
For most estates, native KMS is the best starting point AWS KMS, Azure Key Vault, and Google Cloud KMS are usage-priced, deeply integrated, and publish their...
Kiteworks Urges Customers to Shut Down Servers Over Potential Zero-Day Threat
Kiteworks has lifted its emergency shutdown recommendation after advising customers to temporarily take their systems offline in response to credible intelli...
12 Best Cloud Compliance Tools Compared (2026): Features & Pricing
For most teams facing an audit, Vanta is the best overall compliance automation platform, with Drata the closest rival choose between them on integrations an...
11 Best GCP Security Tools Compared (2026): Features & Pricing
Securing Google Cloud starts with Security Command Center Standard included with every org and the best free first move while Wiz is the best third-party pla...
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
A Docker-focused botnet that repurposes the legitimate, open-source Hermes Agent framework as an interactive post-compromise control layer. The campaign, tra...
12 Best Azure Security Tools Compared (2026): Features & Pricing
For most Azure estates, Microsoft Defender for Cloud is the best starting point its free foundational tier plus published per-resource plans make it the only...