From Stars to Upvotes: Fake Reputation Fueling a Crypto Clipboard Hijacker
Key Points Introduction In this research, we analyze a clipboard hijacker campaign that is hidden inside a collection of “solutions” and “tools” that claim t...
research
20 articles
Protecting legacy OT systems against modern cyberthreats
Many manufacturing plants depend on OT systems that stay in service for many years. That long run can hide significant cybersecurity risks.
State Digital Surveillance Risk Landscape
Explore the state digital surveillance risk landscape. Learn how governments use spyware, AI, and network interception to monitor travelers and how to mitiga...
Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE
Unit 42 discovered a Vertex AI Python SDK vulnerability that allows remote code execution via bucket squatting. Read the article for more.
FishMonger’s arsenal upgraded: SprySOCKS for Windows
ESET researchers have discovered SprySOCKS for Windows, FishMonger’s backdoor weaponizing a kernel driver for advanced stealthiness
The Intelligence No One Else Has: Inside Recorded Future’s Proprietary Collection Engine
Learn how Recorded Future’s proprietary collection engine empowers organizations to move beyond reactive security. Discover the power of our four unique inte...
Inside the Modern SOC: The 72-Minute Race
Attackers can move from access to exfiltration in 72 minutes. Learn how modern SOC teams close the speed gap with Unit 42's AI-driven automation, threat hunt...
15th June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 15th June, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The Univer...
EvilTokens: A phishing attack that doesn’t steal your password
A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages
Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
Unit 42 has discovered a new macOS Tahoe 26 forensic artifact that tracks user menu selections across the operating system. Learn more here.
Factoring "short-sleeve" RSA keys with polynomials
What happens when the bits of an RSA private key are heavily biased toward 0 instead of being randomly generated? The public key’s bits could be biased enoug...
From SQLi to RCE – Exploiting LangGraph’s Checkpointer
By Yarden Porat AI agents need memory. Frameworks like LangGraph provide it through checkpointers – persistence layers that store execution state.
OceanLotus: From external espionage to domestic targeting
A shift in operational pattern of the infamous Vietnam-aligned APT group
Recorded Future Launches Impact and Metrics Dashboard
See the business value of your intelligence program in one live, continuously updated dashboard, built for the conversations that matter most with the execut...
Cyber-Enabled Maritime Sanctions Evasion
Discover how Iranian and Russian shadow fleets use a vast network of fake maritime websites and fraudulent documents to evade international sanctions
Unpacking SMB cyber-readiness – and what makes or breaks it
A company that's expecting a cyberattack but hasn’t actively prepared for it risks making the hardest decisions at the worst possible moment
2026 FIFA World Cup: What Public Safety Officials Need to Know
Prepare for the 2026 FIFA World Cup with expert analysis of the physical and cyber threat landscape.
China's Noncombatant Evacuation Operations: 2005–2025
Explore the Insikt Group study on 37 Chinese noncombatant evacuation operations (NEOs) from 2005–2025, revealing how China leverages SOEs and civilian resour...
Cybercriminals: the 'auditors' you never hired
Every organisation gets audited. The question is who does the auditing.
Russia’s Defense-Based Economy Risks Forcing Putin to Fight Wars
Western sanctions have tied Russia's elite patronage to the defense sector.