MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated
A newly observed MacSync campaign shows a marked evolution in macOS-focused crimeware, replacing relatively simple AppleScript-driven delivery with layered b...
Red
Unknown
auto-detected
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
All Articles (1229)
Last 90 Days
All Time
Bring Your Own Vulnerable Device: The EDR Killer Economy
Discover how Bring Your Own Vulnerable Driver (BYOVD) tactics evolved from lone-operator tricks into a commercialized, tiered EDR-killer service economy.
Rydox Admin Faces 20 Years After Selling Stolen Data and Fraud Tools
Kosovo national Ardit Kutleshi pleaded guilty to running Rydox, a cybercrime marketplace that sold stolen identities and credentials for years. Ardit Kutlesh...
Placeholder Domains Used by 349 AI Agent Skills Found Redirecting to Scams
Manifold Security found placeholder domains cited in 359,000 GitHub files and 349 AI agent skills serving cloaked scam…
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware...
AI Red Teaming versus traditional Application Security testing
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
The Windows botnet relies on AI to maintain persistence, using xAI Grok to choose from predefined actions. The post New x47.
Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit
A threat actor tracked as Red Heron has exploited the critical Gitea remote code execution vulnerability CVE-2026-60004 to steal source-code repositories, es...
Kiteworks Warns Users to Take Systems Offline Amid Suspected Zero-Day Threat
Kiteworks has urged customers worldwide to temporarily shut down their servers after receiving credible law-enforcement intelligence that a threat actor may ...
Uncensored Local AI Model Bypasses EDR to Dump Windows LSASS Credentials
A new demonstration shows how a locally hosted, uncensored AI model can help generate a Windows LSASS credential-dumping utility that reportedly evaded endpo...
Storm-3168 Hackers Abuse Compromised Service Principals to Destroy Azure Cloud Resources
Microsoft has uncovered a destructive Azure campaign linked to Storm-3168, also known as JADEPUFFER, in which attackers abused compromised service principals...
Bitget loses $351.6 million in suspected North Korean crypto hack
The breach was discovered on Thursday evening when security systems detected unauthorized transfers.
Researchers identify AliExpress-themed phishing campaign using disposable domains
EfficientIP Research Labs identified potential .cyou domains on June 9 that were later registered and began resolving to IP addresses on July 2.
Compromised GitHub Actions re-enabled, posing supply chain risks
The compromised GitHub Actions were originally disabled on May 18, 2026, after being found to execute malicious code that harvested sensitive credentials fro...
Cloudflare Containers vulnerability allowed data leakage
The flaw resided in Cloudflare's use of thin provisioning for container disks, where deleted container blocks were returned to a shared pool without being wi...
Kiteworks urges customers to stop using platform after warning from federal intelligence agencies
Frank Balonis, CISO at Kiteworks, told Recorded Future News that the company “received credible threat intelligence from federal intelligence authorities ind...
Gemini hacked three companies. The AI isn't the part that should scare you.
AI exposes old access problems faster, turning leaked credentials and standing trust into bigger risks.
Kiteworks warns customers to shut down servers due to possible imminent attack
Kiteworks’ CISO cited “credible threat intelligence from law enforcement” for the urgent alert.
Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions
Anthropic now allows you to run Claude Code via cloud sessions without signing up for the research preview, and it's offering up to $250 in free usage credit...
Storm-3168: Agentic-driven cloud attacks using compromised service principals
Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the acti...