Over 50,000 Stripe API keys exposed, highlighting fraud risks
Over 50,000 Stripe API keys have been exposed across public code repositories, GitHub Actions logs, and misconfigured web servers, demonstrating the immediat...
Red
Unknown
auto-detected
AI Intelligence Brief cached
Edit Profile
Entity Relationships
Related YARA Rules View all on YARA Rules page →
90-Day Activity
All Articles (1229)
Last 90 Days
All Time
Network of 77 Firefox extensions linked to crypto theft uncovered
Socket researchers identified 40 malicious extensions and 37 others disguised as unrelated utilities, all linked through shared code, infrastructure, and pub...
New Android banking Trojan ToxicPanda 2.0 expands victim targeting
Discovered by Zimperium's zLabs team, ToxicPanda 2.0 leverages the Android Accessibility Service to enable wireless debugging, effectively gaining shell acce...
Critical flaw patched in popular JavaScript sandbox used in AI projects
A critical sandbox escape vulnerability was discovered and patched in isolated-vm, a library for running JavaScript code inside an isolated process. If explo...
Unsecured database exposes millions of facial biometrics
The database, belonging to U.S.
Sakura Internet reports potential compromise of over 1.3 million customer accounts
Sakura Internet, a key provider of digital infrastructure services in Japan and a domestic partner for the Government Cloud program, discovered the breach on...
Password spraying attacks surge 155x, exploiting legacy authentication flaws
The campaign, originating from an IPv6 range provided by LSHIY LLC, leveraged reused credentials and the legacy Resource Owner Password Credentials (ROPC) OA...
Harness launches AI agents to find and fix software vulnerabilities
The AI SAST agent identifies vulnerabilities, including logic flaws missed by traditional tools, and reduces false positives.
MacSync Stealer Uses 30+ Rotating Domains to Steal macOS Credentials and Exfiltrate Data
MacSync Stealer is expanding its macOS-focused theft operation through a rotating network of more than 30 domains, using stable execution and network pattern...
T-Mobile cybersecurity staff cut cable to expel Chinese hackers
The hacking group, identified as Salt Typhoon, compromised hundreds of companies, including major players like AT&T, Verizon, Viasat, Charter, and Windst...
New Zombie Card Attack Lets Expired Visa Cards Make Contactless Payments
Security researchers have demonstrated a “Zombie Card” attack that can reactivate certain expired Visa contactless cards, allowing them to be used for NFC pa...
MLflow Vulnerability Exploited for Cloud Credential Theft
The critical-severity flaw allows attackers to send HTTP requests to internal endpoints and extract sensitive information. The post MLflow Vulnerability Expl...
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purch...
Kriminal breaks out of Grok, Claude guardrails at $12.99
Security researchers are warning of a criminal AI service built on Grok and Claude, among other models, that promises uncensored access to powerful AI capabi...
Johnson Controls Simplex Incident Manager
View CSAF Summary Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and a...
ToxicPanda 2.0 Steals PINs From 140+ Banking and Cryptocurrency Apps Using Invisible Overlays
ToxicPanda 2.0, an evolved Android banking Trojan that significantly expands its fraud, device control, and credential theft capabilities.
Why "Shady AI" is Security's Next Big Governance Problem
In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorize...
Corero brings cloud-based AI threat analysis to SmartWall ONE
Corero Network Security has announced AI-Augmented Cloud-Assist for SmartWall ONE, extending its automated DDoS protection with cloud-delivered AI analysis, ...
Red Hat Kubernetes Flaw Lets Unauthenticated Attackers Access Internal Cluster Services
Red Hat has disclosed CVE-2026-66794, an important-severity server-side request forgery (SSRF) vulnerability in the cluster-proxy-addon component of the Mult...
Identity Abuse Through Trusted Communication Channels
Unit 42 details how attackers exploit enterprise collaboration tools for identity phishing and credential theft. Discover key defense strategies.