Do Son ViciousTrap is hijacking over 5,000 SOHO routers to build a distributed honeypot-like surveillance network, exploiting Cisco flaws for covert observation.
ABB's ASPECT BMS has 32 security flaws, with some critical RCE and privilege escalation vulnerabilities having no planned fixes for legacy systems.
AI-generated TikTok videos are instructing users to run PowerShell commands, leading to the delivery of Vidar and StealC infostealer malware.
Malicious scripts disguised as Cloudflare human verification are embedded in WordPress themes, tricking users into executing PowerShell commands that deliver malware.
The U.S. Department of Justice charged 16 individuals for the $50M DanaBot malware operation, which infected over 300,000 computers worldwide.
Europol and Microsoft led Operation Endgame, a global takedown disrupting 300+ servers and 650 malicious domains linked to major ransomware malware strains.
Open database with 184M leaked credentials found—users urged to change exposed passwords and enable 2FA to protect accounts from future breaches.
Pocket and Fakespot apps will cease operations on July 8, 2025. Mozilla advises users to export data by October 8 before permanent deletion.
Anthropic unveils Claude 4 (Opus & Sonnet), new AI models excelling in programming and extended reasoning, set to rival ChatGPT and Gemini.
Windows 11 debuts cross-device resume, letting users pick up Android tasks on PC—Spotify, OneDrive, and WhatsApp supported in early testing.
Coinbase confirms a social engineering attack led to the theft of 69,461 users' data, including IDs and transaction history, via bribed service reps.
Google is reportedly forcing publishers to share data for AI Overviews or risk losing search traffic, sparking concerns over content control and monetization.
Claude 4 models are reportedly exhibiting a "whistleblowing mode" and even blackmail attempts during testing, raising serious ethical concerns.
Critical NETGEAR flaw (CVE-2025-4978) allows full admin access via hidden backdoor. Exploit details and PoC analysis inside.
The Rhadamanthys stealer is back with targeted phishing attacks across Central and Eastern Europe, using fake copyright infringement lures.
A new, deeply stealthy formjacking malware is targeting WooCommerce, secretly stealing customer payment data from legitimate checkout processes.
Canon urges users to mitigate high-severity flaws in a range of printers that could allow sensitive data extraction.
A high-severity flaw (CVE-2025-47947) in ModSecurity's Apache module allows DoS via JSON. PoC exists, no workaround, and a patch is expected soon.
Malicious npm packages have been silently destroying files and corrupting data in React, Vue.js, and Vite projects for over two years.
A critical zero-day (CVE-2025-4428) in Ivanti EPMM is exploited by UNC5221, enabling unauthenticated RCE and data theft across multiple sectors.
Deceptive VS Code extensions like 'solaibot' are stealing crypto wallet credentials, disabling Defender, and deploying persistent spyware on Windows.
The notorious Genesis Market is back! A new campaign deploys a malicious browser extension via Lumma Stealer to covertly harvest user data.