2+ day, 18+ hour ago   (399+ words) Instead of sending victims to a hosted credential-harvesting page, the attackers generate the phishing page directly inside the victim’s browser using a blob URL. This technique makes detection harder because the phishing page does not exist as a normal internet-accessible…...

5+ day, 22+ hour ago   (425+ words) The attacks primarily target devices with SSH management access exposed to public networks, prompting urgent patching guidance from MikroTik, CERT Polska, and Latvia’s CERT.LV. MikroTik released security updates on September 3, confirming that fixed RouterOS builds are available through supported…...

1+ week, 4+ day ago   (445+ words) Attackers hijacked Border Gateway Protocol routing for Softaculous infrastructure last week, diverting traffic to attacker-controlled systems and delivering a malicious Virtualizor update to a small number of hypervisor servers. According to Virtualizor’s incident report, the routing attack ran from approximately…...

1+ week, 5+ day ago   (364+ words) The attack begins on compromised websites displaying a convincing fake Cloudflare Turnstile CAPTCHA. The page shows a “Verify you are human” prompt, Cloudflare branding, and a loading animation. When users click the verification box, a malicious PowerShell command is copied…...

2+ week, 23+ hour ago   (462+ words) A TerminalFix campaign, a ClickFix variant, is using fake Cloudflare CAPTCHA prompts to trick users into executing PowerShell commands that install a reverse-tunnel implant. Documented by Microsoft, the activity targets organizations and can turn a compromised Windows device into a…...

2+ week, 3+ day ago   (389+ words) Gen Threat Labs has uncovered WordlistLoader, a new malware loader used in ClearFake campaigns to deliver the Amatera Stealer. The campaign abuses compromised legitimate websites to display fake CAPTCHA checks. Victims are told to prove they are human, but the…...

2+ week, 4+ day ago   (225+ words) TP-Link has disclosed three high-severity command injection vulnerabilities affecting Archer BE800 V1, Archer BE3600 V1, and Archer AX75 V1 routers. The most severe issue, CVE-2026-9254, affects the parental-control functionality in all three router models. The vulnerability stems from insufficient filtering and neutralization of special characters in…...

3+ week, 1+ day ago   (400+ words) Residential proxy networks are often hard for security teams to detect, but new research shows they can create serious enterprise risks. PEER2PROFIT pays users to share unused internet bandwidth through an app installed on their devices. ASTROPROXY then resells access to…...

3+ week, 1+ day ago   (163+ words) cyberpress.org Researchers assess the activity as China-nexus with medium confidence, citing victim selection, shared malware tooling, infrastructure links, and tradecraft commonly associated with Chinese espionage activity. The campaign used seven remote access trojan (RAT) families. Five were previously undocumented…...

3+ week, 2+ day ago   (317+ words) MacSync Stealer is a macOS-focused information stealer that uses rapidly changing command-and-control (C2) domains to deliver payloads, communicate with infected devices, and steal data. However, a Microsoft Defender Experts investigation found that the malware keeps several network and execution patterns stable,…...