2+ day, 20+ hour ago   (557+ words) A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious…...

2+ day, 23+ hour ago   (593+ words) The campaigns do not require a macOS vulnerability; instead, they abuse user trust by persuading victims to paste attacker-controlled commands into Terminal, sidestepping traditional file-centric protections. However, Russian-language artifacts observed in some samples do not establish attribution to a particular…...

4+ day, 21+ min ago   (649+ words) Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. The shift puts developer credentials, Model Context Protocol configurations, prompt histories, project metadata, and potentially proprietary…...

4+ day, 2+ hour ago   (164+ words) Microsoft has classified two vulnerabilities as “exploited,” indicating credible evidence of real-world use before broad patch adoption. Organizations should prioritize these vulnerabilities in their incident response efforts rather than treating them as routine maintenance tasks. Large Patch Tuesday releases can…...

4+ day, 1+ hour ago   (605+ words) The operation marks a significant evolution of ClickFix social engineering: rather than persuading users to execute PowerShell commands or install malware on an operating system, attackers manipulate them into running malicious code inside Chrome itself. The document claims to disclose…...

4+ day, 17+ hour ago   (634+ words) A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The result is a hands-on-keyboard…...

5+ day, 23+ hour ago   (273+ words) These exploits allow attackers to take control of print management servers, steal credentials, and deploy Meterpreter payloads within enterprise networks. Analysts Jens Pose and Ross Phillips from Arctic Wolf reported that these intrusions progressed from remote command execution to reconnaissance,…...

6+ day, 49+ min ago   (386+ words) This vulnerability, known as StyleSmuggler, allows attackers to inject PHP payloads into Magento’s template system and execute them via standard application workflows. Sansec’s Forensics Team reported that attacks began on September 4, targeting internet-facing e-commerce stores. The team successfully replicated the…...