1.167 casos · pág. 44/59
ESET documented the evolution of MATCHBOIL, a custom C downloader used by the Russia-aligned cyberespionage group UAC-0099. Samples span April 2024 to April 2026, although CERT-UA first documented the malware in August 2025. Each iteration became more sophisticated, with new obfuscation, sandbox checks and persistence methods. All victims…
Publicly reported data breaches in the US reached an all-time high last year, with over 3,300 incidents and nearly 280 million victim notices. The Identity Theft Resource Center (ITRC) reports that over 471 million notices went out in the first half of 2026, but only 24% described the attack vector, the lowest rate it has recorded. The ar…
Scammers are exploiting the annual Medicare Open Enrollment period (October 15 to December 7) as a pretext to impersonate insurers, agencies or Medicare itself. Contact comes by phone, SMS, email, social media and malicious Google ads that lead to spoofed, official-looking websites. Lures include plan changes, card replacement, lower prem…
This ESET WeLiveSecurity article explains email bombing (also called form, list or subscription bombing) and cites a September report of a Virginia woman flooded with hundreds of emails in 24 hours. The flood hid a genuine bank alert about a fraudulent laptop purchase. Attackers use bots to sign a harvested email address up to many legiti…
TrustedSec consultant Geoff Walton published an update to LLMHaxor, his Burp Suite plugin for testing LLM-enabled applications. The post is a tooling and practitioner-methodology update, not a threat or incident report. The main change is a new proxy that collects WebSocket streaming responses and exposes them to Burp Intruder as an HTTP …
TrustedSec published Part 1 of a red-team tradecraft series on what to do after finding plaintext AWS access keys during an engagement. It is educational content, not a report of a specific incident. It explains the difference between long-term AKIA keys (IAM user) and temporary ASIA keys (STS-issued, which also need a session token and a…
TrustedSec analyzed a multi-stage malware loader that starts as obfuscated Python bytecode (.pyc, CPython 3.13) and ends in an encrypted .NET payload. The chain layers Kramer Python obfuscation, two Donut shellcode layers and a laZzzy shellcode-loader PE, so a signature for any single format misses the others. The author unpacked it with …
TrustedSec published Part 1 of a three-part reference on changes to its open-source password-cracking orchestrator hatecrack since version 2.0 (February 2026). Since then there have been 101 releases and 781 commits, adding thirteen attacks, four submenus, a rewritten LLM integration and a scripted non-interactive mode. New attacks includ…
TrustedSec's Justin Bollinger describes HashcatRosetta, an open-source tool for password-cracking practitioners (part 2 of a 3-part series on hatecrack). It translates dense hashcat rule syntax into plain-English, step-by-step explanations. It also analyzes --debug-mode 4/5 output to show which rules, basewords and wordlists actually prod…
TrustedSec (author Brandon Colley) publishes practical guidance on building an effective logging, auditing, monitoring and alerting program for Active Directory (AD). It is based on recurring logging and auditing gaps found in the firm's AD assessments, where logging is treated as a switch to flip rather than a discipline owned by someone…
TrustedSec announced that it is joining the OpenAI Daybreak Defense Network. It plans to use OpenAI models in its consulting work through Daybreak Blue and, where approved, specialized cyber models through Daybreak Red. The planned uses cover red teaming, penetration testing, application and cloud security, purple teaming, research, threa…
TrustedSec's Justin Bollinger describes how a prek pre-push hook corrupted his git index on July 30. The resulting commit deleted 85,280 lines across about 165 files and staged gitignored, local-only paths (CLAUDE.md, .claude/, docs/plans/, docs/superpowers/). The commit reached the public trustedsec/hatecrack remote before it was force-p…
Around October 5, 2026, an anonymous onion site called The Luna Moth Files claimed to expose internal material from Silent Ransom Group (SRG), also tracked as Luna Moth and UNC3753. The purported archive includes chat exports, a vishing document, screenshots and a purported fake employee résumé. The publisher and the way the archive was o…
Check Point Exposure Management reports that fraudulent voter-registration messages and legitimate political outreach are converging ahead of the 2026 US midterms, making it harder for voters to tell real messages from fake ones. Between July and September, election offices in Rhode Island and Washington warned of fake emails and texts as…
Check Point describes Dangerous Deviation Detection, a detector in Check Point AI Security (now in open beta) that inspects each AI agent tool call before it runs. It flags a call only when the call is dangerous (data leakage, access or privilege escalation, system destruction) and nothing the user or system prompt said warrants it. The a…
Check Point Research disclosed two high-risk vulnerabilities in LiteLLM, the open source LLM gateway that organizations use to connect applications to AI providers such as OpenAI, Google and Anthropic. The project is widely deployed, with about 97 million downloads per month and over 59,000 GitHub stars. CVE-2026-35029 let any user, inclu…
Check Point published test results showing that an AI agent that watched eight teammates break a rule broke it too in 98 percent of cases, and never named the teammates as the reason. The violation rate rose from 44 percent with no observed teammate reversals to 98 percent with eight. Across more than 400 violations, the agent never cited…
Check Point researchers report large-scale phishing campaigns that abuse fake calendar invitations to harvest Microsoft account credentials. Lures arrive either as a malicious .ics attachment or as a link, for example in a fake Microsoft Teams meeting invite, that appears to point to one destination but leads to a credential-harvesting pa…
Check Point Exposure Management researchers uncovered a large, multi-region phishing infrastructure that conceals active campaigns behind domains that look inactive. Root domains return blank or generic "Not Found" pages, while the phishing content is served only through concealed regional paths (for example /it, /de, /pa) and under speci…
Check Point Research's Q3 2026 Brand Phishing Report finds Microsoft was the most impersonated brand, at 33% of all attempts (up from 23% in Q2) and roughly four times the share of any other brand. Apple, Google, LinkedIn and Amazon completed the top five, together accounting for more than half of attempts. Dropbox (up ten places to eight…
