Threat actors behind a coordinated network on YouTube have uploaded over 3,000 videos that masquerade as software tutorials and cheat walkthroughs, yet lead to credential‐stealer malware downloads. The operation uses compromised channels, fake engagement and download links to evade detection posing a new category of platform-based threat for security teams.
A newly disclosed flaw in Adobe Commerce (formerly Magento) dubbed “SessionReaper” enables attackers to hijack live customer sessions via the REST API. With proof-of-concept exploit code now public and over 250 attacks detected in a single day, administrators must act immediately.
Actors on underground forums are now selling a turnkey ransomware toolkit named MonoLock v1.0 designed to target small and medium organisations, disable backups, encrypt data at scale via AES-256/RSA-2048, and demand payment through an automated Tor portal. Security teams must recognise this shift in the ransomware-as-a-service (RaaS) business model and reinforce detection, defence and incident response accordingly.
A sophisticated new espionage campaign, tracked as PassiveNeuron, uses novel malware families Neursite and NeuralExecutor to target government and industrial networks across Latin America and East Asia. This article breaks down the tools, techniques and defensive steps security teams must act on now.
A newly uncovered vulnerability in TP-Link’s Omada gateway line enables remote attackers to execute system-level commands. This flaw threatens business networks worldwide and demands immediate firmware patching and access control reviews.
A widespread campaign exploited the Chrome Web Store to distribute 131 rebranded extensions that hijack WhatsApp Web for automated bulk messaging. These add-ons pose a significant risk to organizations and users alike, demanding immediate review of extension governance and messaging platform protections.
CISA added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. This article provides a CVE-by-CVE technical breakdown, enterprise impact assessment, detection and mitigation actions, and prioritized remediation guidance for security operations teams. Includes an AEO-optimized FAQ and verified external sources.
GlassWorm is the first known self-propagating worm targeting developer environments by infecting VS Code extensions with hidden Unicode payloads. Once installed, it steals credentials from NPM, GitHub and Git, and upgrades machines into proxy nodes and part of a distributed criminal infrastructure. It uses a blockchain-based command and control mechanism and auto-updates to spread across the developer ecosystem. In this article, we dissect how GlassWorm works, what makes it a paradigm shift in supply-chain attacks, and what organisations must do to detect and contain it before their dev workstations become weaponised.
Hackers breached the official Xubuntu website and replaced legitimate download links with malware-infected files. The incident highlights the growing risk of supply-chain compromises targeting open-source Linux distributions.
A public PoC for CVE-2025-59287 exploits an unsafe deserialization flaw in WSUS. Administrators must deploy Microsoft’s October 2025 updates and hunt for indicators of compromise immediately.