The JSONFormatter compromise shows how “harmless” online code tools quietly leaked passwords, API keys and cloud credentials for years. This article breaks down what happened, why Recent Links became a goldmine for attackers, and how security teams should lock down developer workflows before the next leak.
Everest claims it breached Money Mart and stole more than 80,000 internal files from a “National Money Mart Company DataBase,” turning the attack into a major consumer financial data breach. This analysis explains how the Money Mart ransomware attack unfolded, why a payday-loan provider makes an attractive target, and what the incident means for customers and other financial-services firms.
CISA is warning that state-linked threat actors are actively using commercial spyware and remote access trojans to hijack Signal and WhatsApp accounts, weaponize linked devices and deploy zero-click exploits. This article breaks down the campaigns, the tools involved and the specific hardening steps high-value targets should take immediately.
A Russian-linked threat actor is hiding Stealc V2 infostealer inside Blender project files shared on 3D model marketplaces. By abusing Blender’s Auto Run Python Scripts feature, the campaign turns legitimate-looking character rigs into a delivery vector that steals browser, wallet, VPN and messaging credentials from creative workstations.
The infamous Shai-hulud worm has resurfaced in the npm ecosystem with a new Sha1-hulud variant. By executing during preinstall, hijacking popular packages, stealing GitHub and cloud secrets, and wiping developer home directories when exfiltration fails, this worm turns supply-chain compromise into both an access play and a destructive weapon.
ShadowPad operators are exploiting WSUS vulnerability CVE-2025-59287 to gain SYSTEM-level access on Windows servers. By chaining insecure deserialization, PowerCat reverse shells and DLL side-loading, they turn trusted patching infrastructure into a stealth delivery vector for a mature, modular backdoor.
Between 2024 and 2025, China-linked APT31 conducted a stealthy espionage campaign targeting Russian IT contractors and government integrators. The group masked its command-and-control using legitimate cloud services such as Yandex Cloud and OneDrive, deployed loaders like CloudyLoader via DLL side-loading, and maintained long dwell times within compromised networks. This article decodes APT31’s tool-kit, tactics and persistence model, and offers detection and response guidance for defenders.
A WhatsApp API flaw allowed researchers to enumerate 3.5 billion accounts by abusing weak rate-limiting in the contact-discovery endpoint, exposing global phone-number mappings and public profile metadata that adversaries could weaponize for large-scale phishing, impersonation and SIM-swap attacks.
A China-aligned threat group known as PlushDaemon runs a Chinese APT router hijacking campaign that implants EdgeStepper on vulnerable routers, reroutes software-update traffic for popular Chinese-language applications and delivers the SlowStepper espionage toolkit through trusted update channels, turning routine network gear into an adversary-in-the-middle platform.
BadAudio gives APT24 a stealthy first-stage foothold in a long-running espionage campaign that focuses on Windows environments. The C++ downloader hides behind DLL search-order hijacking, control-flow obfuscation and AES-encrypted C2, while the group rotates between watering-hole attacks, supply-chain compromises and targeted spearphishing to deliver it. This article breaks down BadAudio’s loader behavior, APT24’s evolving tradecraft and the defensive steps that help security teams detect, contain and disrupt this PRC-nexus operation.