Research reports
TopicAll topics
PublisherAll publishers
- All publishers1,024
- Check Point95
- DataBreaches.net51
- MITRE ATT&CK44
- GitHub29
- Group-IB29
- Microsoft29
- ETDA Threat Group Cards20
- Medium20
- Trend Micro19
- Unit 4219
- Mandiant (Google)18
- Malpedia15
- Intezer13
- US Department of Justice12
- ESET11
- PhishLabs10
- ANSSI (CERT-FR)8
- Cisco Talos8
- Elastic Security Labs8
- Proofpoint8
- BleepingComputer7
- Cybernews7
- Kaspersky7
- The Record7
- Zscaler7
- AhnLab6
- Fortinet6
- IBM X-Force6
- Infosec Institute6
- NIST6
SortNewest added
621–640 of 1,024 reports · page 32 of 52 · Clear filters
Added Wed 29 Apr
Netskope · Web page · Published 26 Nov
Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading
In mid-September 2025, security researchers first identified a supply-chain compromise in the npm ecosystem, the original Shai-Hulud campaign. The first known compromised package was @ctrl/tinycolor version 4.1.1. Only two months later, a far more aggressive…
Socket · Web page · Published 15 Sep
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 Packages
Socket proactively blocks malicious open source packages in your code. Install Update (September 16, 2025): This campaign has expanded significantly. Our follow up documents nearly 500 affected npm packages, including several open source CrowdStrike packages.…
veracode.com · Web page · Published 9 Jun
Down the Rabbit Hole of Unicode Obfuscation
The rabbit–hole went straight on like a tunnel for some way, and then dipped suddenly down, so suddenly that Alice had not a moment to think about stopping herself before she found herself falling down a very deep well. – Alice’s Adventures in Wonderland by…
Koi · Web page · Published 6 Nov
GlassWorm Returns: New Wave Strikes as We Expose Attacker Infrastructure
Almost three weeks ago, we disclosed GlassWorm - the first self-propagating worm targeting VS Code extensions, using invisible Unicode characters to hide malicious code that literally disappears from code editors. On October 21, 2025, OpenVSX declared the…
Anthropic · Web page · Added 29 Apr
Disrupting the first reported AI-orchestrated cyber espionage campaign
We recently argued that an inflection point had been reached in cybersecurity: a point at which AI models had become genuinely useful for cybersecurity operations, both for good and for ill. This was based on systematic evaluations showing cyber capabilities…
Microsoft · Web page · Published 9 Dec
Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack
The Shai‑Hulud 2.0 supply chain attack represents one of the most significant cloud-native ecosystem compromises observed recently. Attackers maliciously modified hundreds of publicly available packages, targeting developer environments, continuous…
accenture.com · Web page · Added 29 Apr
Turla/Belugasturgeon Compromises Government
Turla, identified internally by Accenture Cyber Threat Intelligence as Belugasturgeon, continues to target government organizations using custom malware, including updated legacy tools, designed to maintain persistence through overlapping backdoor access…
falconfeeds.io · Web page · Added 29 Apr
Latest Cyber Threat Intelligence & Security Insights
The geopolitical landscape of 2026 has been fundamentally reshaped by the convergence of kinetic military operations and systemic digital suppression, a phenomenon most acutely visible in the ongoing tensions between the Islamic Republic of Iran, Israel, and…
breakdev.org · Web page · Published 14 Sep
Evilginx 2.4 - Gone Phishing
Welcome back everyone! I can expect everyone being quite hungry for Evilginx updates! I am happy to announce that the tool is still kicking. It's been a while since I've released the last update. This blog tells me that version 2.3 was released on January…
Trend Micro · Web page · Added 29 Apr
Ransomware Spotlight: Ransomhub
The following section details the initial infection chain observed from RansomHub activity as illustrated in Figure 1. Initial Access The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering…
Socket · Web page · Published 31 Jan
GlassWorm Loader Hits Open VSX via Developer Account Compromise
Socket proactively blocks malicious open source packages in your code. Install Socket’s Threat Research team identified a developer-compromise supply chain attack distributed via the Open VSX Registry, specifically a compromise of the developer’s publishing…
Infosec Institute · Web page · Published 16 Apr
Spoof Using Right to Left Override (RTLO) Technique - InfoSec Resources
In this article we will learn about the one of the most overlooked spoofing mechanisms, known as right to left override (RTLO). What is RTLO? RIGHT TO LEFT OVERRIDE is a Unicode mainly used for the writing and the reading of Arabic or Hebrew text. Unicode has…
Microsoft · Web page · Added 29 Apr
Windows Startup Settings
After October 14, 2025, Microsoft will no longer provide free software updates from Windows Update, technical assistance, or security fixes for Windows 10. Your PC will still work, but we recommend moving to Windows 11. Learn more You might need to change…
breakdev.org · Web page · Published 10 Sep
Evilginx 2.1 - The First Post-Release Update
About 2 months ago, I've released Evilginx 2. Since then, a lot of you reported issues or wished for specific features. Your requests have been heard! I've finally managed to find some time during the weekend to address the most pressing matters. [>> Download…
specopssoft.com · Web page · Published 27 Mar
Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack
Stryker Cyber-Attack: What we Know so Far About the Remote Wipe Attack What happened in the Stryker cyber-attack? Chronological post-attack activity What we know about Handala What this means for defenders Defender strategies How Specops helps stryker…
Added Mon 27 Apr
PhishLabs · Web page · Added 27 Apr
Brand Protection Tools: Domain, Social & Dark Web
When your brand is targeted, your defenses must be ready. Trusted by businesses worldwide, Fortra Brand Protection proactively detects and eliminates fraud and impersonation threats before they escalate. With industry-leading detection and rapid takedown…
PhishLabs · Web page · Added 27 Apr
Brand Protection Tools: Domain, Social & Dark Web
When your brand is targeted, your defenses must be ready. Trusted by businesses worldwide, Fortra Brand Protection proactively detects and eliminates fraud and impersonation threats before they escalate. With industry-leading detection and rapid takedown…
Radware · Web page · Added 27 Apr
Application Layer DDoS in an Era Where Everything Looks Legitimate
Radware icon WHY RADWARE? Learn how Radware EPIC-AI™ rapidly resolves issues Menu Customers CUSTOMERS Read case studies, reviews and customer testimonials Menu Diversity & Inclusion DIVERSITY & INCLUSION Get to know Radware’s fair and supportive culture Menu…
Added Sun 26 Apr
PhishLabs · Web page · Added 26 Apr
Brand Protection Tools: Domain, Social & Dark Web
When your brand is targeted, your defenses must be ready. Trusted by businesses worldwide, Fortra Brand Protection proactively detects and eliminates fraud and impersonation threats before they escalate. With industry-leading detection and rapid takedown…
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.