Research reports
1,224 reports from 387 publishers45 added in the past week
187 reports, newest added first
Added Fri 16 Oct
A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor
About this post: This analysis and write-up were produced by Claude (Opus 5.5), an AI model by Anthropic, working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat (including KesaKode), capstone, Python, capa, FLOSS, StringSifter,…
Malware
Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data
Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…
MalwareInfostealers
Added Wed 14 Oct
ai_breach_mex_gov.docx
Eyal Sela, Director of TI, Gambit Security | https://gambit.security 1 Overview Between late December 2025 and mid-February 2026, a threat actor breached at least nine Mexican government organizations at federal, state, and municipal levels. The threat actor…
Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed
In August 2025, we investigated a new ransomware campaign orchestrated by The Gentlemen, an emerging and previously undocumented threat group. This threat actor quickly established itself within the threat landscape by demonstrating advanced capabilities…
Ransomware
Defacement Attacks: Understanding and Prevention
What is Defacement Attacks? Defacement attacks occur when malicious actors infiltrate a website online or a digital advertising panel device hardware, and replace its content with their own messages. These messages can range from political or religious…
What is Asymmetric Encryption?
Asymmetric encryption is an encryption method that uses two different keys—a public key and a private key—to encrypt and decrypt data. It’s generally regarded as more secure, though less efficient, than symmetric encryption. Almost everything people do on…
WTF is AI poisoning?
This article is a WTF explainer, in which we break down media and marketing’s most confusing terms. More from the series → Marketers have been trying to game LLM responses to suit their brands since users began turning to AI for search. In recent months,…
AI
Jamf Apple Device Management. Mac iPad iPhone TV Apple MDM
Govern AI on Mac. Manage all of Apple. The control plane for enterprise AI, built on the platform that manages and secures every Apple device. We help organizations succeed with Apple at scale. Whether you have a handful of Mac, iPhone, iPad, Apple Watch,…
Mobile
App-Specific Password phishing and how to prevent it
App-Specific Passwords (ASPs) are a way for users to access applications that do not support MFA or are otherwise incompatible with a platform’s standard login workflows. They are intended to enable a user to login to “legacy” (typically desktop) applications…
Phishing
Beyond source code: The files AI coding agents trust — and attackers exploit
As AI coding agents become deeply embedded in developer workflows, defenders must evolve their definition of malicious files and rethink how to protect against them. Autonomous AI agents operate across integrated development environments (IDEs), editors,…
Vulnerabilities
Countering misuse of AI: September 2026 / Anthropic
Over the past eight months, our Threat Intelligence team identified and disrupted operations in which threat actors tried to use Claude for malicious activity. In this report, we share case studies from those operations and describe how malicious use of…
Shai-Hulud Goes Open Source: Malware Creators Leak Their Own Code to GitHub
Breaking News: TeamPCP has gone open source — and the copycats are already here. The group behind Shai-Hulud has leaked their own malware code to GitHub, and independent threat actors have already begun modifying it and expanding its reach. OX Security is…
Malware
Digital certificate explained: Trust, PKI, and internet security
A digital certificate is defined as a digital document, which proves the authenticity of a public key that is used to encrypt an online asset — i.e., email communications, a document, a website, or a software application. This article explains how digital…
Threat Actors are Finding Their Way into Your AI Summaries
AI summaries have become ubiquitous in the modern search engine. They are often the first result that users see and helpfully contain links alongside their authoritatively worded answers. However, these answer engines are fallible, and their responses could…
AI
M-Trends 2026: Data, Insights, and Strategies From the Frontlines
Every year, the cyber threat landscape forces defenders to adapt to evolving adversary tactics, techniques, and procedures (TTPs). In 2025, Mandiant observed a clear divergence in adversary pacing that closely aligns with the trends we have been documenting…
ClickFix Style Attack Uses Grok, ChatGPT for Malware Delivery
A new attack uses SEO poisoning and popular AI models to deliver infostealer malware, all while leveraging legitimate domains. ClickFix attacks have gained significant popularity over the past year, using otherwise benign CAPTCHA-style prompts to lure users…
MalwareAI
How to Bypass CAPTCHA Without Breaking Your Scraper
You are scraping a critical target, and suddenly, your pipeline hits a wall: a CAPTCHA. If you are wondering how to bypass CAPTCHA, you are asking the wrong question. Treating CAPTCHA bypass in web scraping as a pure puzzle-solving exercise fails at scale.…
APT37 Ruby Jumper: Air-Gap Attack via Removable Media
ThreatLabz details the Ruby Jumper campaign in the following sections, focusing on the specific malware employed, the deployment methods, and how the final payload is delivered to achieve the ultimate objective. Attack flow The figure below illustrates the…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.