DPRK-linked actors use GitHub C2 and LNK phishing in South Korea, enabling persistent PowerShell control and data ...

The Microsoft Defender Security Research Team uncovered a sophisticated macOS intrusion campaign attributed to the North ...

Discover the techniques that help popular scripts succeed.

PowerShell's scripting language and ability to interact directly with Windows system elements give it a superpower that ...

A digitally signed adware tool has deployed payloads running with SYSTEM privileges that disabled antivirus protections on ...

PHANTOMPULSE spreads via Obsidian plugin abuse in REF6598 campaign, targeting finance and crypto users, bypassing AV controls ...

NomShub, a vulnerability chain in Cursor AI, allowed attackers to achieve persistent access to systems via indirect prompt ...

Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution ...

A series of malicious LNK files targeting users in South Korea has been detected using a multi-stage attack chain that uses GitHub as command and control (C2) infrastructure.

A MacOS-focused social engineering campaign orchestrated by North Korea-based threat actor Sapphire Sleet has been exposed by ...

A new malware family named 'AgingFly' has been identified in attacks against local governments and hospitals that steal ...

April 16, 2026) – Daployi announced the official launch of its self-hosted edge device management platform, providing DevOps ...