-
Google has released a critical security update for Chrome, upgrading the Stable channel to version 150.0.7871.114/.115 on Windows and macOS, and to version 150.0.7871.114 on Linux. This update addresses 27 vulnerabilities, including several critical us…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly disclosed attack technique called “HalluSquatting” is raising serious concerns in the AI security landscape. This technique demonstrates how attackers can exploit large language model (LLM) hallucinations to covertly compromise systems and pote…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
GitHub Copilot’s new coding agents, which are integrated into IDEs, are susceptible to a specific type of “workflow-level” jailbreak attacks. These attacks can bypass chat refusals, allowing agents to generate harmful code while performing …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A coordinated supply-chain campaign that pushed 17 malicious packages across npm and PyPI, masquerading as SDKs for well-known payment services including PaySafe, Skrill and Neteller. The campaign’s packages 17 npm modules published with four rapid ver…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Threat actors are increasingly chaining classic phishing with collaboration platforms and covert tunneling to create highly believable intrusion paths. A recent multi-stage campaign attributed to UNC6692 exposes how adversaries combine email bombardmen…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A recent technical analysis of an Everest ransomware encryptor reveals a purpose-built, ConfuserEx-protected .NET 4.0 binary that combines heavy obfuscation, misleading cryptographic declarations, and uncommon network tactics to maximize impact and imp…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A targeted campaign in which the ToddyCat (aka APT-style) group leverages a previously observed loader family, Umbrij, to hijack Gmail accounts by abusing Google APIs. Chaining that capability to broad remote access achieved through a malicious MSI ins…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A previously unreported data extortion operation dubbed “Helix” that targets enterprises using identity-focused entry techniques and automated SharePoint exfiltration. The group’s playbook combines voice phishing (vishing), device-code phishing to capt…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Claude Desktop’s synced Personal Preferences feature can be exploited as a covert prompt-injection vector, transforming the AI assistant into a de facto command-and-control (C2) agent. This method allows for remote code execution on a compromised user …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
DuckDuckGo has quietly expanded its privacy-first browser capabilities by introducing a YouTube ad-blocking feature. This feature uses community-driven uBlock Origin filter lists to detect and remove video ads. From a security and privacy standpoint, t…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
