Analysis of the Dropbox Sign (ex-HelloSign) breach: API key attack chain, exfiltration of 68 million accounts, impact on eSignature certificates and GDPR notification obligations.
The UNC3944/Scattered Spider group launches new social engineering campaigns targeting European IT helpdesks. TTP analysis, MGM/Caesars parallels, and defense plan.
Fortinet confirms attackers established persistent read access on FortiGate SSL-VPN appliances via symbolic links, exploiting CVE-2024-55591, CVE-2024-21762 and CVE-2022-42475. DFIR analysis and remediation plan.
A LayerX study published in April 2026 reveals that AI-powered browser extensions have 60% more vulnerabilities, access cookies 3 times more often, and have seen their permissions grow 6 times faster than traditional extensions.
An Android banking trojan connected to Cambodia's cybercrime networks is actively targeting users in 21 countries. Overlay attacks, SMS interception, accessibility abuse. Analysis and protection measures.
On April 7, 2026, attackers compromised Nextend's update infrastructure and distributed a RAT through the official Smart Slider 3 update channel. 800,000 WordPress sites were exposed for approximately 6 hours.
Behind the Axios supply chain attack lies a 6-month social engineering operation. UNC1069 (North Korea) built a trust relationship with maintainer Jason Saayman before stealing his npm credentials.
Microsoft Threat Intelligence documents Storm-1175, the first major Chinese actor linked to the Medusa ransomware. Targets: hospitals, education, and finance in Australia, the UK, and the USA. Less than 24 hours from initial access to encryption.
Russian group APT28 (Forest Blizzard) has been running the FrostArmada campaign since May 2025, compromising unsecured routers to build a covert espionage infrastructure targeting European and North American governments.
A massive OAuth device code phishing campaign has compromised more than 340 Microsoft 365 organizations across 5 countries. Attackers abuse Microsoft's legitimate device authorization flow to obtain persistent tokens that bypass MFA.
CVE-2025-55182 (CVSS 10.0) affects React Server Components and Next.js App Router. The UAT-10608 group (Cisco Talos) exploits the flaw to automatically harvest database credentials, SSH keys, AWS secrets, GitHub tokens, and Stripe keys from 766 confirmed hosts.
On March 30, 2026, the Axios npm package was compromised for 39 minutes via a hijacked maintainer account. The North Korean group UNC1069 deployed the WAVESHAPER.V2 backdoor across Windows, macOS, and Linux.
Iranian group Handala breached FBI Director Kash Patel's personal Gmail. 300+ emails published in retaliation for domain seizures and $10M bounty.
TeamPCP compromised LiteLLM on PyPI on March 24, 2026 via a cascading supply chain attack. 95 million monthly downloads, credentials stolen.
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, deploying custom ransomware GenieLocker.
UNC6201 (China) exploited CVE-2026-22769 (CVSS 10.0) in Dell RecoverPoint since mid-2024 without detection. Three malware strains deployed, root persistence achieved.
The GlassWorm campaign compromised 72 Open VSX extensions to target developers. Attack analysis and protection measures for development teams.
Microsoft DART reveals an active vishing campaign via Teams where attackers impersonate IT support and use Quick Assist to take control of workstations.
Hacktivist group Handala, linked to Iran's IRGC, carried out a destructive wiper attack against medtech giant Stryker via Microsoft Intune. 50 TB of data stolen.
Analysis of the 2026 ransomware landscape: Qilin reaches 1,480+ victims, data-only exfiltration tactics emerge, and new non-Russian actors enter the scene.
Supply chain attacks exploded in 2025 (+95%). From the Shai-Hulud worm to OAuth compromises, analysis of key incidents and defenses to implement.