This sophisticated web skimming campaign exploits Stripe's deprecated API to validate payment data before theft, ensuring only valid card information reaches attackers. Active since August 2024, the operation has compromised 49 merchants through a multi-stage attack that intercepts legitim...
A security vulnerability in Verizon's Call Filter app allowed unauthorized access to other customers' incoming call logs through an unsecured API. Discovered by researcher Evan Connelly in February 2025, the flaw stemmed from the API's failure to verify if users were authorized to access s...
GitHub detected 39 million leaked secrets in repositories during 2024, prompting enhanced security measures. Despite existing protections like Push Protection, secrets continue to leak due to developer convenience prioritization and accidental repository exposure. GitHub has responded with...
Outlaw (Dota) is a persistent Linux-based cryptocurrency mining botnet targeting SSH servers with weak credentials. This Romanian-origin threat employs SSH brute-force attacks for initial access, maintains persistence via custom SSH keys, and deploys mining payloads through a multi-stage i...
Russian hackers, likely the FSB-affiliated Gamaredon group, are targeting Ukrainian entities with Remcos RAT malware through sophisticated phishing campaigns. The attack uses Russian-language file names about troop movements as bait, with malware connecting to servers in Russia and Germany...
