Threats & Attacks
Ransomware, malware, phishing and the actors behind them.
Inside ARToken: How Artificial Intelligence Powers the Next Generation of EvilTokens Phishing
A new phishing-as-a-service platform called ARToken appears to operate as an affiliate of the EvilTokens toolkit, revealing extensive capabilities for stealing Microsoft 365 tokens, establishing persistent access via Primary Refresh Tokens, and automating business email compromise operations with artificial intelligence.
When AI Writes Malware: How DeepSeek's Browser Ransomware Blueprint Changed the Threat Landscape
Check Point researchers uncovered a DeepSeek-generated malware sample that can be weaponized into browser-based ransomware with minimal effort, exposing a new frontier in artificial intelligence cybersecurity threats.
From Hackers to Hives: Qihoo 360 Deploys Multi-Agent Swarms to Challenge American AI Dominance
As U.S. export restrictions block international access to Anthropic's Mythos, Chinese cybersecurity veteran Qihoo 360 has unveiled 'Tulongfeng,' an autonomous multi-agent vulnerability-discovery swarm designed to bypass China's trailing LLM capabilities and secure technical parity.
Krisp Unveils Unified Voice AI Platform with Full Call-Center Governance and Real-Time Fraud Protection
Krisp launches expanded voice AI capabilities for contact centers, combining speech analytics, real-time agent assistance, and voice security to enforce compliance across 100% of voice interactions while detecting synthetic caller fraud live.
Savi Security Addresses AI-Powered Fraud with New Consumer Protection App
Savi Security has raised $7 million in seed funding and is launching its iOS and Android app, designed to protect consumers from sophisticated AI-generated scams like voice cloning and phishing.
Armored Likho: The New AI-Powered APT Threat Targeting Global Energy Infrastructure
A look at how threat actor Armored Likho uses AI-generated loaders and the BusySnake infostealer against government and energy networks.
Teams Screen Sharing Abused in Cross-Tenant Vishing Campaigns to Deliver EtherRAT
A forensic analysis of a social engineering campaign targeting Microsoft Teams, where attackers pose as IT support, request screen control, and install EtherRAT via a Node.js runtime installer.
Inside the New Wave of Hospitality-Targeted Phishing Campaigns
Recent phishing campaigns targeting the hospitality sector across Europe and Asia leverage sophisticated social engineering and persistence tactics, focusing on long-term remote access rather than immediate ransomware deployment.
When a Ransomware Gang Turns Out to Be an LLM Running on Its Own
Researchers at Sysdig identified JadePuffer as the first known ransomware campaign conducted entirely by a large language model agent — from initial access via Langflow's CVE-2025-3248 through credential theft, lateral movement to Alibaba Nacos, and encryption of 1,342 service configurations — demonstrating the arrival of autonomous agentic threat actors.
FBI and Google Dismantle NetNut: How a 2-Million-Device Proxy Botnet Was Taken Down
A coordinated operation by the FBI, Google Threat Intelligence Group, Lumen Technologies, and Shadowserver has seized hundreds of NetNut domains and disrupted the Popa botnet — a residential proxy network built on at least 2 million compromised Android devices including smart TVs and streaming boxes, used by hundreds of threat actors for cybercrime and espionage.
PAMStealer Sneaks Into macOS by Hijacking the Login System Itself
A new macOS malware called PAMStealer uses clever techniques to bypass authentication and stay hidden on infected Macs, according to researchers.
Your AI Coding Assistant Just Ran Malware. You Didn't Even Notice.
A clean GitHub repo tricked Claude Code into fetching and executing a reverse shell via a DNS TXT record — no malicious code, no flags, no human approval. Here’s how it worked, and why your security tools are useless against it.