OWAReaper abuses CVE-2026-42897 to steal OAuth tokens, alter mailbox permissions, and persist inside Exchange accounts.

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor ...

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

A macOS ClickFix campaign uses more than 250 domains and server-side fingerprinting to hide AMOS lures from crawlers and ...

Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential ...

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals ...

OWAReaper malware, deployed by Russian state hackers Laundry Bear against US and European government agencies and ...

欢迎学员来参加小肩膀广东逆向安全百人聚会：广东安全逆向圈子 | 十年逆向教育二次聚会1.

Zimbra zero-click vulnerability CVE-2025-66376 is being actively exploited by Russian hackers targeting NATO governments and defense contractors. Unit 42 and CISA warn that Void Blizzard has raided ...

Amazon Threat Intelligence has tied a DPRK hacking group to four separate npm package supply chain attacks, including axios. The company’s security teams have connected the axios, debug, chalk, and ...

Filters don't stop prompt injection; architecture does. A field guide to the lethal trifecta, the rule of two, Dual-LLM and ...