Sogou's Link Handler Let UNC3569 Install GRAYRABBIT
A crafted Sogou URI reached an old, unsandboxed Chromium renderer. Verify the fixed build, then hunt the process, file, and network chain.
Read article →endpoint
Endpoint security, malware, device controls, and host visibility.
Latest in endpoint
BlueMoon Exploit Kit Breaks Out of Chrome to Deploy Espionage Malware
Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.
Read article →
Attackers Exploit ScreenConnect Flaw to Run Files Without Host Approval
CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.
Read article →
AOMEI Backup Driver Lets Local Users Rewrite Physical Disks
AOMEI Backupper 8.4.0 exposes physical-disk writes to local users. Without Secure Boot, attackers can plant UEFI code that runs before Windows defenses.
Read article →
Google Patches Exploited Chrome Flaw Across Desktop and Android
Chrome 153 fixes exploited V8 out-of-bounds write CVE-2026-87491 across desktop and Android. Fleet owners should verify running builds; Google published no attack indicators.
Read article →
Sliver Toolkit Scripts Credential Theft and Persistent Domain Access
A recovered Sliver kit shows how one operator scripted Domain Admin access, disabled defenses, stole credentials, and hid rotating command servers behind Ethereum.
Read article →
Two Windows Zero-Days Give Local Attackers SYSTEM Privileges
The flaws require a local foothold, affect different Windows release families, and leave defenders with fixed-build checks but no CVE-specific compromise indicators.
Read article →
JSCeal Replays Browser Sessions to Steal Fresh Google Tokens
Recovered JSCeal code replays stolen cookies and passwords through a headless browser to obtain fresh Google OAuth tokens and exposes concrete Windows hunt artifacts.
Read article →
D-Link Router Flaws Let Local Users Seize Admin Access
D-Link fixed a DIR-X1860Z flaw that lets a local-network user set a new admin password; the similar DIR-X1860 has no update path.
Read article →
Fake Microsoft Teams Support Calls Plant Persistent Node.js Backdoors
Microsoft observed fake IT support sessions progress from Teams remote control to a persistent JavaScript implant and WinRM movement toward domain controllers.
Read article →
Google Patches Exploited Chrome V8 Flaw Across Desktop Fleets
Chrome 152.0.7977.82/.83 fixes an exploited V8 type-confusion flaw. Google has not disclosed the attackers, targets, exploit chain, or scale.
Read article →
Ransomware Server Exposes Credential Theft and EDR-Killer Toolkit
A server tied to The Gentlemen exposed TukTuk C2, a credential-stealing prompt, EDR-killer research, exfiltrated Jira data, and healthcare credentials.
Read article →
Malicious Chrome and Edge Extensions Steal Wallet Secrets and Passwords
Socket found 19 browser extensions using automatic updates, rotating command servers and injected modules to steal wallet secrets, sessions and passwords.
Read article →Showing 1–13 of 55