threats

We’ve discovered a vulnerability that could affect millions of Intelbras IP cameras. If you’ve got one — here’s how to prevent attackers from disabling it.

How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.

AI has learned how to quickly gather scattered details about a person, link their accounts together, and turn a digital footprint into a detailed dossier. We look at how artificial intelligence is changing doxing — and what you can do to make deanonymization harder.

Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.

In April, our experts investigated the PAYLOAD campaign — where the leverage wasn’t data encryption but a malicious AD group policy object.

What do malicious browser extensions, crypto theft, and fake Chrome update guides have in common? We look at a recent campaign involving 19 infected add-ons.

How budget smart-TVs and set-top boxes infect home networks and join malicious botnets.

Researchers have built a device that can interfere with critical systems aboard a Boeing 737. Here’s how the attack works, and whether it’s time you started worrying about flying yet.

We break down the file formats that can be unfamiliar to some users, and that aren’t always scanned by security solutions but can still pose cyberthreats.

Sketchy online stores, crypto investments promising fast returns, hidden subscriptions, and browser extensions loaded with harmful software… online scams have moved well beyond classic phishing. Here’s how to spot the websites operating in this gray area, and what kind of harm they can do.

Attackers have found yet another source of free computing resources: automotive head units. We take a look at the first malware specifically targeting cars for infection.

Visit a familiar website, and along with the usual ad banner you could pick up a script that steals cryptocurrency. How can you protect yourself from attacks delivered through online ads?

Attackers are crafting files that devices can read as two different document types at once, and using these “nesting dolls” to smuggle in malware. How to detect and neutralize these two-faced files?

Our experts investigated which file extensions cybercriminals use most in their email blasts. Here’s a breakdown of the most dangerous attachment types — and how to keep your devices safe from malicious files.

CrashStealer is a macOS infostealer disguised as a videoconferencing app. It abuses Apple’s own trusted mechanisms to sneak onto your computer unnoticed.

How attackers distribute ScreenConnect under the guise of free software to deploy AsyncRAT.

ClickFix attacks, which were once seen mostly on Windows, are now spreading to macOS. We break down the mechanics of the attack, and ways to protect your device.

Who sends regular hidden requests from your smartphone and why, how phone number verification works, and whether you should turn it off.

A new variation of ClickFix allows attackers to gain access to Microsoft 365 accounts. We break down how this technique works, and what threat it poses to organizations.

How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.

Microsoft has addressed approximately 600 vulnerabilities in its products, affecting its entire product line — including even Minecraft Server and Age of Empires II. How can organizations handle such a volume?