Targeted
Threat Intelligence

ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories

The internet did not break this week. It got used exactly as designed, which is worse. Searches were siphoned through shady browser add-ons. AI chat links turn...

Multiple Vulnerabilities in Firefox 152 Enables Remote Code Execution Attacks

Mozilla has released Firefox 152 to address multiple high-severity vulnerabilities that could allow remote code execution (RCE) and sandbox escape attacks. The ...

Hackers Can Leverage SQL Server 2025 AI Features to Exfiltrate Sensitive Data

Hackers are increasingly finding new ways to abuse legitimate enterprise features, and Microsoft SQL Server 2025’s newly introduced AI capabilities are now rais...

Hackers Abuse Microsoft Fondue.exe to Side-Load APPWIZ.cpl and Execute Malware

A newly uncovered attack campaign has brought a rarely scrutinized Windows executable into the spotlight. Threat actors are actively abusing Fondue.exe, a legit...

Hackers Abuse Legitimate RMM Tools to Maintain Persistent Access and Evade Detection

Hackers have found a new way to get AI tools to do their dirty work without paying for it. Instead of using their own resources, attackers are hijacking exposed...

Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions

Hackers are increasingly exploiting trusted AI platforms to deliver sophisticated social engineering attacks, with a recent campaign abusing Claude.ai’s shared ...

Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2

Microsoft has disclosed details of a Windows-based cryptocurrency clipper campaign that has targeted users since February 2026. "The clipper in this campaign r...

Critical Cisco ISE Vulnerability Allows Attacker to Execute Malicious Code Remotely

Cisco has disclosed critical security vulnerabilities in its Identity Services Engine (ISE) that could allow attackers to execute malicious code remotely and ac...

Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks

Market intelligence platform Klue suffered a OAuth breach that enabled the "Icarus" threat actors to steal Salesforce CRM data from multiple organizations in an...

FortiBleed exposed admin credentials for 75,000 Fortinet firewalls worldwide

A newly uncovered cybercrime operation dubbed FortiBleed has exposed administrative credentials for approximately 75,000 Fortinet FortiGate firewalls, potential...

INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023

Cybersecurity researchers have charted the evolution of INC from an nascent ransomware-as-a-service (RaaS) operation to one of the most prolific cybercrime grou...

5 reasons Microsoft 365 backup isn’t enough for business data protection

Microsoft 365 helps keep services running, but protecting and recovering business data remains your responsibility. Acronis breaks down five gaps organizations ...

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal c...

Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp

International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish bo...

Accenture to Acquire Majority Stake in Dragos, All of runZero, NetRise in $4.1 Billion OT Cybersecurity Push

The deal values industrial cybersecurity giant Dragos at $3.25 billion, and runZero and NetRise will operate under Dragos. The post Accenture to Acquire Majorit...

Get Out of Security Debt by Tackling the Exposure Problem

Teams digging out of security debt need to answer only two simple questions: Which vulnerabilities in our systems are exposed, and how long should they stay tha...

ShapedPlugin update flow hacked to infect WordPress sites

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the vendor's o...

Modern Data Protection Standards: How Organizations Are Strengthening Cybersecurity in 2026

Organizations today operate in an increasingly hostile cyber threat landscape where data protection has become a critical business requirement. While digital tr...

No Exploits Required

Four decades of incident response experience suggest that exploits are often the symptom, not the root cause, of today’s cybersecurity failures. The post No Exp...

Apple fixes Beats Studio Buds flaw that let hackers spy on conversations

Apple has released security updates to patch a high-severity flaw affecting the Beats Studio Buds wireless earbuds that could allow attackers in Bluetooth range...