LATEST

Seeking Counsel: Ongoing Targeted Campaign Against US Law Firms

Written by: Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, Tyler McLellan Introduction From January through May 2026, Mandiant identified a financially motivated data theft extortion campaign executed by the threat cluster UNC3753 (also tracked as "Luna Moth," “Chatty Spider,” and "Silent Ransom Group") targeting dozens of organizations across professional, legal, and financial services in the United States. UNC3753 leverages voice phishing (vishing) and social engineering deception tech…

CVE-2026-10880 - Osnexus Quantastor 9.8 Unauthenticated SQL Injection

Osnexus Quantastor 9.8 Unauthenticated SQL Injection

Error 524 Decoy: Desenmascarando una Operación Global de Smishing Oculta Tras Páginas de Error

Los investigadores de Group-IB exponen una operación de smishing y phishing a gran escala que suplanta más de 260 marcas en 72 países, utilizando páginas de error 524 falsas para evadir el análisis.

Cisco Webex Meetings Cross-Site Scripting Vulnerability

A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed. This vulnerability existed because of insufficient validation of user input. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious lin…

Inside .NET Loader Analysis: From Malspam to In-Memory Loader

A malspam campaign abusing Google's DoubleClick delivers the loader through a five-stage chain that evades detection and blinds Windows telemetry before persisting

Lessons for life: Why children’s data is a long-term identity risk

Your child’s first data breach may happen before they’ve even opened a bank account. Here’s how to keep their digital life safe.

Error 524 Decoy: Unmasking a Global Smishing Operation Hiding Behind Error Pages

Group-IB researchers expose a large-scale smishing and phishing operation impersonating 260+ brands across 72 countries, using fake Cloudflare error pages, geofencing, and encrypted WebSocket channels for real-time credit card theft.

SolarWinds Web Help Desk Unauthenticated File Upload

SolarWinds Web Help Desk Unauthenticated File Upload SolarWinds Web Help Desk contains an unauthenticated file upload vulnerability. A remote attacker can submit arbitrary file uploads to the affected host without authentication, allowing the attacker to consume all available disk space on the volume hosting the application and induce a denial-of-service condition. Ben Smith Tue, 06/02/2026 - 14:38

How Android helps keep you safe from impersonation scams with fake call detection

Warning that says 'someone may be pretending to call from your contact's number'

Cyber Brief 26-06 - May 2026

Cyber Briefs are monthly executive reports that aim to present an overview of the most relevant developments in cyber security, based exclusively on open sources, with a view to inform political leadership and senior management in its constituency. Additional information on any item in this Brief can be provided upon request. Cyber Briefs are TLP:CLEAR.

Unpatched NTLM Leakage in Windows search: URI Handler, Same Bug, No CVE, No Fix

The same NTLM leakage primitive that got patched in the Snipping Tool exists in Windows Explorer's search: handler. No CVE. No fix. If your patching relies on CVE coverage, you have a blind spot.

Cryptocurrency Scams: The 10 Most Common Types and How They Work

Learn the most common crypto scam types and how they work in practice. Understand how financial institutions can detect fraud earlier and prevent losses at the fiat-to-crypto boundary.

The $48 Billion Blind Spot: Why Merchants Pay for Card Breaches They Can’t See

Merchants face $53B in card fraud losses but lack access to compromised card data. Discover the three barriers keeping merchants in the dark — and the solution.

Amazon Cognito 1-Click Open Redirection via OAuth Error Handling Abuse

Amazon Cognito 1-Click Open Redirection via OAuth Error Handling Abuse Researchers associated with Tenable have discovered a 1-click open redirection technique in Amazon Cognito that can be triggered by abusing the OAuth error-handling mechanism. The vulnerability stems from AWS's OAuth implementation validation sequence: if validation fails due to an unsupported scope, mismatched PKCE parameters, or an unsupported response type, the error handling processes the failure and automatically issues…

Microsoft Entra ID 1-Click Open Redirection via OAuth Error Handling Abuse

Microsoft Entra ID 1-Click Open Redirection via OAuth Error Handling Abuse Researchers associated with Tenable have discovered new techniques to trigger 1-click open redirection attacks in Microsoft Entra ID by abusing the OAuth error-handling mechanism. The attack relies on an initial setup phase where a threat actor registers an OAuth application in an actor-controlled tenant and configures its redirect_uri to point to an attacker-controlled domain. When a victim clicks on a specifically craf…

This month in security with Tony Anscombe – May 2026 edition

In this roundup, Tony looks at attacks against Polish water treatment facilities, how AI-directed attacks failed in Mexico, and what Google believes is the first AI-generated zero-day exploit

Bringing AI agents to Chrome Enterprise security management

Two dashboard side by side

ESET APT Activity Report Q4 2025–Q1 2026

An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2025 and Q1 2026

Your Profile Is a Dossier. Here's Who's Reading It.

Your social media profiles are an attacker's dossier. Learn how attackers use public data to build attack playbooks and what you can do to give them less to work with.

Before Your MSP Chases CMMC, Take an Honest Look at Your Operations

CMMC is an operating model, not a checklist. Before chasing defense work, audit your MSP's internal operations, including access controls and data handling, to ensure you’re ready for the scrutiny.

What to consider before asking an AI chatbot for health advice

Using chatbots for medical advice could elicit hallucinations and even expose you to security and privacy risks. Here’s what’s at stake and how to stay safe.

The GHOST STADIUM Score: Billions At Stake At The World’s Largest Football Tournament

With the 2026 FIFA World Cup just weeks away, Group-IB researchers have uncovered six distinct fraud schemes, four independent threat actors, and over 4,300 fraudulent domains impersonating FIFA's official web presence — including a sophisticated phishing operation run by the Chinese-speaking threat actor GHOST STADIUM, whose campaign could cause losses reaching billions of dollars.

BTMOB: A stealthy RAT burrowing deep into Android devices

The malware pairs remote access capabilities with ready-made campaign tools, lowering the barrier for full device compromise

From Cookies to Keys: The Threat of Session Hijacking

See how session hijacking reshaped cyber threats. Learn how stolen tokens enable rapid breaches, bypass security, and impact enterprise protection.

2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing Services

While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region. These services not only lower the barrier to entry for Chinese cyber criminals, but reveal …

Online Payment Fraud Prevention: Best Practices for Organizations

Learn what payment fraud is, how it unfolds, and the practical controls that organizations can use at every step of the payment process to reduce losses without harming customer trust.

Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise

Watch out for bogus World Cup websites that mimic official ticket and merchandise flows to steal money and personal data

Security Alert: [Updated] Alert Regarding Multiple Vulnerabilities in Trend Micro Products Including TrendAI Apex One

How Huntress Uses Managed SIEM to Detect Threats Faster

See how Huntress uses Managed SIEM to detect threats faster, hunt smarter, and deliver comprehensive protection across endpoints, identities, and infrastructure.