A Vietnamese threat actor's shift from PXA Stealer to PureRAT | Huntress

CISA Shares Lessons Learned from an Incident Response Engagement | CISA

Kawabunga, Dude, You’ve Been Ransomed! | Huntress

EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks | Trend Micro (US)

Unraveling Phishing Campaigns Flagged by Trustwave’s URL Scanner

TAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and Dissidents | Trend Micro (US)

Malicious Screen Connect Campaign Abuses AI-Themed Lures for Xworm Delivery

Rapid Response: CVE-2025-7776

Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System | CISA

Phishing in the Cloud: SendGrid Campaign Exploits Account Security

SlashAndGrab: ScreenConnect Post-Exploitation in the Wild (CVE-2024-1709 & CVE-2024-1708) | Huntress

This 'SAP Ariba Quote' Isn't What It Seems—It's Ransomware

Crypto24 Ransomware Group Blends Legitimate Tools with Custom Malware for Stealth Attacks | Trend Micro (US)

When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub’s Expanding Arsenal

Echoes in the Shell: Legacy Tooling Behind Ongoing SharePoint ‘ToolShell’ Exploitation

Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto | SentinelOne

Active Exploitation of SonicWall VPNs | Huntress

Active Exploitation of Microsoft SharePoint Vulnerabilities

In-the-wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies

In-The-Wild Exploitation of CVE-2025-53770 and CVE-2025-53771: Technical Details and Mitigation Strategies

Zoom Phishing Scam Mimics Connection Issues to Steal Logins

#StopRansomware: Interlock | CISA

Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild | Huntress

BERT Ransomware Group Targets Asia and Europe on Multiple Platforms | Trend Micro (US)

LightSpy Malware Variant Targeting macOS | Huntress