Duo Tech

Researchers identified five critical and high-severity memory corruption vulnerabilities in the Cloudflare workerd runtime, enabling sandbox escapes and cross-tenant data theft.

Cybercriminals are stealing AI API tokens using supply chain attacks and infostealers to fuel gray-market 'transfer station' proxy services, causing massive financial losses.

Security researcher Gareth Heyes demonstrates how to bypass CSS sanitizers in major webmail clients to perform real-time keylogging, token theft, and UI defacement.

UNC6692 uses email bombing and IT impersonation via Microsoft Teams to deploy the Edgecution/SNOW malware suite and facilitate ransomware access.

An unidentified threat actor leveraged SQL injection on a Tomcat application to install a database-resident post-exploitation toolkit called khunt on an Oracle server.

Adversaries can bypass passwordless protections by exploiting Google’s Cloud Authenticator onboarding and recovery flows to extract master keys or forge authentication signatures.

The threat actor STAC4749 uses Microsoft Teams vishing to impersonate IT support, gaining remote access to deploy custom loaders, backdoors, and Chaos ransomware targeting North American organizations.

Phantom Mantis utilizes a portfolio of kernel-mode tools, including the GentleKiller-related G12/G13 line and the DriverKiller BYOVD tool, to disable endpoint security products before ransomware deployment.

The Larva-24009 threat actor (HeptaX) targets global enterprises using LNK-based phishing to deploy QuasarRAT, UltraVNC, and NirSoft information-stealing tools.

Chinese-speaking threat actor knaithe utilizes the Hermes Agent framework and DeepSeek LLM to orchestrate autonomous vulnerability research, target enumeration, and exploitation attempts against global infrastructure.