All topics
Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there's no confirmation that it’s actually been deployed in the wild.
Attackers impersonated LastPass Authenticator on fake GitHub pages to deliver the Rapuncel infostealer in a campaign involving 40 fake brands.
Active since at least August 2025, the malware represents a functional pivot from the threat actor's existing SparrowDoor backdoor.
A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere.
Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.
