Sekoia.io is looking for a Technical Threat Researcher!

Analysis of the CVE-2025-32432 compromise chain by Mimo: exploitation, loader, crypto miner, proxyware, and detection opportunities.

Discover ViciousTrap, a newly identified threat who turning edge devices into honeypots en masse targeting

Après un premier tour de table de 35 M€, Sekoia.io annonce une seconde levée de fonds de 26 M€. Ce financement va servir à l'éditeur de...

Discover the power of detection engineering and how it can help scale your cybersecurity projects efficiently.

Sekoia.io recrute un(e) Sr Technical Threat Researcher !

In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.

Discover how we successfully disinfected thousands of computers infected with the PlugX worm using two remote disinfection methods.

Zero-day exploitation of Ivanti Connect Secure VPN vulnerabilities since as far back as December 2024.

Check Point Researchers uncover a new version of Banshee macOS, finding that its string encryption is the exact copy of Apple's XProtect

Our blog entry discusses a fake PoC exploit for LDAPNightmare (CVE-2024-49113) that is being used to distribute information-stealing malware.

A malicious npm campaign is targeting Ethereum developers by impersonating Hardhat plugins and the Nomic Foundation, stealing sensitive data like priv...

Invitations to try a beta lead to a fake game website where victims will get an information stealer instead of the promised game

By Nati Tal (Head of Guardio Labs)

A phishing campaign targeting European companies used fake forms made with HubSpot's Free Form Builder, leading to credential harvesting and Azure account takeover. A phishing campaign targeting…

Key findings  Proofpoint observed advanced persistent threat (APT) TA397 targeting a Turkish defense sector organization with a lure about public infrastructure projects in Madagascar.   The attack...

The Dragos Ransomware Analysis for Q3 2024 evaluated variants used against industrial organizations worldwide. Learn more about our assessments and findings.

During an incident response for one of our clients, we stumbled upon a server compromised by the now relatively documented 1234 perfctl malware.

Learn about the 2024 evolution of the LATAM cybercrime landscape, including adversary TTPs and key malware families.

A technical analysis of how a malware campaign using a game cheat lure leverages Node.js to distribute XMRig, Lumma and Phemedrone Stealer.

Team82 obtained a sample of a custom-built IoT/OT malware called IOCONTROL used by the Iran-affiliated attackers to attack Israel- and U.S.-based OT/IoT devices.

An in-depth analysis of Xloader malware delivered via spoofed SharePoint notifications.