Cybersecurity research, threat intel, and novel findings produce no information shortage. What's difficult is sorting through the noise to determine what's worth following.

An investigation by Lumu CTI exposes a Colombian payment fraud network using fake payment portals to hijack everyday utility bills and harvest banking credentials.

This blog was originally published as part of CyberCX’s C-Suite Cyber Newsletter series on 30 September 2026.     What...

A GitLab incoming email token in your public README never expires and can be used to push code to main. See how exposed docs become external attack surface.

Cybersecurity risks associated with AI in retail and the automotive sector, including data leakage, fraud, LLMJacking and adversarial attacks, together with best practices for protection.

The activity is linked to a broader campaign that previously used a different delivery mechanism

Rapid7 Intelligence tracked a set of Linux samples that blend into the software and device conventions of the telecom environments they target. The set spans a newly observed BPFDoor variant, a BPF Re...

Cling is an IoT botnet that abuses STUN-like traffic to register infected hosts, receive commands, and blend into normal network activity.

Inside the hidden supply chain of residential proxies

What really frustrates an adversary? Eight Cisco Talos researchers share practical ways to make their next move slower and riskier. From deception and behavioral detection to breaking attack dependenc...

A new benchmark of eight leading AI systems shows that an intelligent model still needs a good context-rich harness.

Learn how Cozy Bear exploits common security gaps and how the Trinity Cyber platform stops phishing, exploits and RDP threats before they reach your network.

A single RedLine C2 from UniqueSignal pivots into a maritime spear-phishing cluster and attacker-owned infrastructure.

Luminis Health said MyChart, its online patient portal, is back online as it responds to a cyberattack. The company has still not said specifically what systems were targeted or who is investigating.

A troubling dynamic has settled into the debate over artificial intelligence, and it is actively degrading our ability to evaluate real cyber risk. Rather than engaging in sober, adversarial analysis,...

By Jeremy Brown, VP of Threat Analysis, Trinity Cyber A threat discovered by one security team should always give the next team a head start. Making that happen takes work: examining the evidence, dec...

An investigation by Lumu CTI exposes a Colombian payment fraud network using fake payment portals to hijack everyday utility bills and harvest banking credentials.

The oncoming AI-driven flood of vulnerabilities demands changes to the U.S. process for retaining them for offensive cyber operations.

CISA data shows AI is accelerating exploitation of the same decades-old flaws, making Secure by Design newly urgent. Plus: Palo Alto Networks details a 10-hour AI-powered breach, CISOs rank agent secu...

It’s been more than two weeks since Luminis Health, which operates hospitals in Anne Arundel and Prince George’s counties, said it was the target of a cyberattack. Here’s what we know.

The malware is a cryptocurrency clipboard hijacker and keylogger written in C (GCC/MinGW, native 64-bit PE). It replaces wallet addresses copied to the clipboard with attacker-controlled addresses across 23 coin types, logs keystrokes, and exfiltrates everything exclusively via the Telegram bot API — no custom C2 domain required. On first run it installs three persistent copies of itself under names that impersonate legitimate Windows processes, registers three independent persistence mechanisms (Run key, COM CLSID hijack, WMI subscription), and spawns a watchdog thread to reinstate any that are removed. Live analysis confirmed the C2 channel is active.

Lessons security professionals can learn from the Chargers and Rams' week one losses.

Silent Push became a fast-flux customer to explore its inner workings. We identified an active, nearly impossible-to-detect global operation.

The software industry is entering the AI era burdened by legacy flaws and weaknesses, making Secure by Design essential.

Prepare for CRA reporting obligations from September 2026, including 24-hour alerts, SRP reporting, legacy products, and 2027 EU compliance.

Digital risk has expanded far beyond the traditional security perimeter.

New research from Lumu CTI dissects how TAG-150’s CastleRAT abuses ClickFix, Ethereum, and Steam to bypass enterprise defenses.

Published by Brendan Wilkinolls, Technical Director Secure AI and Cyber Intelligence on September 3 2026 This blog was originally published...

68% of organisations deploy passkeys, 28% are fully passwordless. Where passkey attacks actually land, and the takeover chain that never touches a passkey.

Social engineering uses manipulation in cyber fraud such as CEO fraud and romance scams. Learn the risks, warning signs and measures that can help protect people and organisations.

Uncensored refers to a lack of typical guardrails or ethical restrictions, lowering the technical barrier of entry into cybercrime

The answer is unequivocal: yes. The network is a critical element in preventing and disrupting a ransomware attack. It is […]

One click. Three critical failures. One backdoor.

Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility...

Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats.

The entrepreneurs, venture capitalists, government officials, AI experts, and other innovative, influential people driving the local technology scene

The LATAM CISO Summit 2026 will convene in Cancún, Mexico, bringing together the region’s foremost cybersecurity leaders

Published by Shameela Gonzalez, Financial Services Industry Lead on August 27 2026   As we reflect on the theme of...

A phishing-as-a-service kit no longer needs a fake login page. Inside EvilTokens, Kali365 and the Microsoft OAuth device code abuse behind a 1,380% surge.