A toolkit for open source researchers

License plate readers, police drones and fake cell towers are spreading fast, and two hackers are proving that anyone can detect them with about ten dollars of hardware and some open source firmware.Colonel Panic is a malware researcher and hardware builder whose hacking started with AOL dial-up and stacks of 2600 Magazine. After years in…

[Application deadline: Dec 1, 2026] Under the supervision of the senior legal advisor, the research assistant will assist with maintaining a spyware litigation database. This work will involve conduct...

VK can change what the Russian Max messenger does to you, one user at a time. Its surveillance features can be switched on without you noticing. Read our full analysis.

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”.

An exclusive interview with a first-time female operative, and a day-by-day record of her first three weeks inside a North Korean IT worker cell. Her training, her assignments, and the American front ...

EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations.

Apple’s new operating system is here, and along with it comes a new version of Siri, dubbed with two very familiar letters: AI. As the name suggests, this Siri power-up resembles an AI chatbot more

It has been one year since Shai-Hulud made its first appearance on npm.

The woman whose arrest by plain-clothes immigration agents at SFO was caught in a viral video is home after seven weeks in a detention center, she announced Wednesday.

Alt: River Cartwright Thumbs Up (Slow Horses)

A year of incident response data reveals how Akira, DragonForce & Clop build ransomware infrastructure — and how defenders can hunt it.

Alt: "Shut up and take my money"

ALT: Man's Stress Headache

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based implant. Learn how attackers move from social engineering to lateral movement using legitimate tools, and how Microsoft Defender helps detect and disrupt the activity.

Join the Battle for Cloud Security

CTI, threat intelligence, OSINT, malware, APT, threat hunting, threat analysis, CTF, cybersecurity, security