Reader view
Choose the default article length.
Endpoint security, malware, device controls, and host visibility.
A disguised signed MSP360 installer gave intruders one management channel, then installed ScreenConnect for another. Hunt the service-to-installer chain and restrict unapproved agents.
Read article →A legitimate remote-support agent can give a ransomware operator persistent access. Inventory approved tools, watch credential-access behavior and make agent sessions stoppable.
Read article →CERT/CC identifies trusted diagnostic shells with memory-write commands. Match the binary and firmware trust lists, then install vendor updates and verify DBX revocation.
Read article →Readwise Reader 8.10.1 fixes an SVG sanitizer flaw, while two metadata XSS records still include that build. Check Android versions and limit untrusted imports.
Read article →Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.
Read article →Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.
Read article →An HP-specific InsydeH2O SMM handler accepts unsafe memory parameters from a local kernel attacker. Check HP PCs for exposure and install a model-matched BIOS update when HP lists one.
Read article →Three unauthenticated vCast endpoints expose screen images, APK delivery and service input on shared networks. Isolate ViewBoards and check who can reach them.
Read article →Talos traces a phishing-to-Windows backdoor chain affecting Asian institutions. Hunt the script host and sideloaded DLL, then restrict script execution.
Read article →A crafted Sogou URI reached an old, unsandboxed Chromium renderer. Verify the fixed build, then hunt the process, file, and network chain.
Read article →Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.
Read article →CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.
Read article →AOMEI Backupper 8.4.0 exposes physical-disk writes to local users. Without Secure Boot, attackers can plant UEFI code that runs before Windows defenses.
Read article →Showing 14–26 of 77
