Hot Topic

On September 1, 2025, Qrator Lab identified and managed a major attack from the largest L7 DDoS botnet seen so far, targeting a government organization. A total of 5.76 million IP addresses were blocked. Qrator Labs has been tracking a botnet for months. The first attack occurred on March 26, …

Investigations into the Nx “s1ngularity” NPM supply chain attack have unveiled a massive fallout, with thousands of account tokens and repository secrets leaked. According to a post-incident evaluation by Wiz researchers, the Nx compromise has resulted in the exposure of 2,180 accounts and 7,200 repositories across three distinct phases. Wiz …

Security researchers found that three unauthorized TLS certificates were issued in May 2025 for 1.1.1.1, the public DNS service operated by Cloudflare. Improperly issued certificates by the Fina RDC 2020 authority could let attackers intercept and decrypt DNS queries, revealing users’ browsing habits. However, if a malicious or unauthorized party …

Palo Alto Networks suffered a data breach that exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance. The company states that it was one of hundreds of companies affected by a supply-chain attack disclosed last week, in …

A viral story claims that Google has warned all 2.5 billion Gmail users about account risks due to a recent Salesforce breach, but this is false; no such warning exists. Google has now responded, that “unfortunately, several inaccurate claims surfaced this week incorrectly claiming we issued a broad warning to …

Domains aimed at capitalizing on the FIFA Club World Cup 2025 in the U.S. have been discovered, signaling preparations for the upcoming 2026 World Cup. PreCrime Labs from BforeAI, a cybersecurity firm focused on proactive threat prevention, reports that many domains for the FIFA World Cup 2026 have already been registered …

A new Android malware called SikkahBot is targeting students in Bangladesh by pretending to be official apps from the Bangladesh Education Board. Cyble Research and Intelligence Labs (CRIL) found that this malware has been active since July 2024. According to CRIL, the SikkahBot malware is distributed through shortened URLs, including …

AI-driven malware has emerged sooner than anticipated, with the first identified ransomware using AI for local tasks now found. ESET reports that the AI-powered ransomware is currently just a proof-of-concept and still in progress, but it seems to have all the features of traditional ransomware. Dubbed PromptLock, the malware is …

It is no secret that passwords are highly susceptible to phishing and brute force attacks. This led to the mass adoption of passkeys, a passwordless authentication method leveraging cryptographic key pairs that allows users to log in with biometrics or a hardware key. According to FIDO, over 15 billion accounts …