Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
958 matching stories — announcement, in Digital Risk Protection (DRP) — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
How threat actors discuss, sell, and use abliterated open-weight models, measured across more than 100,000 Telegram channels and 100 dark web forums. The post AI Models are Fueling a New Wave of Cybercrime: A Quantitative Analysis appeared first on Flare | Identity First Threat Intelligence | Unmatched Visibility into Cybercrime.
As Black Friday and the holiday season approach, shoppers are primed to snag the best deals online before they miss out. There‘s just one problem—hackers are also looking for their next target to make some quick holiday cash. Threat actors have a ream of tricks up their sleeves to deceive shoppers into handing over their […] The post The Dark Side of Black Friday: Scams, Spoofing, and Exploits appeared first on CybelAngel.
Part 1: The Ecosystem and the Actors By Jon DiMaggio, Cybersecurity Researcher The most dangerous thing about The Com isn’t any single group inside of it, but that the ecosystem replaces them faster than law enforcement can arrest the ones already operating. In 2025 and 2026, law enforcement handed down real sentences to real people […] The post Arachnophobia: How Fear, Branding, and Bad Attribution Distorted The Com appeared first on Flare | Identity First Threat Intelligence | Unmatched
See how 1001Pneus stopped competitor price scrapers hiding behind residential IPs, freeing its 50-person team from bot firefighting with DataDome.
How criminals turn spend-management onboarding into fraud infrastructure, and why you may be accountable for the fraud you never see.
Part 500 is the cybersecurity rule of the New York State Department of Financial Services (DFS). Its formal name is 23 NYCRR 500. It applies to firms that operate under...
A customer types examplebank.com with one letter wrong. The page that loads looks right, asks for a login, and the attacker keeps the password. This post covers how that works,...
A vendor risk assessment answers one question: how much damage could this vendor cause us, and are its controls good enough for that? It is a decision about whether to...
Why the controls on an AI agent have to live outside of it, and what a security operations team can implement and maintain those controls.The new privileged user in your environmentSecurity teams spent two decades learning how to work with the people they trust most. Domain admins, DBAs, finance approvers and contractors with VPN access all get a mature playbook: verified identity, scoped access, logged activity and a fast way to revoke it all.Today, we’re navigating the same kind of access with
OverviewWhile performing continuous red teaming exercises through Rapid7’s Vector Command service, Rapid7 discovered three new vulnerabilities in Eptura Archibus. A legacy API endpoint could be exploited to bypass authentication and run various functions without authentication (CVSS: 8.6 High). The most serious functions allow for full database read (CVSS: 8.5 High) and an insecure file upload (CVSS: 9.6 Critical). The insecure file upload leads to remote code execution.Product descriptionArchib
Cybercriminals are selling forged identity documents, deepfake videos, and live verification services to help buyers bypass Know Your Client (KYC) checks. Flare examines how these underground services operate and the techniques used to create and maintain fraudulent verified accounts. [...]
ConnectWise is investigating unauthorized access to application identities associated with Cloud Backup, formerly SkyKick, after researchers detected the applications authenticating into customer Microsoft 365 environments. A vendor-controlled Microsoft 365 application credential was compromised and used to obtain Microsoft Graph access tokens in customer tenants. ConnectWise subsequently disabled seven application identities and suspended Cloud Backup, SaaS […]
SOCRadar Dark Web Team identified several underground posts, including an alleged ZoomInfo database sale involving 185 million records, an alleged TryCircle customer data leak, and an alleged Vicente López municipal database exposure. Other posts advertised a previously compromised HDB Financial Services dataset and an unverified X (Twitter) user database leak claim. Alleged ZoomInfo Database Sale […]
Learn how to detect leaked employee credentials through dark web monitoring, breach intelligence, and suspicious login activity. Discover how to identify exposed accounts, assess security risks, and prevent credential-based cyberattacks. The post How to Detect Leaked Employee Credentials appeared first on Foresiet.
1. BeyondTrust: ARMORY CASTLE exploited a Remote Support zero-day as a China-nexus espionage operation since August The headline: On October 15, 2026, BeyondTrust disclosed CVE-2026-102764, a CVSS 9.3 authentication bypass by spoofing in Remote Support appliances. Mandiant now tracks the China-nexus actor behind the campaign as ARMORY CASTLE, formerly UNC5221, the same group with a […] The post Cyber Roundup: Week of October 12 appeared first on CybelAngel.
Dark web alerts can help security teams investigate potential exposure and identify follow-on threats after a data breach. Burger King Japan disclosed on October 15, 2026, that unauthorized access to its official mobile app membership system resulted in the exposure of approximately 11.18 million customer records. The incident highlights how personal information can create security […]
We now have the complete source code of the phishing kit behind the "free smartwatch" scam that has been impersonating Egypt's banks since 2025. It did not read like the work of a coder. It reads like the notes of someone shopping: a to-do list in Arabic that says "create the applications table" and "add password protection to the admin panel", QA reports and unit tests the operator did not write, and a README that explains, in Arabic, how to stamp out another copy of the whole thing. Every line
Analysis of over 50 million detections from PayPal to Twitch, Google Gemini to Azure shows exposed credentials are everywhere. Imagine a developer’s laptop infected by an infostealer. The malware captures passwords and stored browsing sessions. It can also capture configuration files, settings, and other files containing API keys. A security team may identify the infection […] The post A Study of 49.7 Million Compromised Token Matches Reveals What Password-Stealing Infostealers Find
Mosad is an underground actor primarily involved in the trade and disclosure of sensitive information linked to military, intelligence, government and defense environments. The post Mosad Threat Actor Report appeared first on ThreatMon.
Every Cybersecurity Awareness Month campaign rests on four habits: Strong passwords, Multifactor authentication, Spotting phishing, and keeping software updated. All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent, and AI agent security has no equivalent of the annual training. The National Cybersecurity Alliance's theme this year is "Don't Make It Easy for Them," built on the idea that small ha
Beyond the catwalks and the glossy magazine covers, the global luxury goods market is on track for USD 480 billion in 2026, with French and Italian maisons still leading the way. From New York, Rome, and Paris, luxury brands are major players in the global economy, which makes them a standout target for counterfeiters, fraud […] The post Luxury Cybercrime in 2026: Best Practices for CISOs appeared first on CybelAngel.
Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone, was of the latter kind.Virus Bulletin created the award to honor Péter's life and work, and it recognizes outstanding technical security research: the rigorous, the deep, and the useful – exactly what he was known for himself. And as far as recognitions in our industry
Krybit is a fast-growing ransomware gang that was hacked by a rival, hit back, and is still extorting victims. Find out how it works, who it has targeted, and what organisations can do to protect themselves. Read more in my article on the Fortra blog.
Dark web alerts help security teams identify potential data exposure, but the UK Legal Aid Agency (LAA) incident demonstrates why breach intelligence must be combined with verified reporting and ongoing investigation. In an update published on October 14, 2026, the UK government confirmed that data stolen during the agency’s 2025 cyberattack included approximately 250,000 records […]
Blog Open Ports Aren’t the Problem. Unknown Exposure Is. An organization’s external attack surface is not static. New servers are deployed, cloud resources appear, applications move between environments, firewall rules change, and temporary services can remain exposed long after they are needed. One of the clearest signals of this shifting exposure is an open network […] The post Open Ports Aren’t the Problem. Unknown Exposure Is. appeared first on ThreatMon.
Milk Dragon uses social ads and fake discounts to steal payment details. Learn how the scam works and how brands can disrupt it before it reaches customers.
Follow stolen card data from testing and resale to identity risks and recovery scams, with practical steps for victims and faster disruption for brands.
See how attackers hijack vendor threads to redirect ACH and wire payments, which signals to check, and how verified callbacks and dual approval reduce risk.
Recent news of multiple South Korean banks having their networks breached has once again deepened the industry's alarm over AI attacks. Even when attackers are not technically skilled, they can use AI agents to cause a major security impact.
Threat research is always a bit of a cat-and-mouse game, and it’s often made more so when an actor survives years in the face of scrutiny. The actors behind the so-called Help Traffic Distribution System (TDS) are one such case. They’ve been active since at least April 2017 and have been largely unaffected by the […] The post Inside Help TDS: Hotejka, Cloudflare Pages and Predictive Detection appeared first on Infoblox Blog.
DataDome’s latest report uncovers a 41.5% surge in AI agent traffic, a 4.7x jump in agentic browser requests, and a shifting agent mix. Learn more.
Meta’s Muse hit 29M requests in 12 days. See DataDome's Q3 2026 AI agent traffic data for insights on agentic browsers, top AI agents, and risks for your site.
Modern takedown operations automate the detection, evidence, and filing. The part they cannot automate is the intermediary’s decision to act. Understanding both sides is what separates effective programs from performative ones. The word “takedown” implies something immediate: report a malicious site, and it disappears. The reality has two halves. The first, detecting the impersonation, gathering […] The post How Phishing Takedowns Actually Work appeared first on Allure Se
Cisco Secure Email & PAN-OS Zero-Days Exploited Cisco and Palo Alto Networks have patched two actively exploited zero-day vulnerabilities that can lead to root-level code execution on security appliances. CISA has flagge
Executive Summary Cyble has continued tracking GhostBat RAT activity targeting Android users in India since its initial identification in October 2025. Recent investigations into malicious mParivahan and eChallan-themed applications revealed a broader operator-controlled ecosystem that we track as GhostX. Analysis of the exposed GhostX backend identified administrative and user-management structures, device-control records, SMS-delivery instructions, call-forwarding activity, and continuously ch
When a board slide fails, it's usually because the numbers are wrong. The external threats slide fails the other way around. The numbers are accurate, the work behind them was real, and nobody in the room knows what to do with any of it. The post What belongs in a cybersecurity board report on external threats appeared first on Bolster AI.
Blog Wallstreet Ransomware: A Closer Look at Sweden’s Unusual Victim Cluster Executive Summary During routine dark web monitoring activities, ThreatMon analysts identified a notable concentration of Swedish organizations among the victims recently listed by the Wallstreet ransomware group. On October 13, 2026, the group published 10 Swedish organizations on its dark web leak site, accounting […] The post Wallstreet Ransomware: A Closer Look at Sweden’s Unusual Victim Cluster ap
Discover how the MrBeast & Chicken Road 2 casino affiliate scam operates via PWA fake app stores and learn essential steps to protect yourself.
The Ukrainian military can again use SpaceX’s Starshield satellite service on the move, a Defense Ministry source told Recorded Future News on Thursday, days after sudden restrictions disrupted drone missions along the front line.
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for