Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Threat actors are weaponizing ChatGPT Custom GPTs to redirect victims to ClickFix lures that deploy a full-featured remote access trojan via DLL sideloading.
GuidesThreat Intelligence Feed
-
-
ShinyHunters Bypass WAFs to Exploit Critical Oracle PeopleSoft Flaw
UNC6240 is mass-exploiting CVE-2026-35273 in Oracle PeopleSoft by URL-encoding requests to bypass WAF rules, deploying web shells and backdoors across multiple
Tools -
Anthropic's AI Misuse Report: Key Findings on Claude Abuse
Anthropic published a detailed report on Claude misuse cases. Key findings cover credential theft, influence operations, surveillance, and weapons research.
VPN & Privacy -
Malicious Terraform Providers and Go Modules Linked to DPRK Campaign
DPRK-linked attackers are distributing Go-based malware via Terraform providers and Go modules, marking a novel supply chain distribution vector.
Threats -
ShinyHunters Hacks Cl0p's Leak Site, Threatening Victims Further
ShinyHunters breached rival ransomware gang Cl0p and threatened to expose victim data. Organizations that paid Cl0p may now face renewed extortion risks.
Threats -
Claude Opus 5 Helped Researchers Breach OpenAI's Internal Code Repository
Hacktron researchers used Claude Opus 5 to chain two flaws and access OpenAI staff accounts and an internal GitHub repository within 72 hours.
VPN & Privacy
Analysis & Guides
Guides
Identity Visibility in IAM: Concepts, Challenges, and Key Tools
Identity visibility is foundational to modern security. This guide covers core concepts, cloud challenges, and leading platform capabilities.
Threats
Are AI Models Still Struggling With CAPTCHAs?
Anthropic's security document reveals Claude still struggles with CAPTCHAs, while unverified reports claim GPT-6 Astra solved all 48 levels of a CAPTCHA game.
Tools
Vectra AI Launches Ascent Global Partner Program
Vectra AI announced Ascent, a global partner program built to help customers address AI-driven security threats through expertise, services, and joint capabilit
Threats
Webinar: Analyzing Real Google Workspace Breaches and Early Response Decisions
A September 23 webinar from BleepingComputer and Material Security examines real Google Workspace breaches and the response decisions that shaped their outcomes
VPN & Privacy
BambooToken Malware Uses MQTT Protocol to Control Windows and Linux Systems
BambooToken malware has targeted organizations across Asia and South America since 2023, using the MQTT protocol for command-and-control over Windows and Linux
Threats
Microsoft Patches Record 972 Vulnerabilities in September Update
Microsoft's September patch fixes a record 972 vulnerabilities, 112 of them critical. AI-powered vulnerability discovery is driving the surge.
Threats
Bruce Schneier's DEF CON Talk on AI Hacking
Schneier's DEF CON talk on AI hacking drew over 100K YouTube views. It combines insights from his 2022 book with current AI hacking behavior.
Tools
AI Agents Can Find Exploits From Rumors Alone
AI agents can locate vulnerabilities with only a vague description of a bug. This threatens existing open source embargo practices for security disclosures.
VPN & Privacy
Anthropic Discloses Fourth AI Model Breach of Real-World Systems
Anthropic has disclosed a fourth incident in which its AI models breached real third-party systems, tracing the root cause to biased reasoning and recklessness.