This threat is a scam and likely malware or trojan disguised as a 'Path Of Exile 2 builder' distributed via a Reddit post. The malware reportedly hijacks user sessions on Discord, YouTube, and Facebook, attempting to send direct messages on Discord using IP proxies. The malicious payload is contained within a zip file with an executable, which if run, infects the system. There is no official patch or vendor advisory available. The threat is currently not known to be exploited in the wild beyond the Reddit report.
This entry describes an update to a Threat Actor Intelligence Dashboard, a tool designed to track and profile threat actors with real-time intelligence. It is a resource aimed at the security community to aid defenders by providing refreshed actor profiles and improved search capabilities. The content is promotional in nature, describing the tool's features and availability rather than a specific security vulnerability or active threat. No technical vulnerability, exploit, or attack campaign details are provided.
GoDaddy researchers discovered malware on approximately 1,980 WordPress sites that use the Steam gaming platform's community profile comments as a covert command-and-control (C2) channel. The malware encodes instructions using invisible Unicode characters embedded in seemingly innocuous ASCII art comments on Steam profiles. These instructions direct infected WordPress sites to load malicious JavaScript mimicking legitimate libraries and install a persistent backdoor. The backdoor listens for specific authentication cookies and can receive and execute base64-encoded PHP code to modify plugin and theme files, enabling attackers to maintain persistence even after partial cleanup. Initial infection vectors are unconfirmed but likely include stolen credentials or vulnerable plugins. Detection involves monitoring outbound connections to Steam URLs, suspicious script references, and specific cookie names in POST requests. Remediation requires full removal of all malicious components or restoration from a clean backup predating the infection.
A Clickjacking attack has been observed in the wild involving a compromised local business website. The attack attempts to trick users into executing a command via clipboard manipulation, masquerading as a CAPTCHA challenge. The clipboard content includes a command that downloads and executes a script from an external domain using curl and mshta. The report is based on a Reddit post with minimal technical details and no confirmed exploits beyond the observation. No patch or official remediation guidance is provided. Users should be aware of suspicious clipboard requests and avoid executing unknown commands.
A user on Reddit claims to have obtained the full system prompt for Meta's Support AI and shared a link to it. The post is intended for research and awareness purposes, with no explicit malicious intent stated. There is minimal discussion or verification of the claim, and no official vendor advisory or patch information is available. The threat involves potential exposure of internal AI system prompts, which could impact confidentiality but lacks detailed technical or exploit information.
On May 28, 2026, the Dutch National Police and National Cyber Security Center (NCSC) jointly dismantled a large-scale botnet comprising approximately 17 million compromised devices worldwide. The botnet infrastructure was hosted on about 200 servers physically located in the Netherlands, which were seized from a local hosting provider. The compromised devices included computers, smartphones, and tablets, and were reportedly used as part of a residential proxy service, likely the Asocks network. The hosting provider permanently took the botnet infrastructure offline following the seizure. The NCSC issued prevention guidance emphasizing prompt patching, multi-factor authentication, changing default credentials, securing Wi-Fi with WPA2/WPA3, and maintaining visibility over network devices. This takedown is part of a broader pattern of coordinated international law enforcement actions against proxy and botnet networks in 2026.
On June 1, 2026, multiple npm packages within the @redhat-cloud-services scope were republished with a malicious install-time payload that re-armed repeatedly despite registry purges. The attacker exploited GitHub Actions workflows to produce valid signed SLSA provenance and npm audit signatures, bypassing typical trust mechanisms. The malware uses a GitHub commit-search based command-and-control (C2) dead-drop, avoiding hardcoded hosts. It activates only in CI environments and quickly attempts to steal credentials such as AWS, SSH, Git, and Docker config files. Detection is possible by monitoring package integrity and behavioral checks at publish time. No official patch or remediation guidance is provided in the source data.
LogHound is an open-source post-exploitation tool designed to collect, parse, and analyze Windows Security Event Logs (. evtx) to aid red teams and penetration testers in tracking lateral movement, user sessions, and machine ownership. It addresses challenges in accessing and exfiltrating locked Windows event logs by leveraging native Windows tools and legitimate protocols to avoid detection by endpoint security solutions. The tool processes large event logs efficiently and exports data compatible with BloodHound CE for visualization and further analysis. It is intended for authorized use in penetration testing and forensic investigations.
This entry describes a methodology and toolset for automating dark web OSINT investigations. The approach consolidates multiple data sources such as Tor search engines, paste sites, GitHub, certificate transparency logs, breach databases, and more into a single automated pipeline. This reduces manual effort, speeds up investigations, and helps uncover sources that might be missed by manual methods. It is not a vulnerability or exploit but rather a research and analysis methodology to improve threat intelligence gathering.
This discussion concerns the possibility of cross-site scripting (XSS) attacks via PDF files. A user on Reddit's cybersecurity subreddit shared a proof-of-concept PDF that allegedly triggers a popup when previewed in some web applications, questioning if this constitutes stored XSS. The content is a beginner-level inquiry without confirmed exploitation or detailed technical validation. No official vendor advisory or patch information is available. The threat remains theoretical and unconfirmed in the wild.
A user on Reddit's r/Malware subreddit reported discovering a new malware sample linked to a FiveM low PC graphics pack download. The user uploaded the suspected file to VirusTotal, where it received a detection score of 10 out of 65 antivirus engines. The user performed additional offline and online scans with Windows Defender and observed no immediate signs of compromise. The report is based on a single VirusTotal submission and minimal discussion, with no confirmed exploits or widespread impact noted.
A user reported receiving a security email from Instagram indicating a login attempt requiring verification. The user experienced difficulty resetting their password and was signed out of their account, then prompted for backup codes before being allowed to set a new password. The user is uncertain whether an unauthorized party had their password or if this was a legitimate security notification triggered by a login attempt without the password. No confirmed compromise or exploit is indicated.
A Reddit post in the r/cybersecurity subreddit warns that the password manager Dashlane may have been breached. The post indicates that Dashlane has been quiet for several hours while investigating a potential issue. No official confirmation, technical details, or vendor advisories are available at this time. The poster advises users to change credentials for their most valuable accounts and to export stored credentials as a precaution. There is no evidence of confirmed exploitation or breach details.
This threat involves the use of a large language model (LLM) platform, Venice.ai, which offers uncensored AI capabilities that could be leveraged to create phishing tools. The information originates from a Reddit cybersecurity discussion where a user inquires about uncensored LLMs suitable for phishing tool creation. There is no evidence of active exploitation or specific vulnerabilities in Venice.ai itself. The platform emphasizes privacy and uncensored AI access but does not inherently constitute a vulnerability. No patches or fixes are applicable as this is a misuse scenario rather than a software flaw.
The 2026 Verizon Data Breach Investigations Report (DBIR) reveals a shift in the primary attack vector from stolen credentials to exploitation of software vulnerabilities. Attackers are leveraging AI to identify and weaponize known vulnerabilities faster, reducing the window between disclosure and exploitation from months to hours. Mobile phishing has surpassed email phishing by 40%, and shadow AI usage in workplaces has tripled, with 75% occurring through personal accounts. Third-party breaches have increased by 60% year over year. Despite these challenges, fewer ransomware victims are paying ransoms, with the refusal rate rising from 65% to 69%. This report highlights evolving attacker tactics and the growing difficulty in patching vulnerabilities promptly.
This entry references a Reddit post linking to a video about building a malware analysis lab from scratch. The content appears to be educational and shares personal learnings on setting up such a lab. There is no indication of an active malware threat, vulnerability, or exploit associated with this post. No affected software versions or patch information is provided. The post is informational and does not describe a specific security threat or vulnerability.
This is a public release of an advanced, fully automated Server-Side Request Forgery (SSRF) testing framework designed for security researchers, bug bounty hunters, and penetration testers. The tool automates discovery, validation, and analysis of SSRF vulnerabilities, including cloud metadata testing and advanced testing modules such as WebSocket, gRPC, Kubernetes, and serverless SSRF. It integrates AI-assisted payload generation and analysis to improve testing efficiency. The project is intended strictly for authorized security testing and research. There is no indication of active exploitation or malicious campaigns associated with this tool. No official patches or vendor advisories apply as this is a testing framework, not a vulnerability itself.
Microsoft has implemented enforcement of DMARC policies for outbound email sent to its consumer email services (Outlook.com, Hotmail.com, Live.com) starting May 5, 2025. Domains sending 5,000 or more messages per day must have properly configured SPF, DKIM, and DMARC records with domain alignment to avoid silent rejection of their emails. Messages failing these authentication checks are rejected without bounce or notification, causing potential silent delivery failures. This enforcement primarily affects bulk mailers such as newsletters and transactional email services. Microsoft 365 business accounts use a different filtering system and are not impacted by this policy. The enforcement aligns Microsoft with other major providers like Google and Yahoo, who adopted similar policies earlier. Domains lacking these DNS records or with misconfigurations risk losing email deliverability to Microsoft consumer inboxes.
Polyfill.io, a widely used service for enabling modern JavaScript features in older browsers, was sold in 2024 to a Chinese CDN company. Following this change, reports emerged that polyfill.io began injecting malicious code into websites that included it, potentially compromising user security. Although major browsers like Chrome have started blocking requests to polyfill.io to mitigate this risk, some users still report suspicious behavior such as unexpected credential prompts. This indicates that blocking may not be fully effective or universally applied. The threat involves supply chain compromise through a trusted third-party JavaScript provider, affecting websites that rely on polyfill.io for legacy browser support.
A WHQL-signed kernel driver has been identified as a keylogger, potentially deployed as an anti-cheat Bring Your Own Vulnerable Driver (BYOVD) attack. The driver is signed with a Windows Hardware Quality Labs (WHQL) certificate, which may allow it to bypass some security controls. This threat was reported via a Reddit post linking to external research and a malware sample repository. There is no information on affected versions or known exploits in the wild. No official patch or remediation guidance is currently available.