Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.

Attackers abuse Node.js to execute malicious scripts and deploy payloads in attacks targeting governments, technology ...

Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based ...

Microsoft Threat Intelligence identified a “TerminalFix” social engineering campaign designed to deploy a custom Python-based ...

Threat actors are abusing legitimate remote-management tools, including ConnectWise ScreenConnect and Microsoft Quick Assist, ...

Threat actors are increasingly exploiting overlooked Active Directory service principal name misconfigurations, making ...

This week’s ThreatsDay Bulletin tracks fake IT calls, abused remote tools, phishing kits, unsafe downloads, ransomware, ...

PostgreSQL vulnerability CVE-2026-6471 allows low-privileged attackers to execute code, gain PostgreSQL superuser access and ...

NCC Group's July threat report highlights Jadepuffer, an AI-driven ransomware operation that can carry out much of an attack without a human directing every step. Jadepuffer can change tactics when an ...

The flaw that had gone unnoticed since 2014 could let attackers with low-privileged replication access execute code, gain ...

A toolkit shaped by decades of Unix history makes technical work second nature on Linux.

PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over ...