Pulling the latest reports from PhishTank, OpenPhish, URLhaus, FTC, FBI IC3, AARP, and partner RSS feeds. Hold tight — this usually takes a second or two.
Aggregated from PhishTank, OpenPhish, URLhaus, Google Safe Browsing, and per-source RSS feeds. Top category this week: Business email compromise. The messages look real. The links don't. Here's what's running, who it targets, and how to spot it before you tap.
A young man called crying, saying 'Grandma, I'm in trouble.' He said he was arrested and needed bail money wired immediately. He begged me not to tell his parents. I was about to go to Western Union when my neighbor suggested I call my grandson directly — he was fine, sitting at home.
Zoom is warning of a critical vulnerability in its desktop client and software development kit for Windows that could be exploited by an unauthenticated party to hijack accounts. [...]
Opens in a new tab →
Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed
Opens in a new tab →
Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning that anything in the folder is about to execute. Whatever that binary does, it does as you, with your source, your SSH keys and your cloud tokens. Cursor keeps re-running it for as long as the project stays open. No prompt
Opens in a new tab →
LastPass is warning users about an ongoing phishing campaign that is using fake security notices to direct them to fraudulent websites. [...]
Opens in a new tab →
At least two distinct threat actors are weaponizing a novel evasion technique called OAuth client ID spoofing in cloud campaigns, while slipping past telemetry. The activity allows users to enumerate user accounts and validate stolen credentials in Microsoft Entra ID environments, without ever generating a successful sign-in event that would otherwise alert defenders. And bad actors have begun
Opens in a new tab →
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting vulnerabilities in the iCagenda and Balbooa Forms extensions for Joomla to achieve remote code execution through arbitrary file uploads. [...]
Opens in a new tab →
Cybersecurity agencies from the United States and eight other countries have issued a joint warning that Russian state hackers are targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks. [...]
Opens in a new tab →
Paste a URL, an email address, or a phone number. We cross-reference live threat feeds and return a verdict in plain English, with the reasons behind it.
30 REQ / MIN · RATE-LIMITED BY IP