X-Industry

Abnormal AI has released a comprehensive report detailing the ZeroTokens platform, a sophisticated live-operator phishing infrastructure that has evolved significantly since its initial disclosure in August 2026.  The expanded investigation reveals the scope of operations, resilience, and technical sophistication, showing how threat actors have systematically targeted financial institutions globally.  Since Abnormal's initial disclosure (below), the scope of the ZeroTokens campaign has expanded

Business email compromise (BEC) has become the most common type of cyber-attack affecting South African organizations.  Most local companies have either suffered such an attack or received messages from compromised accounts amid an unprecedented surge in incidents.[1]

Interpol’s Cyberthreat Assessment Report 2026 stated that 70% of BEC detections in Africa originated in South Africa.  Despite rampant growth, Interpol said the method used to initiate a BEC attack has remained the same over the la

A new analysis has revealed that Max, Russia's state-linked "super-app", functions as an advanced surveillance tool capable of monitoring tens of millions of citizens with a level of detail rarely seen in consumer technology.  According to the findings, the platform can capture screenshots of a user's device, harvest private messages and financial data, inject code, and even impersonate users within the app itself.  The research suggests that Max represents an unprecedented level of state-contro

A sealed box, a cat, a vial of poison, and a quantum trigger that may or may not fire.  As long as Schrödinger’s thought experiment has circulated, it has pointed to a gap in our picture of nature.  Atoms and subatomic particles can occupy two states at once.  Tables, people, and cats cannot. Somewhere between a single particle and a living animal, the both-at-once description gives way to ordinary, one-thing-at-a-time reality. Physicists call that fading of quantum overlap decoherence. In their

Cybersecurity researchers at Bitdefender have identified a campaign called Midnight Mimosa affecting multiple low-cost Android phone brands built on MediaTek platforms, allowing operators to install apps, grant permissions and load code without the owner’s consent.

The infection happens below the normal app-installation layer. In its research shared with Hackread.com, Bitdefender notes that “every user-facing defense had already been bypassed” by the time the phone was switched on.[1]

Example on

A financially-motivated threat actor recently deployed open-source AI agent frameworks to attack hundreds of online retailers at scale, compromising more than 100 e-commerce websites and exfiltrating over 600,000 credit card records.  Active since July 2026, the campaign has leveraged three specialized AI tools to execute the complete attack chain across target networks with minimal human intervention.[1]

The automated framework relied on Strix, an AI penetration testing framework that conducted

Salt Security published research showing a critical vulnerability in the Manus agentic AI platform that could have let a single malicious email hijack the system and expose user-connected accounts. The vulnerability has since been addressed, but it highlights fundamental security challenges enterprises face when deploying autonomous AI agents.  Manus is a general-purpose agentic AI platform that lets users automate multi-step tasks, including research, data analysis, content creation, and softwa

Turn trusted adversary intelligence into a practical roadmap for faster, more confident threat detection. In addition to weekly cyber threat presentations and industry-segment-specific articles, this library is now available at https://www.redskyalliance.org as a service for our followers.

The MITRE ATT&CK detection library gives security teams a proven, publicly available foundation for designing detections around real adversary behaviors. By mapping detection guidance to the MITRE ATT&CK frame

SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands.  These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.  In the incident, Fortinet analyzed the SectopRAT payload was concealed within a legitimate program developed by an Italian company with a long-standing digital

SentinelLABS recently examined the gap between cybersecurity benchmark scores and operational usefulness.  In the months that followed, they observed those same design gaps in the flood of agentic systems hitting the market.  This fail-fast development trend treats evaluation as a process that emerges after the proof of concept.  In other words, teams build the system, demonstrate that it can work, and defer the harder task of establishing how reliably it performs and where it fails for a later

FortiGuard Labs has identified a Linux backdoor that exploits known vulnerabilities in internet-facing devices and converts infected systems into remotely controlled proxy nodes.

Hacking& Cracking - Called ClingSTUN, the malware supports remote command execution, maintains access after a reboot and uses legitimate public STUN servers to communicate through network address translation.[1]

Known Vulnerabilities Used for Initial Access - According to the company’s report shared with Hackread.com ah

When a factory robot governed by a generative AI model swings an arm toward a target, its path can respond to environmental conditions.  It may not hit a person. The same constraint appears in other less dramatic applications that fail in the same way.  An edited portrait may change the light or the expression; it may not become someone else.  A simulated physical field may take an unexpected shape; it may not leave the envelope the equipment was designed for.  In each case, the generator is fre

The notorious extortion group ShinyHunters announced that it had breached the Federal Bureau of Investigation (FBI) and stolen records on current and former employees.  In a statement on its dark-web site, the group said it targeted the agency after a May 2026 advisory that outlined its methods and urged victims not to pay. It claimed to have taken data on almost all FBI agents and individuals who applied for jobs there. The announcement followed a brief appearance of the group’s banner on the F

Microsoft Threat Intelligence has detailed new phishing and malware delivery activity from Star Blizzard, a Russian state threat group.  The group, also known as Callisto Group and SEABORGIUM, is associated with Centre 18 of Russia’s Federal  Security Service, according to the US Cybersecurity and Infrastructure Security Agency (CISA).

Hacking & Cracking - Since January 2026, Microsoft has identified at least 13 large-scale phishing campaigns targeting organizations worldwide. The activity affec

For years now, Red Sky Alliance has been reporting on vessel name spoofing, using fake email addresses to lure companies in the maritime arena to click on infected emails.  Now Georgia Tech has revealed vessel GPS spoofing, which produced a study showing 367,000 ships affected by global GPS spoofing.  This research included the Red Sea activity detected months before the MSC Antonia grounding in May 2025.  Researchers analyzing global ship-tracking data have identified 31 persistent areas of abn

Kiteworks is a provider of secure file-transfer and data-sharing software. Its products are used by organizations to exchange sensitive information with employees, customers, and various other outside organizations. As we've seen in recent months, services sitting at the boundaries between organizations and outside parties are attractive targets for attackers seeking large amounts of data.

On September 25th, Kiteworks took a bit of an unusual approach and advised their customers to shut down the

Hackread.com posted a great example of cyber security in action.  A long-running supply-chain campaign has used malicious npm packages to deliver a remote access trojan (RAT), steal credentials and maintain access to compromised Windows systems.  CloudSEK’s Global Threat Intelligence team called the operation MALFEX and linked it to a single operator active since August 2023.[1]

Hacking& Cracking - The operator used multiple npm accounts containing the Malfex name, along with a GitHub account ca

• Artificial General Intelligence (AGI) and Artificial Superintelligence (ASI) represent successive stages beyond today’s narrow AI systems.
• Narrow AI (the present)
• Current AI (also called Artificial Narrow Intelligence or ANI) is specialized. Systems like large language models, image generators, recommendation engines, or game-playing agents excel at specific tasks but cannot flexibly transfer knowledge or solve novel problems outside their training distribution the way a human can. They lack a

A bank creating an encryption key, a state drawing a lottery, and a hospital assigning patients to a trial all need the same thing: a random number that nobody in the room, and nobody who built the machine generating random output, could have known in advance. Ordinary computers aren’t optimized for randomness. They follow recipes. Left alone, they cycle, repeat, or leak the rhythm of their own clocks. As a result, modern systems keep asking for fresh and increasing volumes of unpredictability.

Research published by Chainalysis shows that nation-state cyber actors are leading an unprecedented expansion in the use of public distributed ledgers to orchestrate cyberattacks.  Analysts recorded a 440% year-on-year surge in what the industry terms "blockchain dead drop" (BDD) techniques. In these schemes, threat actors insert malicious commands and routing instructions straight into public ledger records and automated smart contracts.[1]

Conventional attack infrastructure relies on centraliz