Mirko Zorz
354 dark web vendors and buyers arrested in Operation TorNado
Europol and police in 14 countries arrested 354 dark web vendors and buyers in Operation TorNado, which ran from May 2025 to October 2026. Investigators went after people who …
Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam …
How attackers turned a Teams meeting booking into a device code phishing trap
Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got a valid session token …
Suspected North Korean IT workers reached onboarding at companies with open data
Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding …
Your pinned MCP server may not be as pinned as you think
An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration …
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows computers. Each page showed …
Attackers breached 10 organizations with an open-source AI pentest framework
Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August and September 2026. …
Operation Endgame malware takedown turns up over 6 million stolen logins
Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered more than 6 million …
Stolen Claude API keys can turn Claude Code into a remote-controlled implant
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s …
Check your GitHub repos: A secret stealer hit tens of thousands of them
A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, …
GitHub Agentic Autofix and the question of who owns a bad AI patch
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes one flaw and …
Dagster: Open-source cloud-native data pipeline orchestrator
Dagster is an open source orchestrator for data pipelines. It decides what runs, in what order, and when. It also tracks how the tables, datasets, machine learning models, and …
Featured news
Resources
Don't miss
- Fake GTA 6 download goes after Steam logins and crypto wallet data
- Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
- How attackers turned a Teams meeting booking into a device code phishing trap
- Suspected North Korean IT workers reached onboarding at companies with open data
- Your pinned MCP server may not be as pinned as you think