The era of trusting users to spot fake login pages is over. A new generation of phishing kits, like Tycoon 2FA, has automated credential theft into a simple subscription service. These kits create flawless replicas of Microsoft or Google login portals. They operate as a "man-in-the-middle," seamlessly relaying one-time codes and session cookies in real time. Over 64,000 attacks have been...

An innovative open-source solution emerges for safeguarding code repositories from accidental exposure. This tool delves into directories, individual files, and git histories, meticulously searching for sensitive data. Its engine employs both pre-defined and customizable patterns to detect valid secrets with high accuracy. The risk is real: malicious actors routinely automate scans of public...

Android's security landscape is shifting for experienced users. A forthcoming feature, Advanced Flow, will enable safer installation of apps from sources outside official stores. This system, launching in August, directly addresses the high costs of mobile malware and fraud. Last year alone, such threats led to global losses nearing half a trillion dollars. The goal is to provide enhanced...

During Sony's E3 presentation, Jack Tretton, who leads Sony Computer Entertainment of America as its president and CEO, took a moment to express his regrets regarding the significant disruption to the PlayStation Network. His words of contrition were directed toward multiple groups: business partners outside Sony's direct operations, store vendors, and the gaming community at large who...

ConnectWise has issued an urgent security alert regarding a critical cryptographic flaw in its ScreenConnect remote access software that enables attackers to hijack sessions and escalate privileges. The vulnerability, designated CVE-2026-3564, impacts all ScreenConnect installations running versions prior to 26.1 and has been assigned a critical severity rating. ScreenConnect serves as a...

The FBI has issued a public warning highlighting a significant threat posed by Russian intelligence-linked actors targeting popular encrypted messaging services like Signal and WhatsApp. These malicious entities have launched widespread phishing campaigns that have already compromised thousands of user accounts globally. This alert marks the first official attribution directly connecting these...

The recent security incident involving the popular vulnerability scanner, Trivy, has revealed a sophisticated supply-chain attack orchestrated by the threat group known as teampcp. Malicious actors infiltrated the official Trivy release channels and GitHub Actions workflows to distribute credential-stealing malware. Trivy, widely used by developers and security professionals, is instrumental...