The Federal Police in Germany (BKA) has identified two Russian nationals as the leaders of GandCrab and REvil ransomware operations between 2019 and 2021.

According to BKA's disclosure, 31-year-old and 43-year-old acted as the heads of the two ransomware groups "from at least the beginning of 2019 until at least July 2021."

Shchukin hid behind the monikers UNKN/UNKNOWN for years, and speaking as a representative of the ransomware operation.

The German authorities say that Shchukin and Kravchuk participated in at least 130 extortion cases targeting companies in the country specifically.

Following these attacks, at least 25 victims paid Shchukin and his co-conspirators $2.2 million in ransom, while the total financial damage caused by them is estimated in excess of $40 million.

GandCrab , and its leader at the time decided to , after claiming to have earned $2 billion from ransom payments. The leader, however, cashed out with $150 million, which they claimed to have invested in legal businesses.

GandCrab leader announces retirement source: BleepingComputer

Soon after, a new operation called REvil emerged, following the affiliate model established by GandCrab through advertising and building partnerships with cybercriminals.

REvil, also known as Sodinokibi, was formed from previous GandCrab affiliates and operators who had already learned the successful tactics and started to apply them to their operations.

REvil later added public leak sites and to pressure victims. Notable victims include multiple , , and the that impacted around 1,500 downstream victims.

Following the massive Kaseya hack, REvil took a two-month break, during which and started to monitor operations.

Multiple were recorded at the time, and in mid-January 2022, Russia arrested more than a dozen REvil gang members, who were after time served on carding charges.

It is unclear if either Shchukin or Kravchuk joined other ransomware operations following REvil’s demise in 2021.

BKA believes that Shchukin and Kravchuk are now in Russia and asks the public to share any information that could lead to their whereabouts. Relevant entries were also created on the .

The police shared several images, including tattoo photos, to help track down the two threat actors and bring them to justice.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

By , Security Research Engineer at Picus Security.

It’s a story the security community knows well. You bring in a shiny new automated penetration testing tool, and the first "run" is a revelation. The dashboard lights up with critical findings, lateral movement paths you didn't know existed, and a "Gotcha!" moment involving a legacy service account.

The Red Team feels like they’ve found a force multiplier; the CISO feels like they’ve finally automated the "human element" of security.

But then, the honeymoon ends.

On average, by the fourth or fifth execution, the "new" findings dry up. The tool starts reporting the same stale issues, and the once-shiny dashboard becomes just another screen delivering noise. This isn't just a lull in activity; it's the Validation Gap – the widening distance between what organizations actually validate and what they report as validated.

If you’ve started to feel like your automated pentesting tool is overpromising and underdelivering, you’re experiencing a shift in the market. The industry is waking up to the fact that while automated pentesting is a powerful feature, it’s an increasingly dangerous strategy when used in isolation.

The POC Cliff: Where Discovery Goes to Die

This pattern of exciting first run with significantly diminishing returns by run four, isn’t anecdotal.

Security practitioners call it the Proof-of-Concept (PoC) Cliff: the steep drop in new findings volume once the tool has exhausted its fixed scope. It’s not a tuning problem.

By design, deliver their best results in the first run. Within a few cycles, exploitable paths within their scope are exhausted. But that doesn’t mean your environment is secure. It just means the tool has reached its limits, while deeper issues remain untested.

This is the structural ceiling of a tool operating against a deterministic surface. It’s an architectural limitation, not an operational one.

Automated pentesting chains its steps. Step B depends on Step A, and Step C depends on Step B. Once you patch the specific path the tool favors, it's blocked at Step A, and Steps B through Z never execute. The tool might be able to test 20 lateral movement techniques, but if it gets caught early in the chain, those techniques stay dark. You get the false sense of "mission accomplished" while the rest of your attack surface remains unprobed.

This is where draws a hard line.

BAS doesn't chain; it runs thousands of independent, atomic simulations. Each technique gets its own clean execution. A blocked exfiltration test over DNS doesn't prevent testing exfiltration over HTTPS next. A failed lateral movement technique doesn't stop the tool from testing 19 others.

One tests the path. The other tests the shield.

Automated pentesting maps attack paths. Picus validates the other five surfaces: detection rules, prevention controls, identity, cloud, and AI.

Findings from your existing tools get normalized into a single prioritized queue. No rip and replace. See it live.

Clearing the Air: BAS vs. Automated Pentesting

To better understand the “why” of the PoC Cliff, we need to address a growing point of confusion in the industry. While Breach and Attack Simulation (BAS) and automated penetration testing share the broad goal of validation, they use different methods to answer different questions.

Think of as a series of independent measurements. It continuously and safely emulates adversarial techniques, malware payloads, lateral movement, and exfiltration, to verify if your specific security controls (firewalls, WAF, EDR, SIEM) are actually doing their jobs.

Its primary mission is to test if your defenses are blocking or alerting on known threat behaviors. Each test stands alone as a check of your defensive strength.

, by contrast, is directional. It takes a more surgical, adversarial approach by chaining vulnerabilities and misconfigurations together the way a real attacker would. It excels at exposing complex attack paths, such as Kerberoasting in Active Directory or escalating privileges to reach a Domain Admin account.

Though both are often thought of as “validation methods,” the two are fundamentally different in mission and outcomes. One tells you how strong your individual defenses are; the other tells you how far an attacker can travel in spite of them.

The "Simplicity" Trap: Why Pentesting Isn't BAS

Recently, some vendors have proposed the idea that automated pentesting can, and should, replace BAS. On paper, it sounds great.

In reality, this isn't an upgrade; it’s a coverage regression disguised as a simplification.

As we’ve just seen, automated pentesting and answer fundamentally different questions. To secure a modern enterprise, you need the answers to both:

- BAS asks: "Are my firewalls, EDRs, WAFs, and SIEMs actually doing their jobs across the entire MITRE ATT&CK framework?" It focuses on the effectiveness of your defensive controls.

- Automated Pentesting asks: "Can an attacker get from Point A to Point B using known exploits?" It focuses on the success of specific attack paths.

Figure 1. Example Attack Chain Scenario: What Automated Pentesting & BAS Validates

If you swap for automated pentesting, you stop validating your prevention and detection stack.

You might know that an attacker can’t reach your database via one specific exploit, but you have zero visibility into whether your EDR would even blink if they tried a different, non-exploitative technique.

The Six Blind Spots of the Modern Attack Surface

While marketing materials promise "comprehensive" coverage, the reality is that automated pentesting typically only scratches the surface of infrastructure and application paths.

Figure 2. Six Layers of an Organization’s Attack Surface

As shown above, two surfaces get no coverage from automated pentesting. Four get partial coverage at best. Not a single surface is fully covered. That's 0 for 6 completely validated. This creates a massive validation gap where today’s breaches are actually happening:

1. $1

   2. $1

   3. $1

   4. $1

   5. $1

   6. $1

The Intelligence Layer: Exposure Validation & Prioritization

This cross-cutting layer unifies these silos. Matching theoretical CVEs against live security control performance strips out noise, turning the 60%+ of findings falsely classified as high or critical down to the ~10% that are genuinely exploitable, reducing false urgency by over 80%, to produce one defensible, prioritized action list.

The Three Questions You Need to Ask

Understanding this gap is one thing; fixing it requires holding your validation vendors to a higher standard. To cut through the marketing hype and find out what a tool actually delivers, everything distills down to three fundamental diagnostic questions.

Bring them with you to every vendor meeting, every renewal conversation, and every budget review. They work because they are structural, not subjective. Any tool that answers all three with specificity and evidence deserves serious evaluation; any tool that cannot has just shown you where your gap is.

1. $1

   2. $1

   3. $1

The difference between "we chose not to validate this surface" and "we didn't realize it wasn't being validated" is the difference between risk management and exposure.

The Bottom Line

Your attack surface doesn't care which vendor's logo is on the tool.

It only cares whether it has been tested. If your current automated pentesting deployment is leaving critical surfaces in the dark, it's time to remap your strategy.

Our latest practitioner’s guide, provides the complete diagnostic framework you’ll need to audit your own coverage, diagnose where your coverage plateaus, and build a unified validation architecture.

Start with the six surfaces. Score your own coverage. Knowing where your tools stop is how you decide where to go next.

Sponsored and written by .*

Fortinet has released an emergency weekend security update for a new critical FortiClient Enterprise Management Server (EMS) vulnerability that is actively exploited in attacks.

Tracked as CVE-2026-35616, the flaw is an improper access control vulnerability that allows unauthenticated attackers to execute code or commands via specially crafted requests.

The issue was patched Saturday, with Fortinet confirming it has been exploited in the wild.

"Fortinet has observed this to be exploited in the wild and urges vulnerable customers to install the hotfix for FortiClient EMS 7.4.5 and 7.4.6," .

Fortinet says the vulnerability impacts FortiClient EMS versions 7.4.5 and 7.4.6 and can be mitigated by installing one of the following hotfixes:

The vulnerability will also be fixed in the upcoming FortiClientEMS 7.4.7. FortiClient EMS 7.2 is not affected.

The flaw was discovered by cybersecurity firm Defused, which described it as a pre-authentication API access bypass that allows attackers to bypass authentication and authorization controls entirely.

Defused that they observed the flaw being exploited as a zero-day earlier this week before reporting it to Fortinet under responsible disclosure.

Internet security watchdog has found over 2,000 exposed FortiClient EMS instances online, with the majority located in the USA and Germany.

The vulnerability follows a separate critical FortiClient EMS flaw, , reported last week and also actively exploited in attacks.

Both vulnerabilities were discovered by Defused, with Fortinet also crediting Nguyen Duc Anh for the latest flaw.

Fortinet is urging customers to apply the hotfixes immediately or upgrade to version 7.4.7 when it becomes available to mitigate the risk of compromise.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Scammers are sending fake "Notice of Default" traffic violation text messages impersonating state courts across the U.S., pressuring recipients to scan a QR code that leads to a phishing site demanding a $6.99 payment while stealing personal and financial information.

This is a new variation of the widely sent that users received in 2025, which claimed to be from state toll agencies.

This new campaign started a few weeks ago, with someone sharing a text targeting New York residents with BleepingComputer, and many other people reporting similar texts online for other states, including California, North Carolina, Illinois, Virginia, Texas, Connecticut, and New Jersey.

Unlike the previous campaign, which included a text message and links to phishing sites, this new variation instead includes an image of an alleged court notice with an embedded QR code.

"This notice constitutes a final and urgent warning regarding an outstanding traffic violation involving your registered vehicle within the State of New York," reads the fake court notice.

"This matter has now entered the formal enforcement stage."

Fake court notice about traffic violations Source: BleepingComputer

The text message shared with BleepingComputer claims to be from the "Criminal Court of the City of New York", stating that there is an unpaid parking or toll violation that must be paid immediately or the person must appear in court. Included are instructions to scan a QR code to settle the unpaid balances.

Scanning the QR code brings the targeted person to an intermediary site that first prompts you to solve a captcha to prove you are human. The QR codes and CAPTCHA are used to make it harder for automated security software and researchers to analyze the phishing campaign.

Solving the CAPTCHA redirects you to another phishing site that impersonates the state's DMV or another agency, claiming there is an unpaid toll or parking ticket. In all examples seen by BleepingComputer, this outstanding balance is $6.99.

For example, phishing sites that impersonate the New York DMV use the hostname "ny.gov-skd[.]org" or "ny.ofkhv[.]life".

Fake NY Department of Motor Vehicles phishing site Source: BleepingComputer

Clicking continue will take you to a page where you can enter your personal and credit card information to pay the alleged charge.

This form is used to steal your data, including your name, address, phone number, email address, and, eventually, your credit card information.

This information can then be used for a wide variety of malicious activities, including follow-on phishing attacks, financial fraud, identity theft, and the sale of your data to other threat actors.

As a general rule, if you receive a text from an unknown phone number or email address requesting payment of a bill, ignore it.

State agencies have in response to these scams that they do not use text messages requesting personal information or payment information.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year.

In this type of attack, the threat actor sends a device authorization request to a service provider and receives a code, which is sent to the victim under various pretexts.

Next, the victim is tricked into entering the code on the legitimate login page, thus authorizing the attacker's device to access the account through valid access and refresh tokens.

This flow was designed to simplify connecting devices that do not have accessible input options (e.g., IoT devices, printers, streaming devices, and smart TVs).

Device code phishing flow Source: Push Security

The device code phishing technique was first documented in 2020, but malicious exploitation was recorded a few years later, and has been used by both state-hackers and financially-motivated ones [, , , ].

Researchers at observed a massive increase in the use of these attacks, warning that they have been widely adopted by cybercriminals.

“At the start of March (2026), we’d observed a 15x increase in device code phishing pages detected by our research team this year, with multiple kits and campaigns being tracked — with the kit now identified as EvilTokens the most prominent. That figure has now risen to 37.5x.” - Push Security

Earlier this week, threat detection and response company Sekoia published research on the phishing-as-a-service (PhaaS) operation. The researchers underline that it is a prominent example of a phishing kit that “democratizes” device code phishing, making it available to low-skilled cybercriminals.

Push agrees that EvilTokens has been a major driver of the technique's mainstream adoption, but notes that there are several other platforms competing on the same market, which could become more prominent in the event of law enforcement disrupting EvilTokens:

1. $1

   2. $1

   3. $1

   4. $1

   5. $1

   6. $1

   7. $1

   8. $1

   9. $1

   10. $1

It should be noted that other than Venom and EvilTokens, the names of the other phishing kits were given by Push researchers to track the malicious activity.

Push Security also published a video showing how the DOCUPOLL kit works. The threat actor uses DocuSign branding and a lure for an alleged contract, asking the victim to sign into the Microsoft Office application.

[embedded content]

In total, there are at least 11 phishing kits offering cybercriminals this type of attack, all using realistic SaaS-themed lures, anti-bot protections, and abusing cloud platforms for hosting.

To block device-code phishing attacks, Push Security suggests that users disable the flow when not needed by setting conditional access policies on their accounts.

It is also recommended to monitor logs for unexpected device code authentication events, unusual IP addresses, and sessions.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign linked to North Korean hackers.

This follows the threat actors compromising a maintainer account to (1.14.1 and 0.30.4) to the npm package registry, triggering a supply chain attack.

These releases injected a dependency named plain-crypto-js that installed a remote access trojan (RAT) on macOS, Windows, and Linux systems.

The malicious versions were available for roughly three hours before being removed, but systems that installed them during that period should be considered compromised, and all credentials and authentication keys should be rotated.

The Axios maintainers said they have wiped affected systems, reset all credentials, and are implementing changes to prevent similar incidents.

The Google Threat Intelligence Group has since linked this attack to North Korean threat actors tracked as UNC1069.

"GTIG attributes this activity to UNC1069, a financially motivated North Korea-nexus threat actor active since at least 2018, based on the use of WAVESHAPER.V2, an updated version of WAVESHAPER previously used by this threat actor," .

"Further, analysis of infrastructure artifacts used in this attack shows overlaps with infrastructure used by UNC1069 in past activities."

Targeted in a social engineering attack

According to a , the compromise began weeks earlier through a targeted social engineering attack on the project's lead maintainer, Jason Saayman.

The attackers impersonated a legitimate company, cloned its branding and founders' likenesses, and invited the maintainer into a Slack workspace designed to impersonate the company. Saayman says the Slack server contained realistic channels, with staged activity and fake profiles that posed as employees and other open-source maintainers.

"They then invited me to a real slack workspace. this workspace was branded to the companies ci and named in a plausible manner," explained Saayman in to the post-mortem.

"The slack was thought out very well, they had channels where they were sharing linked-in posts, the linked in posts i presume just went to the real companys account but it was super convincing etc. they even had what i presume were fake profiles of the team of the company but also number of other oss maintainers."

The attackers then scheduled a meeting on Microsoft Teams that appeared to include numerous people.

During the call, a technical error was displayed, claiming that something on the system was out of date, prompting the maintainer to install a Teams update to fix the error. However, this fake update was actually RAT malware that gave threat actors remote access to the maintainer's device, allowing them to obtain the npm credentials for the Axios project.

Other maintainers reported similar social engineering attacks, where the threat actors tried to get them to install a fake Microsoft Teams SDK update.

This attack is similar to a ClickFix attack, in which victims are shown a fake error message and then prompted to follow troubleshooting steps that deploy malware.

This attack also mirrors previous campaigns reported by , in which North Korean threat actors tracked UNC1069 used the same tactics to target cryptocurrency firms.

In previous campaigns attributed to the UNC1069 threat actor, the threat actors would deploy additional payloads on devices, such as backdoors, downloaders, and infostealers designed to steal credentials, browser data, session tokens, and other sensitive information.

Since the attackers gained access to authenticated sessions, MFA protections were effectively bypassed, allowing access to accounts without having to re-authenticate.

The Axios maintainers confirmed that the attack did not involve modifying the project's source code, but instead relied on injecting a malicious dependency into otherwise legitimate releases.

Pelle Wessman, a maintainer of numerous open-source projects, including the popular Mocha framework, that he was targeted in the same campaign and shared a screenshot of a fake RTC connection error message used to trick targets into installing malware.

Fake RTC Connection error message used in another attack Source: Pelle Wessman

When Wessman refused to install the app, the threat actors tried to convince him to run a Curl command.

"When it became clear that I wouldn’t run the app and we had chatted back and forth on website and chat app they made one final desperate attempt and tried to get me to run a curl command that would download and run something, then when I refused they went dark and deleted all conversations," .

Cybersecurity firm Socket also reported that this was a coordinated campaign that has begun targeting maintainers of popular Node.js projects.

Multiple developers, including maintainers of widely used packages and Node.js core contributors, reported receiving similar outreach messages and invitations to Slack workspaces operated by the attackers.

Socket noted that these maintainers are responsible for packages with billions of weekly downloads, demonstrating that the threat actors focused on high-impact projects.

"Since we published our initial analysis of the axios compromise, a deep dive into its hidden blast radius, and a report on the maintainer confirming it was social engineering, maintainers across the Node.js ecosystem have come out of the woodwork to report that they were targeted by the same social engineering campaign," .

"The accounts now span some of the most widely depended-upon packages in the npm registry and Node.js core itself, and together they confirm that axios was not a one-off target. It was part of a coordinated, scalable attack pattern aimed at high-trust, high-impact open source maintainers."

Socket said the campaign followed a consistent pattern, with the threat actors first making contact through platforms like LinkedIn or Slack and then inviting recipients into private or semi-private workspaces.

After building rapport with the target, the threat actors scheduled video calls, which in some cases were conducted through sites impersonating Microsoft Teams and other platforms.

During these calls, an error message would be displayed to the targets, which prompted them to install "native" desktop software that works better or run commands to fix the technical issues.

The same playbook used against all these targets during the same time period indicates this was a coordinated campaign rather than a series of one-off attacks.

The Socket researchers say that these types of supply chain attacks are becoming more common, with attackers now focusing on widely used packages to cause widespread impact.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Telehealth giant Hims & Hers Health is warning that it suffered a data breach after support tickets were stolen from a third-party customer service platform.

Hims & Hers is an American telehealth company specializing in the direct-to-consumer healthcare space, providing subscription-based treatments for hair loss, ED, mental health, skincare, weight loss, and other conditions or needs.

It is one of the most successful U.S. brands in the online pharmacy and telehealth space, with strong marketing presence, and annual revenues close to $1 billion.

According to a sample of the notification shared with the , the data breach occurred in early February 2026.

"On February 5, 2026, Hims & Hers, Inc. became aware of suspicious activity affecting our third-party customer service platform," reads the letter sent to impacted individuals.

"We promptly took steps to secure our customer service platform and initiated an investigation into the nature and scope of the potential security incident."

"The investigation determined that from February 4, 2026, to February 7, 2026, certain tickets sent to our customer service team were accessed or acquired without authorization."

Following an internal investigation, the company determined, on March 3, that hackers had accessed support tickets that, in some cases, contained personal information.

The exposed information may include names, contact information, and other unspecified data, likely related to the support request submitted in each case.

The company underlined that no medical records or doctor communications were compromised in this incident.

While the company did not share further details, BleepingComputer learned last month that the ShinyHunters extortion gang conducted the breach.

The data was stolen as part of a widespread campaign in which threat actors to gain access to third-party cloud storage services and SaaS platforms to steal data.

In this particular attack, BleepingComputer was told that the threat actors used the Okta SSO account to access the His and Hers Zendesk instance, where they stole millions of support tickets.

The company is now offering 12 months of free credit monitoring services to all impacted individuals.

Customers are also encouraged to maintain heightened vigilance against unsolicited communications that may contain phishing or social-engineering lures. Also, they are advised to review account statements and monitor credit reports for suspicious activity.

BleepingComputer has reached out to the firm to request more information about the incident and how many customers have been impacted, but we have not heard back by publication time.

Two recent high-profile customer support security breaches that led to client data breaches are those of DIY store chain in February and in March. In both these cases, the compromised platform was Zendesk.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

A new report dubbed "BrowserGate" warns that Microsoft's LinkedIn is using hidden JavaScript scripts on its website to scan visitors' browsers for installed extensions and collect device data.

According to a report by Fairlinked e.V., which claims to be an association of commercial LinkedIn users, Microsoft's platform injects JavaScript into user sessions that checks for thousands of browser extensions and links the results to identifiable user profiles.

The author claims that this behavior is used to collect sensitive personal and corporate information, as LinkedIn accounts are tied to real identities, employers, and job roles.

"LinkedIn scans for over 200 products that directly compete with its own sales tools, including Apollo, Lusha, and ZoomInfo. Because LinkedIn knows each user's employer, it can map which companies use which competitor products. It is extracting the customer lists of thousands of software companies from their users' browsers without anyone's knowledge,' the .

"Then it uses what it finds. LinkedIn has already sent enforcement threats to users of third-party tools, using data obtained through this covert scanning to identify its targets."

BleepingComputer has independently confirmed part of these claims through our own testing, during which we observed a JavaScript file with a randomized filename being loaded by LinkedIn's website.

This script checked for 6,236 browser extensions by attempting to access file resources associated with a specific extension ID, a for detecting whether extensions are installed.

This fingerprinting script was in 2025, but it was only detecting approximately 2,000 extensions at that time. A from two months ago shows 3,000 extensions being detected, demonstrating that the number of detected extensions continues to grow.

Snippet of the list of extensions scanned for by LinkedIn's script Source: BleepingComputer

While many of the extensions that are scanned for are related to LinkedIn, the script also strangely detected language and grammar extensions, tools for tax professionals, and other seemingly unrelated features.

The script also collects a wide range of browser and device data, including CPU core count, available memory, screen resolution, timezone, language settings, battery status, audio information, and storage features.

Gathering information about visitors' devices Source: BleepingComputer

BleepingComputer could not verify the claims in the BrowserGate report about the use of the data or whether it is shared with third-party companies.

However, similar fingerprinting techniques have been used in the past to build unique browser profiles, which can enable tracking users across websites.

LinkedIn denies data use allegations

LinkedIn does not dispute that it detects specific browser extensions, telling BleepingComputer that the info is used to protect the platform and its users.

However, the company claims the report is from someone whose account was banned for scraping LinkedIn content and violating the site's terms of use.

"The claims made on the website linked here are plain wrong. The person behind them is subject to an account restriction for scraping and other violations of LinkedIn's Terms of Service.

To protect the privacy of our members, their data, and to ensure site stability, we do look for extensions that scrape data without members' consent or otherwise violate LinkedIn's Terms of Service.

Here’s why: some extensions have static resources (images, javascript) available to inject into our webpages. We can detect the presence of these extensions by checking if that static resource URL exists. This detection is visible inside the Chrome developer console. We use this data to determine which extensions violate our terms, to inform and improve our technical defenses, and to understand why a member account might be fetching an inordinate amount of other members' data, which at scale, impacts site stability. We do not use this data to infer sensitive information about members.

For additional context, in retaliation for this website owner's account restriction, they attempted to obtain an injunction in Germany, alleging LinkedIn had violated various laws. The court ruled against them and found their claims against LinkedIn had no merit, and in fact, this individual's own data practices ran afoul of the law.

Unfortunately, this is a case of an individual who lost in the court of law, but is seeking to re-litigate in the court of public opinion without regard for accuracy."

❖ LinkedIn

LinkedIn claims the BrowserGate report stems from a dispute involving the developer of a LinkedIn-related browser extension called "Teamfluence," which LinkedIn says it restricted for violating the platform's terms.

In documents shared with BleepingComputer, a German court denied the developer's request for a preliminary injunction, finding that LinkedIn's actions did not constitute unlawful obstruction or discrimination.

The court also found that automated data collection alone could infringe upon LinkedIn's terms of use and that it was entitled to block the accounts to protect its platform.

LinkedIn argues the BrowserGate report is an attempt to re-litigate that dispute publicly.

Regardless of the reasons for the report, one point is undisputed.

LinkedIn's site uses a fingerprinting script that detects over 6,000 extensions running in a Chromium browser, along with other data about a visitor's system.

This is not the first time that companies have used aggressive fingerprinting scripts to detect programs running on a visitor's device.

In 2021, eBay was found to use JavaScript to to determine whether they were running various remote support software.

While eBay never confirmed why they were using these scripts, it was widely believed that they were used to block fraud on compromised devices.

It was later discovered that were using the same fingerprinting script, including Citibank, TD Bank, Ameriprise, Chick-fil-A, Lendup, BeachBody, Equifax IQ connect, TIAA-CREF, Sky, GumTree, and WePay.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

A former core infrastructure engineer has pleaded guilty to locking Windows admins out of 254 servers as part of a failed extortion plot targeting his employer, an industrial company headquartered in Somerset County, New Jersey.

According to , 57-year-old Daniel Rhyne from Kansas City, Missouri, remotely accessed the company's network without authorization using an administrator account between November 9 and November 25.

Throughout this time, he allegedly scheduled tasks on the company's Windows domain controller to delete network admin accounts and to change the passwords for 13 domain admin accounts and 301 domain user accounts to "TheFr0zenCrew!".

The prosecutors also accused Rhyne of scheduling tasks to change the passwords for two local admin accounts, which would affect 3,284 workstations, and for two more local admin accounts, which would impact 254 servers on his employer's network. He also scheduled some tasks to shut down random servers and workstations on the network over multiple days in December 2023.

Subsequently, on November 25, Rhyne emailed a number of his coworkers a ransom email titled "Your Network Has Been Penetrated," saying that all IT administrators had been locked out of their accounts and that server backups had been deleted to make data recovery impossible.

Additionally, the emails threatened to shut down 40 random servers daily over the next ten days unless the company paid a ransom of 20 bitcoin (worth roughly $750,000 at the time).

"On or about November 25, 2023, at approximately 4:00 p.m. EST, network administrators employed at Victim-1 began receiving password reset notifications for a Victim-1 domain administrator account, as well as hundreds of Victim-1 user accounts," the criminal complaint reads.

"Shortly thereafter, the Victim-1 network administrators discovered that all other Victim-1 domain administrator accounts were deleted, thereby denying domain administrator access to Victim-1's computer networks."

Forensic investigators found that on November 22, Rhyne used a hidden virtual machine and his account to search the web for information on clearing Windows logs, changing domain user passwords, and deleting domain accounts as he planned his extortion plot.

One week earlier, Rhyne made similar web searches on his laptop, including "command line to remotely change local administrator password" and "command line to change local administrator password."

Rhyne on Tuesday, August 27, and released after his initial appearance in federal court. The hacking and extortion charges to which carry a maximum penalty of 15 years in prison.

Earlier this month, a North Carolina data analyst contractor was , Brightly Software (a Software-as-a-Service company previously known as SchoolDude), for $2.5 million.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Microsoft is investigating and working to resolve Exchange Online mailbox access issues that have intermittently affected Outlook mobile and macOS users for weeks.

When it this service issue (tracked under ) last week, Microsoft said it started on March 11 and that the root cause was a newly introduced virtual account. While the company flagged it as resolved on April 1, the incident has been re-added to the admin message center under a different tag ().

"We've received reports from affected tenants that the impact scenario originally communicated through SHD EX1256020 is still ongoing. We're working to restart the Notification Broker service on affected portions of Exchange Online service infrastructure to remediate impact while we continue our analysis into the underlying root cause," Microsoft says.

"Impact may occur intermittently for some users accessing their Exchange Online mailboxes in the Outlook mobile apps or the new Outlook for Mac desktop client. This section may be updated as our investigation progresses."

In the latest update issued on Thursday evening, the Exchange Online team said it's still investigating the root cause and working on additional measures to prevent this issue from recurring.

While Microsoft has yet to share which regions or how many users have been affected by this issue over the last three weeks, it flagged this as an incident, which typically applies to critical service issues with noticeable user impact.

Earlier this month, Microsoft that prevented users from accessing mailboxes and calendars via Outlook on the web, Outlook desktop, Exchange ActiveSync, and other Exchange Online connection protocols.

The same day, it that caused Office.com or Microsoft 365 Copilot web sign‑in problems affecting the Microsoft Copilot desktop app, Copilot in Microsoft Teams, and Copilot in Office apps.

that intermittently blocked email via the Internet Mailbox Access Protocol 4 (IMAP4) was addressed in January, while a blocked Exchange Online access via the classic Outlook desktop client in November.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Two vulnerabilities in Progress ShareFile, an enterprise-grade secure file transfer solution, can be chained to enable unauthenticated file exfiltration from affected environments.

Progress ShareFile is a document sharing and collaboration product typically used by large and mid-sized companies.

Such solutions are an attractive target for ransomware actors, as previously seen in Clop data-theft attacks exploiting bugs in , , , , , and .

Researchers at offensive security company watchTowr discovered an authentication bypass (CVE-2026-2699) and a remote code execution (CVE-2026-2701) in the Storage Zones Controller (SZC) component present in branch 5.x of Progress ShareFile.

SZC gives customers more control over their data by allowing them to store it on their infrastructure (either on-prem or in a third-party cloud provider) or on the Progress systems.

Following watchTowr's responsible disclosure, the problems have been addressed in Progress ShareFile 5.12.4, released on March 10.

How the attack works

In a report today, that the attack begins by exploiting the authentication bypass issue, CVE-2026-2699, which gives access to the ShareFile admin interface due to improper handling of HTTP redirects.

Once inside, an attacker can modify Storage Zone configuration settings, including file storage paths and security-sensitive parameters such as the zone passphrase and related secrets.

By exploiting the second flaw, CVE-2026-2701, attackers can obtain remote code execution on the server by abusing file upload and extraction functionality to place malicious ASPX webshells in the application’s webroot.

The researchers note that, for the exploit to work, attackers must generate valid HMAC signatures and extract and decrypt internal secrets. However, these are achievable after exploiting CVE-2026-2699 due to the ability to set or control passphrase-related values.

Overview of the exploit chain Source: WatchTowr

Impact and exposure

By watchTowr's scans, there are about 30,000 Storage Zone Controller instances exposed on the public internet.

The ShadowServer Foundation currently observes of Progress ShareFile, most of which are located in the United States and Europe.

watchTowr discovered the two flaws and reported them to Progress between February 6 and 13, and the full exploit chain was confirmed on February 18 for Progress ShareFile 5.12.4. The vendor released security updates in version 5.12.4, released on March 10.

Although no active exploitation in the wild has been observed as of writing, systems running vulnerable versions of ShareFile Storage Zone Controller should be patched immediately, as the public disclosure of the chain is likely to entice threat actors.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Fraud operations have expanded beyond traditional hacking techniques to include methods that exploit legitimate services and real-world infrastructure. By combining publicly available data, weak identity verification processes, and operational gaps, threat actors are building scalable fraud workflows that are both low-cost and difficult to detect.

A tutorial shared in a fraud-focused chat group and analyzed by analysts provides step-by-step guidance on how to identify and exploit vacant residential properties to intercept sensitive mail, revealing a low-tech but highly effective method for enabling identity theft and financial fraud.

Unlike traditional cybercrime techniques that rely on malware, , or network intrusions, the method outlined in this article focuses almost entirely on abusing legitimate services and physical-world logistics.

The approach blends open-source intelligence, postal service features, and fake identity fraud into a coordinated workflow designed to gain persistent access to victims’ mail.

A “drop address” tutorial circulated on Telegram

Turning vacant properties into fraud infrastructure

The tutorial begins with identifying so-called “drop addresses”, real residential properties that are temporarily unoccupied and can be used to receive mail without immediately alerting the rightful occupants.

Threat actors are instructed to search real estate platforms such as Zillow, Rightmove, or Zoopla, filtering for recently listed rental properties. By focusing on newly available listings, attackers increase the likelihood that the property is vacant or between tenants.

The guidance further suggests reviewing older listings to identify homes that have remained unoccupied for extended periods, increasing their reliability as drop locations.

In some cases, threat actors even recommend physically maintaining abandoned properties to make them appear occupied, reducing the risk of drawing attention while using the address for fraudulent purposes.

Threat actors share fraud playbooks, stolen credentials, and fake document services across dark web forums and Telegram channels.

Flare monitors these sources continuously, so you can detect exposure before it enables account takeovers, mail fraud, or identity theft.

Monitoring incoming mail to identify valuable targets

Once a suitable address is identified, the next phase involves utilizing legitimate digitalized postal services for discovery and monitoring of incoming mail.

Informed Delivery, for instance, is a free service that provides residential consumers with digital previews of their incoming letter-sized mail and tracks package deliveries.

By registering these services for the selected address, attackers can monitor incoming correspondence remotely, allowing them to identify valuable items such as financial documents, credit cards, or verification letters before physically accessing the mailbox.

This transforms mail delivery into a form of intelligence gathering, enabling more targeted and efficient fraud.

If the address is already registered, the tutorial references change-of-address requests as a way to regain control over mail delivery. These services are designed for legitimate users relocating their residence and are widely available through postal systems such as USPS.

For example, users can submit a permanent or a temporary Change of Address (COA) request online or in person, enabling mail to be forwarded to a new location for periods ranging from several weeks up to 12 months.

Additional services, such as Premium Forwarding, can consolidate and redirect all incoming mail on a recurring basis.

While these mechanisms include identity verification safeguards such as requiring a small online payment tied to a billing address or presenting a valid photo ID in person, the tutorial suggests that actors perceive these controls as potentially insufficient or inconsistently enforced.

In particular, the ability to submit forwarding requests remotely, combined with the reliance on address-linked verification rather than strong identity binding, may create opportunities for abuse if supporting identity information is compromised or fabricated.

As a result, control over mail delivery may, in some cases, be reassigned without direct interaction with the legitimate resident, turning a service intended for convenience into a potential vector for unauthorized redirection.

At this stage, the operation moves beyond passive targeting and into active monitoring, providing attackers with visibility that significantly increases the success rate of downstream fraud.

Establishing persistence through mail forwarding

After confirming that valuable mail is being delivered, the workflow shifts toward establishing long-term access through mail forwarding services.

Actors are instructed to create personal mailbox accounts that allow them to redirect all incoming mail from the drop address to a separate location under their control.

Because these services typically require identity verification, attackers rely on fake identities, forged documents, or purchased personal data to complete the process.

This marks a critical transition from opportunistic interception to persistent access. Once mail forwarding is in place, attackers no longer need to revisit the physical location, reducing exposure while maintaining continuous access to sensitive information.

The use of fake identities, often involving fabricated personal details or Credit Privacy Numbers (CPNs), demonstrates how this technique integrates with broader fraud ecosystems.

Rather than operating in isolation, drop address abuse becomes one component in a larger pipeline that can support , credit fraud, and .

In practice, these fake identities can be used to register mailbox services, submit forwarding requests, or receive sensitive financial correspondence tied to victim accounts.

This allows actors to bridge the gap between digital compromise and real-world access, enabling them to complete verification steps, intercept authentication materials, or establish new accounts under assumed identities.

As a result, control over a physical address can become an important step in fraud operations that depend on both identity credibility and access to legitimate communication channels.

A hybrid fraud model blending digital and physical layers

The method outlined in the tutorial reflects a broader evolution in fraud operations, where digital intelligence gathering is combined with physical-world manipulation.

In addition to leveraging online platforms and postal services, actors also describe using individuals (sometimes recruited from vulnerable populations) to physically access mailboxes or collect delivered items.

This introduces a human layer into the operation, allowing attackers to outsource risk and further distance themselves from direct involvement.

The activity described in the tutorial reflects a broader rise in mail-enabled fraud documented in recent reporting. According to Inspection Service–related data, reports of mail theft have increased significantly in recent years, with theft from mail receptacles rising by 139% between 2019 and 2023.

Financially, the impact is substantial, with mail theft schemes linked to hundreds of millions of dollars in suspicious activity tied to check fraud.

At the same time, abuse of postal redirection services, similar to the technique referenced in the tutorial, has also grown, with change-of-address fraud increasing sharply year-over-year. Together, these trends highlight how control over physical mail has become valuable.

At the same time, the tutorial acknowledges operational challenges. Virtual addresses and commonly reused locations are increasingly flagged by financial institutions, suggesting that defenders are beginning to incorporate address-based risk signals into their detection models.

As a result, actors emphasize the importance of finding “clean” residential addresses that have not yet been associated with fraudulent activity.

Together, these elements illustrate a fraud model that is not driven by technical sophistication, but by coordination, adaptability, and the strategic use of legitimate systems.

Not an Isolated Tutorial / Fraud

While this may look like an isolated tutorial, this is part of a broader phenomenon or tutorials on how to find physical drop address, some are for free and others are paid for.

Expanding attack surface beyond traditional cybersecurity controls

The emergence of these techniques underscores a growing challenge for organizations: many of the systems being abused: real estate platforms, postal services, and identity verification processes, exist outside the scope of traditional cybersecurity defenses.

As fraud operations continue to evolve, detection increasingly depends on correlating signals across domains, including address usage patterns, mail forwarding activity, and identity inconsistencies. Without this broader visibility, attacks that rely on legitimate services rather than technical exploits may continue to evade conventional security controls.

.

Sponsored and written by .*

Google released emergency updates to fix another Chrome zero-day vulnerability exploited in attacks, marking the fourth such security flaw patched since the start of the year.

"Google is aware that an exploit for CVE-2026-5281 exists in the wild," Google said in a issued on Tuesday.

As detailed in the Chromium commit history, this vulnerability stems from a use-after-free weakness in , the underlying cross-platform implementation of the WebGPU standard used by the Chromium project.

Attackers can exploit this Dawn security flaw to trigger web browser crashes, data corruption, rendering issues, or other abnormal behavior.

While Google has found evidence that threat actors were exploiting this zero-day flaw in the wild, it did not share details about these incidents.

"Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed," the company noted.

​Google has now fixed the zero-day for users in the Stable Desktop channel, with new versions rolling out to Windows, macOS (146.0.7680.177/178), and Linux users (146.0.7680.177). While Google says that this out-of-band update could take days or weeks to reach all users, it was immediately available when BleepingComputer checked for updates today.

If you don't want to update the browser manually, you can also have it check for updates at the next launch and install them automatically.

This is the fourth actively exploited Chrome zero-day patched since the start of the year. The first (CVE-2026-2441) was an iterator invalidation bug in CSSFontFeatureValuesMap (Chrome's implementation of CSS font feature values), which Google .

Google patched bugs exploited in attacks earlier this month: the first is an weakness in the Skia 2D graphics library (CVE-2026-3909), and the second is an inappropriate implementation vulnerability in the V8 JavaScript and WebAssembly engine (CVE-2026-3910).

In 2025, Google fixed a total of , many of which were discovered and reported by Google's Threat Analysis Group (TAG), which is known for tracking and identifying zero-day exploits used in spyware attacks.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

The U.S. Federal Bureau of Investigation (FBI) warned Americans against using foreign-developed mobile applications, particularly those created by Chinese developers.

In a public service announcement (PSA) issued via its Internet Crime Complaint Center (IC3) platform this Tuesday, the FBI warned of privacy and data security risks associated with these apps.

"As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China," .

"The apps that maintain digital infrastructure in China are subject to China's extensive national security laws, enabling the Chinese government to potentially access mobile app users' data."

Among the risks highlighted in the advisory, the FBI said that some of these mobile apps may continuously collect data and users' private information, even when users grant permission only while the app is active.

The apps may also collect extensive information with default permissions, including address book data such as contacts' names, phone numbers, e-mail addresses, user IDs, and physical addresses.

"The apps' privacy policies list where the collected data, including personal information and system prompts, is stored. Some of the apps state that the collected data is stored on servers located in China for as long as the developers deem necessary," it added. "Some apps do not allow the users to operate the platform unless users consent to data sharing."

To protect their data and privacy, the FBI recommends turning off unnecessary data sharing, regularly updating device software, and downloading verified apps only from official app stores.

While the bureau also advised changing passwords regularly, using a password manager app like Bitwarden or 1Password to generate strong passwords for all accounts is a more secure approach, since frequently updating them may lead to choosing easier-to-remember ones that are quicker to guess in brute-force attacks.

The FBI has asked Americans whose data has been compromised or who have noticed suspicious activity after installing a foreign-developed mobile app to report the incidents through its IC3 platform.

The bureau's PSA comes after China of TikTok's U.S. business in early 2026 to a majority American-owned joint venture led by Oracle, U.S. tech investment firm Silver Lake, and Emirati investor MGX, to avoid being banned in the country following a 2024 U.S. law requiring parent company ByteDance to divest the platform over national security concerns.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

​Microsoft has resolved a known issue that rendered the classic Outlook email client unusable for users who enabled the Microsoft Teams Meeting Add-in.

The bug was first reported on March 12, when affected Microsoft 365 customers began experiencing Outlook crashes and prompts to start it in safe mode.

Microsoft nearly a week later in a Microsoft 365 incident report (), blaming a previous Outlook build for the crashes.

"Starting around March 12, 2026, classic Outlook might crash and then prompt to start in Safe Mode," it in a recently updated support document.

"This issue is happening when older builds of classic Outlook are using the newest version of the Teams Meeting Add-In build 1.26.02603. For example, this issue happens on Current Channel if the classic Outlook build is equal or lower than Version 2402 (Build 17328.20142)."

Outlook safe mode prompt (Microsoft)

​On Monday, Microsoft and that a fix is rolling out with Microsoft Teams version 26058.712.4527.9297.

Microsoft advised affected users to update their classic Outlook client to the latest build, which addresses the issue. Those who can't immediately upgrade are advised to perform an for click-to-run installs (which reinstalls all Office applications).

Users who need to stay on the older build of Office they're currently using can also disable the buggy Teams Meeting Add-in as a temporary workaround by going through the following procedure:

1. $1

   2. $1

   3. $1

   4. $1

Last week, Microsoft also fixed a classic Outlook bug that when synchronizing Gmail and Yahoo accounts since February 26.

Earlier this year, it addressed another classic Outlook issue caused by the December 2025 updates that prevented Microsoft 365 customers .

Microsoft is also investigating a bug that when creating groups in classic Outlook if Exchange Web Services (EWS) is enabled for the tenant.

​Another issue, acknowledged by Microsoft almost two months after the first user reports, for some users in classic Outlook, OneNote, and other Microsoft 365 apps.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems.

According to reports from software supply chain security and application security companies , , , and , the threat actor published on the Node Package Manager (npm) registry two malicious versions of the package

One malicious variant, axios@1.14.1, was published today at 00:21 UTC, while the second one, axios@0.30.4, emerged less than an hour later, at 01:00 UTC.

The packages were published without the automated OpenID Connect (OIDC) package origin and no matching GitHub commit appeared, which should trigger an alert immediately.

The researchers say that the threat actor gained access to the package after compromising the npm account of Jason Saayman, the main .

It is unclear how many downstream projects have been impacted by the supply-chain attack during the nearly three-hour exposure window.

Given that the Axios npm package has around , the number may be significant.

Axios is an HTTP client for JavaScript applications that manages requests between clients, such as browsers or Node.js apps, and servers. Its purpose is to simplify communication via GET, POST, PUT/PATCH, and DELETE requests.

Infection chain

After getting access to the package, the attacker injected a malicious dependency called plain-crypto-js@^4.2.1 into the package.json file and did not alter the Axios code.

The dependency executes a post-install script during the package’s installation, launching an obfuscated dropper (setup.js) that contacts a command-and-control (C2) server to retrieve a next-stage payload based on the detected operating system.

Platform-specific attack chain Source: Endor Labs

On Windows, the attack mixes VBScript and PowerShell to run a hidden Command Prompt window and execute a malicious script. The malware copies PowerShell to %PROGRAMDATA%\wt.exe to evade detection and achieve persistence across reboots, then downloads and executes a PowerShell script.

On macOS, the malware uses AppleScript to download a binary to /Library/Caches/com.apple.act.mond, mark it as executable, and run it in the background.

On Linux systems, the dropper fetches a Python-based payload stored at ‘/tmp/ld.py’ and executes it in the background with the nohup (no hang up) command.

In all cases, the malware infected the host with a remote access trojan (RAT), allowing attackers to execute commands and maintain persistence on infected systems.

The RAT can retrieve and execute a base64-encoded binary that it writes in a hidden temp file, execute shell commands via /bin/sh or AppleScript, and enumerate directories on the infected host.

After the infection is completed, the dropper deletes itself, removes the modified package.json, and replaces it with a clean copy to make forensic investigations more difficult.

Overview of the attack Source: Socket

According to researchers at StepSecurity, the Axios supply-chain attack was , but a carefully planned activity, as "the malicious dependency was staged 18 hours in advance."

The fact that different payloads were delivered based on the detected operating system appears to support this theory, along with the self-destruct action for every artifact.

Currently, there is no information about the threat actor behind the Axios supply-chain attack.

Recently, several high-profile supply-chain attacks were claimed by a group known as TeamPCP. The hackers targeted popular open-source software projects like , , and .

However, the compromise of the Axios package does not have the characteristics of a TeamPCP attack, and security researchers couldn’t link it to a specific threat actor.

Users of Axios are recommended to lock at axios@1.14.0 and axios@0.30.3, which are the last known clean releases of the popular package.

If compromise is confirmed, rotate all credentials and rebuild environments from a known good state.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

​Cybersecurity firm F5 Networks has reclassified a BIG-IP APM denial-of-service (DoS) vulnerability as a critical-severity remote code execution (RCE) flaw, warning that attackers are exploiting it to deploy webshells on unpatched devices.

BIG-IP APM (short for Access Policy Manager) is a centralized access management proxy solution that enables admins to secure and manage user access to their organizations' networks, cloud, applications, and application programming interfaces (APIs).

Tracked , this security flaw can be exploited by attackers without privileges to perform remote code execution when targeting BIG-IP APM systems with access policies configured on a virtual server.

In addition to flagging the vulnerability as being exploited in the wild, F5 and advised defenders to check their BIG-IP systems' disks, logs, and terminal history for signs of malicious activity.

"This known vulnerability was previously categorized and remediated as a Denial-of-Service (DoS) vulnerability. Due to new information obtained in March 2026, the original vulnerability is being re-categorized to an RCE. The original CVE remediation has been validated to address the RCE in the fixed versions. We have learned that this vulnerability has been exploited in the vulnerable BIG-IP versions," in an advisory update published this Sunday.

"F5 strongly recommends that you consult your corporate security policy for guidelines about incident handling procedures including but not limited to forensic best practices, that are specific to your organization. More specifically, review the policies to ensure that they comply with evidence collection and forensics procedures for a security incident before you attempt to recover the system," the company added.

Internet threat-monitoring non-profit organization Shadowserver now tracks ; however, there is no information on how many have a vulnerable configuration or have already been secured against CVE-2025-53521 attacks.

F5 BIG-IP systems exposed online (BleepingComputer)

​The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also the vulnerability to its on Friday and ordered federal agencies to secure their BIG-IP APM systems by midnight on Monday, March 30.

"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," it warned.

"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

In recent years, BIG-IP vulnerabilities have been exploited by nation-state and cybercrime threat groups to , , , , and from victims' networks.

F5 is a Fortune 500 technology giant that provides cybersecurity, application delivery networking (ADN), and various other services to more than 23,000 customers worldwide, including 48 of the Fortune 50 companies.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

The pitch is usually some version of the same thing: deploy an AI agent, reduce your alert backlog, and free your analysts to focus on higher-value work.

Some of that promise is real. But Gartner's latest research on the category suggests most organizations evaluating these tools are asking the wrong questions, or not asking enough of them.

In a recent Gartner report titled Validate the Promises of AI SOC Agents With These Key Questions, analysts Craig Lawson and Andrew Davies lay out a structured evaluation framework for cybersecurity leaders considering AI SOC agent deployments.

Their central finding is sobering: while 70% of large SOCs are expected to pilot AI agents for Tier 1 and Tier 2 operations by 2028, only 15% will achieve measurable improvements without structured evaluation. You can download a complementary copy of the .

That gap between adoption and outcomes is huge, if trust. It suggests the problem facing most security teams is less about whether to adopt AI in the SOC and more about how to separate genuine operational improvement from marketing noise.

Here are the key areas Gartner recommends evaluating, and why each one is critical to success.

1. Does it actually reduce the work your team does today?

This sounds obvious, but Gartner frames it carefully. The first question isn't "what can this tool do?" but rather "which SOC functions does your organization handle today that are repetitive time sinks of limited value in improving threat detection, investigation, and response?"

A tool might demonstrate impressive capabilities in a demo environment while addressing workflows your team has already solved through other means. The evaluation should start with your operational bottlenecks, not the vendor's feature list.

Gartner also recommends asking which specific tasks are best suited for augmentation and whether the solution is purpose-built for specific SOC roles. A platform designed around alert triage and investigation will approach the problem differently than one built for creating if/then workflow rules.

Understanding that scope upfront prevents misaligned expectations later.

This Gartner report provides cybersecurity leaders with key questions and a pragmatic way to evaluate AI SOC solutions, ensuring they actually improve Threat Detection, Investigation, and Response (TDIR) program efficiency and operational outcomes.

2. How do you measure outcomes beyond "alerts processed"?

Volume metrics can be misleading. Processing 10,000 alerts a month means very little if the quality of investigation degrades or if true positives slip through.

Gartner emphasizes that evaluation should center on improvements in and outcomes: mean time to detect, mean time to respond, and false positive reduction. But the report goes further, noting that qualitative outcomes matter too.

Is the tool improving analyst satisfaction? Is it leading to better execution, not just faster execution?

The report also stresses that mean time to contain (MTTC) should be the overall end goal, since containment is where risk actually gets reduced. Any vendor conversation that stops at triage speed without addressing downstream investigation quality and containment timelines is leaving out the part that matters most.

Ask for real-world benchmarks from environments similar to yours. And ask whether those benchmarks were collected during a proof of concept or in sustained production use, because those are often very different numbers.

3. Is the vendor going to be around in two years?

This category is early-stage. Gartner's report describes a market with large numbers of startups using different approaches and design principles. That diversity is healthy for innovation, but it introduces vendor risk that cybersecurity leaders need to evaluate honestly.

The report recommends asking when a vendor's solution first became generally available, what their current customer base looks like, and what their funding and financial outlook is. Gartner also suggests accepting that acquisitions in this space are highly likely and treating that reality as a third-party vendor management risk rather than a disqualifying factor.

Pricing models deserve scrutiny too. Some AI SOC agents price based on alert volume, others on data volume or token usage.

The cost of processing high volumes of alerts through an LLM-backed system can scale in unexpected ways, and Gartner specifically cautions buyers to understand how costs behave under load.

4. Does it make your analysts better, or just busier in a different way?

One of the more nuanced sections of Gartner's framework focuses on analyst augmentation and upskilling. The question isn't just whether the AI handles triage faster. Speed has never been in doubt with AI. It's whether the technology enhances human expertise over time.

Gartner recommends asking what training and enablement resources accompany the tool, whether the AI can create learning opportunities for analysts (such as suggesting threat hunts or recommending best practices), and whether it assists with detection engineering work.

This gets at a tension in the AI SOC market that doesn't get discussed enough. If the AI handles all the investigative legwork, do junior analysts ever develop the skills to become senior analysts?

The best implementations thread this needle by presenting their reasoning in a way that teaches while it triages, giving analysts a transparent investigation to review rather than a binary verdict to accept.

Prophet Security, for example, to show every query, data source, and analytical step the AI took to reach a conclusion. That gives junior analysts a model for how experienced investigators approach an alert, rather than just a yes-or-no answer to rubber-stamp.

5. What are the boundaries of AI autonomy?

Gartner draws a useful distinction between "human in the loop" and "human on the loop" models. The former requires human approval for each action. The latter gives the AI broader latitude to act, with human oversight at the strategic level rather than the tactical level.

Neither model is inherently correct. The right answer depends on your organization's risk appetite, regulatory requirements, and the maturity of the AI system in question.

But Gartner's framework pushes buyers to ask specific questions: What actions can the agent perform autonomously, and which require human approval? How do you enforce guardrails for high-impact decisions like account disablement or network isolation? Can autonomy levels be customized based on task type or risk level?

The report also highlights the importance of fail-safe mechanisms. When an AI agent encounters ambiguity or conflicting signals, it should default to escalation rather than action. That design philosophy matters more than any individual feature because it reflects how the system behaves at the edges, which is where real damage can occur.

6. Will it actually work with your existing stack?

Integration claims are easy to make and hard to validate. Gartner's framework asks buyers to evaluate native integration depth across SIEM, EDR, SOAR, and identity platforms rather than accepting a logo wall at face value.

The report raises a question that often gets overlooked: does the solution require data centralization, or can it operate in any environment as a plug-and-play solution?

For organizations with complex or hybrid architectures, the difference between a tool that needs all your data in one place and one that can query across multiple security data sources is operationally significant.

7. Can you actually see what it's doing?

Transparency might be the most important evaluation criterion in the entire framework. Gartner asks: How does the solution provide explainability for decisions and actions taken by the AI agent? Do you offer human-readable audit trails for every automated action? How do you handle sensitive data, and what controls prevent model misuse or data leakage?

For regulated industries, these aren't nice-to-haves. They're requirements. But even organizations without strict compliance mandates should care about explainability because it directly affects whether analysts trust the tool enough to adopt it.

An AI agent that produces a verdict without showing its work puts the analyst in an uncomfortable position. They either accept the conclusion on faith, which is risky, or they redo the investigation themselves, which defeats the purpose.

This is why some vendors in the space have adopted what amounts to a "glass box" approach: documenting every query run against data sources, the specific data retrieved, and the logic used to reach a determination.

Prophet Security calls this their investigation timeline, where analysts can trace each conclusion back to the underlying evidence rather than trusting a confidence score.

The report emphasizes that buyers should look for this kind of clear explainability, safe handling of sensitive data, and mechanisms for human feedback that actually influence the system's future behavior.

The bigger picture

Gartner's framework is valuable precisely because it resists the impulse to declare winners in a category that's still taking shape. The report's cautions section warns against overreliance on marketing claims, notes that full autonomy isn't viable today, and flags hidden costs around pricing models and integration complexity.

For security leaders evaluating AI SOC agents, the takeaway is straightforward: the technology has genuine potential to reduce investigation burden, improve response times, and extend coverage to alert volumes that human teams simply cannot process manually. But realizing that potential requires the kind of structured, outcomes-driven evaluation that most buying processes skip.

Prophet Security built its around many of the same principles Gartner outlines in this report: transparent investigations that show every step of the AI's reasoning, integration across SIEM, EDR, identity, and cloud tools without requiring data centralization, and a human-on-the-loop model where analysts review completed investigations rather than raw alerts.

The platform is designed to augment existing teams, not replace them, completing investigations in minutes while giving analysts the evidence and context they need to make confident decisions.

For organizations looking to apply Gartner's evaluation framework to their own buying process, the full report, Validate the Promises of AI SOC Agents With These Key Questions, is available for download.

to access all seven evaluation categories, including detailed guidance on what to look for in vendor responses.

Sponsored and written by .

A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler.

The attack uses the ClickFix technique, presenting a fake CAPTCHA that mimics Cloudflare’s human verification check to trick users into executing malicious code.

Researchers at Malwarebytes say this is the first documented macOS campaign combining ClickFix delivery with a Python-based infostealer compiled using Nuitka.

Because Nuitka produces a native binary by compiling the Python script into C code, the resulting executable is more resistant to static analysis.

Compared to PyInstaller, which bundles Python with bytecode, it’s more evasive because it produces a real native binary with no obvious bytecode layer, making reverse engineering much harder.

“The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware,” .

Attack chain

The attack begins with a ClickFix lure on the domain update-check[.]com, posing as a human verification step from Cloudflare and asking the user to complete the challenge by pasting a base64-obfuscated curl command into the macOS Terminal, bypassing OS-level defenses.

ClickFix step used in Infinity attacks Source: Malwarebytes

The command decodes a Bash script that writes the stage-2 (Nuitka loader) to /tmp, then removes the quarantine flag, and executes it via ‘nohup.’ Finally, it passes the command-and-control (C2) and token via environment variables and then deletes itself and closes the Terminal window.

The Nuitka loader is an 8.6 MB Mach-O binary that contains a 35MB zstd-compressed archive, containing the stage-3 (UpdateHelper.bin), which is the Infinity Stealer malware.

The malware's disassembly view Source: Malwarebytes

Before starting to collect sensitive data, the malware performs anti-analysis checks to determine whether it is running in a virtualized/sandboxed environment.

Malwarebytes’ analysis of the Python 3.11 payload uncovered that the info-stealer can take screenshots and harvest the following data:

• Credentials from Chromium‑based browsers and Firefox

  • macOS Keychain entries

  • Cryptocurrency wallets

  • Plaintext secrets in developer files, such as .env

All stolen data is exfiltrated via HTTP POST requests to the C2, and a Telegram notification is sent to the threat actors upon completion of the operation.

Malwarebytes underlines that the appearance of malware like Infinity Stealer is proof that threats to macOS users are only getting more advanced and targeted.

Users should never paste into Terminal commands they find online and don’t fully understand.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.

A large-scale campaign is targeting developers on GitHub with fake Visual Studio Code (VS Code) security alerts posted in the Discussions section of various projects, to trick users into downloading malware.

The spammy posts are crafted as vulnerability advisories and use realistic titles like “Severe Vulnerability - Immediate Update Required,” often including fake CVE IDs and urgent language.

In many cases, the threat actor impersonates real code maintainers or researchers for a false sense of legitimacy.

Application security company Socket says that the activity appears to be part of a well-organized, large-scale operation rather than a narrow-targeted, opportunistic attack.

The discussions are posted in an automated way from newly created or low-activity accounts across thousands of repositories within a few minutes, and trigger email notifications to a large number of tagged users and followers.

Fake security alerts on GitHub Discussions Source: Socket

“Early searches show thousands of nearly identical posts across repositories, indicating this is not an isolated incident but a coordinated spam campaign,” Socket researchers say in a this week.

“Because GitHub Discussions trigger email notifications for participants and watchers, these posts are also delivered directly to developers’ inboxes.”

The posts include links to supposedly patched versions of the impacted VS Code extensions, hosted on external services such as Google Drive.

Example of the fake security alert Source: Socket

Although Google Drive is obviously not the official software distribution channel for a VS Code extension, it’s a trusted service, and users acting in haste may miss the red flag.

Clicking the Google link triggers a cookie-driven redirection chain that leads victims to drnatashachinn[.]com, which runs a JavaScript reconnaissance script.

This payload collects the victim’s timezone, locale, user agent, OS details, and indicators for automation. The data is packaged and sent to the command-and-control via a POST request.

Deobfuscated JS payload Source: Socket

This step serves as a traffic distribution system (TDS) filtering layer, profiling targets to push out bots and researchers, and delivering the second stage only to validated victims.

Socket did not capture the second-stage payload, but noted that the JS script does not deliver it directly, nor does it attempt to capture credentials.

This is not the first time threat actors have abused legitimate GitHub notification systems to distribute phishing and malware.

In March 2025, a widespread phishing campaign with fake security alerts designed to trick developers into authorizing a malicious OAuth app that gave attackers access to their accounts.

In June 2024, threat actors triggered GitHub’s email system via submitted on repositories, to direct targets to phishing pages.

When faced with security alerts, users are advised to verify vulnerability identifiers in authoritative sources, such as (NVD), CISA's catalog of Known Exploited Vulnerabilities, or MITRE's website fot the program.

take a moment to consider their legitimacy before jumping into action, and to look for signs of fraud such as external download links, unverifiable CVEs, and mass tagging of unrelated users.

Automated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the other.

This whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic questions for any tool evaluation.