EUVD-2022-39979

Malicious code in bioql PyPI...

EUVD-2022-35645

Malicious code in bioql PyPI...

EUVD-2024-27270

Malicious code in bioql PyPI...

EUVD-2023-36904

Malicious code in bioql PyPI...

EUVD-2024-24482

Malicious code in bioql PyPI...

17,500 Phishing Domains Target 316 Brands Across 74 Countries in Global PhaaS Surge

The phishing-as-a-service PhaaS offerings known as Lighthouse and Lucid have been linked to more than 17,500 phishing domains targeting 316 brands from 74 countries. "Phishing-as-a-Service PhaaS deployments have risen significantly recently," Netcraft said in a new report. "The PhaaS operators...

Characterizing Phishing Pages by JavaScript Capabilities

In 2024, the Anti-Phishing Work Group identified over one million phishing pages. Phishers achieve this scale by using phishing kits -- ready-to-deploy phishing websites -- to rapidly deploy phishing campaigns with specific data exfiltration, evasion, or mimicry techniques. In contrast, researche...

Axios Abuse and Salty 2FA Kits Fuel Advanced Microsoft 365 Phishing Attacks

Threat actors are abusing HTTP client tools like Axios in conjunction with Microsoft's Direct Send feature to form a "highly efficient attack pipeline" in recent phishing campaigns, according to new findings from ReliaQuest. "Axios user agent activity surged 241% from June to August 2025, dwarfin...

Malicious code in windows-sdks (npm)

The package windows-sdks was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

PT-2025-34562 · Undefined · Undefined

🔥 Android under fire: Two high-severity bugs — CVE-2025-38805 and CVE-2025-38806 — have entered exploit kits. Attackers adapt quickly; don’t be the easy target. Details: https://t.co/tej1yYGlw1 Created by AI. Android ZeroDay...

PT-2025-34561 · Undefined · Undefined

🔥 Android under fire: Two high-severity bugs — CVE-2025-38805 and CVE-2025-38806 — have entered exploit kits. Attackers adapt quickly; don’t be the easy target. Details: https://t.co/tej1yYGlw1 Created by AI. Android ZeroDay...

MAL-2025-15916 Malicious code in bnrn-kits (npm)

The package bnrn-kits was found to contain malicious code...

Malicious code in bnrn-kits (npm)

The package bnrn-kits was found to contain malicious code...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

Official Clerk JavaScript SDKs 数据伪造问题漏洞

Official Clerk JavaScript SDKs is a Clerk open source official Javascript repository for Clerk authentication. A data forgery vulnerability exists in the Official Clerk JavaScript SDKs, which stems from insufficient verifyWebhook validation and may result in the acceptance of unsigned webhook...

CVE-2025-5256

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection...

CVE-2025-5256 Open Redirect vulnerability on user unlock path

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection...

CVE-2025-5256 Open Redirect vulnerability on user unlock path

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection...

Pakistan Arrests 21 in ‘Heartsender’ Malware Service

Authorities in Pakistan have arrested 21 individuals accused of operating "Heartsender ," a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to trick victim companies into making...

Mautic has an Open Redirect vulnerability on user unlock path.

Summary This advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious websites, potentially leading to phishing attacks or the delivery of exploit kits. Open Redirection...