LATEST

From Cost Center to ROI Engine: Making ASM a Security Investment That Pays for Itself

In today’s sprawling digital landscape, the question for security leaders isn’t whether Attack Surface Management (ASM) matters; it’s whether your ASM platform is doing enough to earn its place in the budget. If your board or finance team is asking you to justify the spend, you’re not alone. Saying it “improves visibility” or “reduces risk” isn’t enough anymore. You need to show real outcomes, saved hours, reduced incidents, lower cloud costs, and stronger operational resilience. That’s where C…

Top Cyber Threat Trends of 2025: Deepfakes, ClickFix & More | Huntress

John Hammond and Greg Linares with Huntress discuss the top tradecraft we’ve seen this year so far, from ClickFix attacks to deepfake social engineering

Be Offensive: A bold take on Cybersecurity Awareness Month.

Over 20 years of Cybersecurity Awareness Month, and we’ve had enough. This October, Huntress is taking a new attitude with an offensive-minded approach to defense.

Sharpening the Focus on Product Requirements and Cybersecurity Risks: Updating Foundational Activities for IoT Product Manufacturers

Update: The comment period for your feedback on the second public draft of NIST IR 8259 has been extended through December 10, 2025. Over the past few months, NIST has been revising and updating Foundational Activities for IoT Product Manufacturers (NIST IR 8259 Revision 1 Initial Public Draft), which describes recommended pre-market and post-market activities for manufacturers to develop products that meet their customers’ cybersecurity needs and expectations. Thank you so much for the thought…

E-commerce Fraud-as-a-Service: How Scammers Exploit Brand Trust at Scale

In the rapidly evolving digital marketplace, e-commerce brands have become prime targets for cybercriminals. Beyond traditional data breaches, these brands now face sophisticated scams that exploit their reputation, deceive consumers, and erode trust. Drawing from investigations conducted by RedHunt Labs’ threat intelligence team, this blog delves into some of the most prevalent scams targeting e-commerce platforms and highlights how a Digital Risk Protection (DRP) solution can help fortify you…

ClickFix Attack: Variants, Detection & How It Works | Huntress

Learn how ClickFix techniques like FileFix, TerminalFix, and DownloadFix trick users into compromising. Then, learn proven detection methods using chokepoint strategies and behavioral analytics.

A Vietnamese threat actor's shift from PXA Stealer to PureRAT

Trace a threat actor's journey from custom Python stealers to a sophisticated commodity RAT. Learn how their tactics evolved and why this shift to .NET matters.

[MàJ] Multiples vulnérabilités dans Cisco ASA et FTD (25 septembre 2025)

**[Mise à jour du 07 novembre 2025]** Le 5 novembre 2025, Cisco a mis a jour son billet de blogue initialement publié le 25 septembre 2025 (cf. section Documentation). L'éditeur déclare avoir connaissance d'une nouvelle attaque, affectant les équipements ASA et FTD vulnérables, qui cause un déni...

Accelerating adoption of AI for cybersecurity at DEF CON 33

Posted by Elie Bursztein and Marianna Tishchenko, Google Privacy, Safety and Security TeamEmpowering cyber defenders with AI is critical to tilting the cybersecurity balance back in their favor as they battle cybercriminals and keep users safe. To help accelerate adoption of AI for cybersecurity workflows, we partnered with Airbus at DEF CON 33 to host the GenSec Capture the Flag (CTF), dedicated to human-AI collaboration in cybersecurity. Our goal was to create a fun, interactive environment, …

Echoes of AI Exposure: Thousands of Secrets Leaking Through Vibe Coded Sites | Wave 15 | Project Resonance

1. Introduction The vibe coding revolution has empowered millions to build and deploy websites using natural languages. Entrepreneurs, artists, and small businesses can now bring their ideas to life online without writing a single line of code. But has this convenience come at a hidden security cost? In this post, we present the 15th wave of Project Resonance: A RedHunt Labs Research Initiative, investigating the security posture of websites built on modern “vibe coding” platforms. Our research…

SAT effectiveness | Huntress

Learn the truth about SAT effectiveness. Our latest report reveals why increased spending on training isn’t reducing human risk—and how to fix it.

System Update Completed

All packages were updated successfully.

How EDR Telemetry Powers Managed Investigations

Learn more about what it actually means to go up against hackers–and why creative, human-led investigations are essential for keeping your organization safe from modern threats.

How Malicious Hackers Try to Infiltrate Your IT Team

Malicious hackers are impersonating IT and cybersecurity professionals to infiltrate your systems and steal sensitive data. Learn how to identify and defend against these insider threats and protect your organization from "fake workers."

Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025

The blog provides an in-depth look at MuddyWater’s evolution in tooling, targeting, and infrastructure management, suggesting a more mature and capable advanced persistent threat within the META region.

Entra ID actor token validation bug allowing cross-tenant global admin

A critical vulnerability discovered in Microsoft's Entra ID (formerly Azure AD) allowed for cross-tenant access and potential global admin privilege escalation. The flaw was found in the legacy Azure AD Graph API, which improperly validated the originating tenant for undocumented "Actor tokens." An attacker could use a token from their own tenant to authenticate as any user, including Global Admins, in any other tenant. This vulnerability bypassed security policies like Conditional Access. The …

Supporting Rowhammer research to protect the DRAM ecosystem

Posted by Daniel MoghimiRowhammer is a complex class of vulnerabilities across the industry. It is a hardware vulnerability in DRAM where repeatedly accessing a row of memory can cause bit flips in adjacent rows, leading to data corruption. This can be exploited by attackers to gain unauthorized access to data, escalate privileges, or cause denial of service. Hardware vendors have deployed various mitigations, such as ECC and Target Row Refresh (TRR) for DDR5 memory, to mitigate Rowhammer and e…

Agneyastra to the Rescue: Protecting your Firebase Projects before the Tea spills out!

In July 2025, the Tea app 🔗, a mental health and social community platform, experienced a devastating breach that spilled 72,000 images (including 13,000 driver’s license and verification selfies) and over 1.1 million private direct messages onto the internet. The leaks first surfaced on 4chan and quickly spread across forums, torrents, and underground channels. This was not “just another API key leak.” Instead, it was a story about Firebase misconfigurations, poor data retention practices, an…

How Pixel and Android are bringing a new level of trust to your images with C2PA Content Credentials

Posted by Eric Lynch, Senior Product Manager, Android Security, and Sherif Hanna, Group Product Manager, Google C2PA Core At Made by Google 2025, we announced that the new Google Pixel 10 phones will support C2PA Content Credentials in Pixel Camera and Google Photos. This announcement represents a series of steps towards greater digital media transparency: The Pixel 10 lineup is the first to have Content Credentials built in across every photo created by Pixel Camera. The Pixel Camera app achie…

TecCom TecConnect 4.1 XML External Entity (XXE)

CVE-2025-10183

AI-Powered Celebrity Impersonation Scams: A Threat Intelligence Report by RedHunt Labs

Introduction A new wave of AI-powered investment scams is targeting Indian users on Facebook and Instagram, luring them with fake celebrity endorsements and deepfake interviews. Ads featuring figures like Nirmala Sitharaman, Sadhguru, and Neha Kakkar promote fraudulent schemes, directing users to counterfeit news websites mimicking The Times of India, IndiaTime, and NDTV. These sites claim celebrities have built fortunes using exclusive investment strategies, persuading victims to deposit ₹21,0…

An Attacker’s Blunder Gave Us a Look Into Their Operations

An attacker installed Huntress onto their operating machine, giving us a detailed look at how they’re using AI to build workflows, searching for tools like Evilginx, and researching targets like software development companies.

10 Cybersecurity Podcasts to Add to Your Queue Now

From Deepfakes to Dark LLMs: 5 use-cases of how AI is Powering Cybercrime

AI in cybercrime is evolving fast, fueling AI phishing attacks, AI scam calls, AI voice cloning scams, and even AI deepfake scams. From Dark LLMs to next-gen AI phishing tactics, we break down how criminals exploit AI today and what you can do to stay protected.

Obscura, an Obscure New Ransomware Variant

Huntress found a previously unseen ransomware variant called Obscura on a victim company’s domain controller.

Debunking Microsoft 365 & Identity Myths

Don’t fall for common Microsoft 365 identity security myths. Here, Huntress debunks misconceptions around logins, MFA, Conditional Access, Impossible Travel, and security tuning.

From a Fake AnyDesk Installer to MetaStealer

Learn how a fake AnyDesk installer led to a unique MetaStealer attack, highlighting how threat actors evolve ClickFix techniques beyond the classic playbook to steal credentials and files.

ShadowSilk: A Cross-Border Binary Union for Data Exfiltration

This blog describes attacks on victims in Central Asia and APAC. Research into the attack has identified a group also called YoroTrooper. We also identified profiles of attackers on hacker forums, their malicious web-panels, test infections of attackers' own machines, and screenshots of attackers' desktops.

Join Huntress' John Hammond & Dave Kleinatland on a | Huntress

Huntress researchers take a tour through the dark web, from innovative threat actor marketing techniques to cybercrime drama on BreachForums.

Should MSPs Turn Off Google Gemini? | Huntress

Hackers are using Google Gemini's email summaries to sneak in phishing attacks without links or attachments.