short, practical notes about not getting phished. no fear mongering, just the checklist.
Attackers holding a valid password can flood a phone with approval prompts until someone taps approve. How MFA fatigue works, what the Uber and Cisco breaches showed, and why number matching and hardware keys change the outcome.
AiTM phishing kits and infostealer logs increasingly trade in authenticated sessions rather than passwords: a stolen session cookie is already past the MFA wall. A look at how session hijacking works and which defenses actually hold.
A working reference to darknet market vocabulary: what exit scam, rug pull, vendor bond, finalize early, FUD, mirror, canary and OPSEC actually name, and why each term was coined.
Kaspersky's GReAT team links the BlackX UEFI bootkit to APT41 and an espionage campaign against diplomatic organizations in Central Asia. It exploits the Baton Drop Secure Boot bypass (CVE-2022-21894), which stays exploitable when the manual revocation step was skipped.
In early September 2026, the FBI opened a probe into Nexus, a darknet service selling scans of more than 153 million US and Canadian driver's licenses, apparently sourced from identity-verification firm IDScan.net. The case shows why KYC data is the darknet data trade's most durable commodity, and what to do if your scan is in a dump.
Citizen Lab reports that merely displaying a targeted advertisement was enough to infect employees' devices with mercenary spyware commissioned by the Israeli ad-tech firm Discover-Tech. Major ad platforms and industry bodies have since cut the company's access.
Attackers used leaked GitHub developer tokens to push a credential-stealing payload as litellm v1.107.0 to PyPI and Docker Hub on October 21, 2026 — the project's second pipeline compromise of 2026, after March's TeamPCP backdoor. Cloud keys, Kubernetes secrets and AI API keys were among the targeted data.
Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained a hardware implant hidden behind the display, capturing 24-word recovery phrases during setup and transmitting wallet keys over a mobile network. According to Bitquery, unconfirmed by Ledger, suspected losses reach $93.2 million across 315 wallets on six chains; Tether has frozen roughly $10 million in USDT.
PHP shipped out-of-band releases today for two critical use-after-free bugs enabling unauthenticated remote code execution. Sites running PHP - especially onion services - should update and restart all workers now.
The blockchain-analytics firm says an external actor used AI-driven “offensive agentic techniques” to access its systems and internal tools, exposing user IDs, names, email addresses and role labels. Investigation content and credentials were not accessed, according to the company.
A malicious script injected through a compromised third-party vendor hit Polymarket's front end and drained an estimated $2.7 million from about 700 users, according to Bubblemaps monitoring. Trading has resumed, the company has promised full reimbursement, and it is the platform's second vendor-origin compromise in 2026.
Slovak intelligence dismantled an EU-funded NERO R-ONE camera and found a rebadged Russian CORDON PRO.M with two modems and a hidden SMS-triggered backdoor tied to twelve Russian phone numbers.
