Threat intelligence, automated.
AI-researched threat write-ups, live IOC feeds, and MITRE ATT&CK mappings — human-reviewed before every publish. Built for defenders.
ArcticRAT Android Malware Leverages AI for Financial Profiling
The ArcticRAT cybercrime gang is deploying Android malware that has evolved from cryptocurrency theft to achieving full device control. This sophisticated malware now utilizes artificial intelligence to analyze stolen financial data, enabling the attackers to create detailed victim profiles for more effective exploitation.
Read full report →Trojanized Claude Code Extension Incident via Stolen Fireworks AI Key
A trojanized version of Anthropic’s official Claude Code extension was distributed on Cursor’s marketplace after an attacker leveraged a stolen access key. The key, issued by Cursor to Fireworks AI, was exposed during a Fireworks AI breach, allowing the attacker to copy data and compromise the extension.
FBI Warns of Artex Tool Accelerating Cyberattacks
The FBI has issued a flash alert regarding Artex, an open-source hacking tool capable of automating cyberattacks at ‘machine speed’. This tool significantly reduces the time required to chain attack techniques, enabling adversaries to achieve privileged access in under three hours. Defenders should prioritize rapid detection and response to mitigate the accelerated threat posed by Artex.
US Disrupts North Korean ‘FaceStealer’ Crypto Theft Campaign
The U.S. government has successfully disrupted a North Korean social engineering campaign, dubbed ‘FaceStealer,’ which was responsible for stealing over $400 million in cryptocurrency. This campaign leveraged sophisticated social engineering tactics to compromise individuals and illicitly transfer digital assets, highlighting the persistent financial motivations of state-sponsored actors.
Cursor IDE Supply Chain Compromise: Malicious Claude Code Extension
Cursor, an AI-native code editor, confirmed a security breach that led to the distribution of a malicious ‘Claude Code extension’ through its marketplace. Attackers gained access by stealing credentials from AI infrastructure provider Fireworks AI, enabling them to compromise Cursor’s build and distribution pipeline.
CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition
A critical Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability (CVE-2026-119977) in WordPress Core versions 4.7 through 7.1.3 allows unauthenticated attackers to achieve Remote Code Execution. This occurs during the core upgrade window due to predictable, web-accessible staging paths, enabling attackers to inject malicious code.
CVE-2026-118527: Ivanti Connect Secure Predictable Numbers Vulnerability Leading to File Upload
CVE-2026-118527 is a critical vulnerability in Ivanti Connect Secure that allows a remote authenticated attacker to upload arbitrary files to a known location on disk. This flaw stems from the generation of predictable numbers or identifiers and can be chained with other vulnerabilities for broader system compromise. Given its presence in CISA’s KEV, it is actively exploited in the wild.
CVE-2026-111357: Ivanti Connect Secure Privilege Escalation
CVE-2026-111357 is a high-severity privilege escalation vulnerability in Ivanti Connect Secure appliances, actively exploited in the wild since October 2026. A local authenticated attacker can leverage this flaw, which involves mishandling of DSCache configuration data by the `dsinvoked` broker, to gain root privileges. This vulnerability can be chained with other Ivanti zero-days.
CVE-2026-76418: Cisco Secure Firewall ASA/FTD Denial of Service Vulnerability
Cisco Secure Firewall ASA and FTD Software are vulnerable to a remote, unauthenticated denial of service (DoS) condition (CVE-2026-76418). Exploitation involves sending crafted requests to the SSL remote access VPN service when secondary authentication is configured, causing the device to unexpectedly reload. This vulnerability is rated 8.6 (HIGH) and is listed in CISA’s Known Exploited Vulnerabilities Catalog.
Transparently AI-authored
Every report on this site is researched and drafted by an AI agent, then reviewed and approved by a human analyst before publication. The Agent Logbook shows every step — sources consulted, enrichment calls, tokens used, and approval status — in real time.