Global Intelligence Search
Query the entire database for vulnerabilities, news articles, open-source security tools, and known threat actors.
Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Executive Summary This article analyzes new attack classes against passwordless authentication, focusing on Google’s synced passkey ecosystem and the Cloud Authenticator used by desktop clients. The attacks demonstrate...
The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version
Executive Summary After months of dormancy, the attackers behind the XCSSET malware released version 40 (v40), targeting the macOS ecosystem. This version’s advanced architecture hides its core logic in memory space,...
Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
Executive Summary Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor. They targeted infrastructure using seven vulnerabilities, combining autonomous AI-driven...
Russian Global Webmail Espionage
Executive Summary Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and...
Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy
Executive Summary We conducted this research in close partnership with Siemens, reflecting our shared commitment to advancing the security and resilience of critical infrastructure. This report details a critical,...
AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report
Unit 42’s 2026 Global Incident Response Report offers frontline intelligence drawn directly from global investigations. The report spotlights four defining trends shaping the threat landscape. We’ll take a closer look...
The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
Executive Summary The security of the npm ecosystem reached a critical inflection point in September 2025. The Shai-Hulud worm, a self-replicating malware that automated the compromise and redistribution of malicious...
Latvian officials resign after cyberattack exposes data on 1.2 million people
Latvia's Road Traffic Safety Directorate, which handles vehicle registration and driver's licenses, announced a significant data breach affecting its systems. Credit: Maris Greidans / Flickr Latvian officials resign...
US charges Iranians for sprawling hacking campaign on government agencies, universities
Image: sina drakhshani / Unsplash US charges Iranians for sprawling hacking campaign on government agencies, universities The Justice Department accused hackers connected to Iran’s military of breaching employee email...
More than 200 victims of Medusa ransomware identified over the last year, CISA says
Image: Unsplash/Photomosh More than 200 victims of Medusa ransomware identified over the last year, CISA says Federal cybersecurity agencies warned on Tuesday that troves of new victims of the Medusa ransomware gang...
Berlin cuts two state ministries off government network after security breach
/berlin-cuts-two-state-ministries-off-government-breach Berlin cuts two state ministries off government network after security breach Two Berlin state ministries have been cut off from the city government’s IT network...
University of Texas forced to take systems offline in San Antonio after cyberattack
Image: Weston via Unsplash/USTA University of Texas forced to take systems offline in San Antonio after cyberattack One of the largest universities in Texas is facing a wide range of disruptions following a cyberattack...