Daily
The Press Corner
A short résumé of each security publication from the daily scan, with the topic and a link to the original. The scan runs every day at 01:15 UTC. If that run misses, the next hourly pass picks it up. Last scan Oct 23, 2026.
English. 1–15 of 16
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.
Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants
Microsoft said it has observed threat actor activity in multiple ConnectWise customer environments, with the attackers leveraging the ARTEX agentic AI platform
EvilTokens abuses Microsoft device code flow for account takeovers
A new phishing-as-a-service (PhaaS) campaign is abusing Microsoft's device code authentication flow to gain unauthorized access to user accounts. Sekoia researchers first spotted the toolkit "EvilTokens" that lets attackers capture authentication tokens by tricking users into completing a…
Russian hackers signal phishing campaign
Russian hackers signal phishing campaign
Anthropic AI ultimatums and IP theft: The unspoken risk
Two recent high-profile events concerning Anthropic's Claude AI underscore a little-discussed risk at the heart of the enterprise's rush to capitalize on leading AI capabilities. The first incident involved a China-based extraction campaign against Anthropic's intellectual property.
Time to restore America’s cyberspace security system
China’s campaign to break into our critical infrastructure and federal government networks is persistent and growing. Beijing is stealing information while also planting tools and maintaining access in key systems, giving it the option to pressure the United States in the future.
Chinese APT group Phantom Taurus targets gov and telecom organizations
Researchers have documented a previously unknown threat actor that aligns with China's intelligence collection interests. The group primarily targets government and telecommunications organizations from Africa, the Middle East, and Asia with the goal of maintaining long-term covert access to critical systems.
Nation-state group CL-STA-0969 targeted Southeast Asian telecoms in 2024
State-backed group CL-STA-0969 hit Southeast Asian telecoms in 2024, targeting critical infrastructure, says Palo Alto Networks’ Unit 42. Palo Alto Networks reported that a nation-state actor, tracked as CL-STA-0969, targeted telecom firms in Southeast Asia, with attacks on critical infrastructure from February to…
China-Linked APT Aquatic Panda: 10-Month Campaign, 7 Global Targets, 5 Malware Families
China-linked APT Aquatic Panda targeted 7 organizations in a 10-month espionage campaign using five malware families.
SideWinder APT Targets Maritime, Nuclear, and IT Sectors Across Asia, Middle East, and Africa
SideWinder APT expands attacks on maritime, nuclear, and IT sectors, rapidly modifying malware to evade detection.
Russian disinformation campaign active ahead of 2024 US election
U.S. intel says Russia made a fake video claiming Haitians voted illegally in Georgia, aiming to spread election disinformation.
Justice Department accuses Russia of interfering with 2024 elections
The U.S. government announced indictments, seizures and sanctions against individuals they say were associated with a propaganda campaign targeting the 2024 election.
'eXotic Visit' Spyware Campaign Targets Android Users in India and Pakistan
Active Android spyware campaign 'eXotic Visit' targeting users in India and Pakistan.
New Leak Shows Business Side of China’s APT Menace – Krebs on Security
New Leak Shows Business Side of China’s APT Menace – Krebs on Security
New 'HrServ.dll' Web Shell Detected in APT Attack Targeting Afghan Government
A new web shell called HrServ is part of a suspected APT attack in Afghanistan. HrServ can erase tracks and execute code in memory.