short, practical notes about not getting phished. no fear mongering, just the checklist.
Air-gapped machines still get infected. How data physically crosses an air gap - USB firmware tricks, acoustic and light covert channels, radio leakage from a USB port - anchored in Stuxnet and the Ben-Gurion research lineage, and what defenders do about it.
A breach notice compresses weeks of forensics into a few careful sentences. The scope verbs, the password storage format and the gap between discovery and disclosure usually say more than the apology does.
A two-year campaign that once targeted crypto-wallet users has moved to security professionals, hiding a modular Electron loader in GitHub repositories that pose as Fscan parsers, scan automation and log-analysis tools. Dr.Web says more than 2,000 Windows systems are infected.
DRAM holds its contents for seconds to minutes after power-off, longer when chilled, and full-disk encryption keys are usually among them. What the 2008 Princeton work showed, what modern memory scrambling does not fix, and the mitigations Tails actually ships.
Roughly half of the people who find a dropped USB drive plug it in and open files - a field experiment measured 48 percent. A look at the history of the ploy, the study behind the numbers, modern bait hardware and the rules that actually help.
Browser extensions listed in official stores have repeatedly worked as credential and cookie stealers. A look at documented campaigns, the review gap that lets approved packages change behavior after approval, and a practical defense routine.
Stolen records rarely travel straight from a breach to the tool that abuses them. Brokers, aggregators, enrichers and repackagers keep the material moving, and every stage of that chain has a point where defenders can break it.
ALPR networks let a single query reach tens of thousands of cameras, and connected cars stream position data to brokers. FTC enforcement, leaked audit logs and documented stalking cases show why vehicle location should be treated as permanently compromised.
Google has taken legal action against the command-and-control servers of x.cpe, a firmware backdoor that TrendAI counted on 1,472,554 Android devices across 206 models. Google says Shenzhen manufacturer Videostrong built and sold access to the botnet, and has banned the company from certified Android hardware.
Fake recruiters on LinkedIn and fake interview sites turn job applications into malware infections. A look at the documented campaigns — Operation DreamJob, Contagious Interview, Graphalgo — their red flags, and what to check before running any coding test.
Cisco Talos has documented a Windows infostealer that sends each victim's stolen data to OpenRouter models and asks for a ranked assessment of what the person is worth and how good their opsec is. The sample ships as a per-customer build with no attacker-owned infrastructure.
Adversary-in-the-middle kits relay one-time codes and session cookies in real time, but a passkey is bound to the single domain that issued it, so the proxy gets nothing to relay. A look at why the mechanism holds, where it still falls short, and how far adoption has come.
