[{"channel_id":1142915694,"post_id":5490,"date":1787718159000,"views":"56","fwd_from":[],"text":"Survey: 56% of AI enthusiasts (and a third of all users) tell chatbots things they keep from other people<\/b>

https:\/\/spreadprivacy.com\/ai-privacy-survey-aug26\/<\/a>","text_length":157,"media":{"root":"\/002\/chUAAG6CH0QAAAAAs3WE_c4nIyE","webpage":{"url":"https:\/\/spreadprivacy.com\/ai-privacy-survey-aug26","type":"photo","title":"Survey: 56% of AI enthusiasts (and a third of all users) tell chatbots things they keep from other people","site_name":"Spread Privacy","display_url":"spreadprivacy.com\/ai-privacy-survey-aug26","description":"New survey found 56% of AI enthusiasts (and a third of all users) tell chatbots things they keep from other people. How safe are their secrets?","thumbs":{"m":{"w":320,"h":180,"hash":"wswdMbiukvCDVODtW8nnhg&ts=1787762070"},"x":{"w":800,"h":450,"hash":"zD6JhgOwQ8yduK2l3WLy4w&ts=1787762070"},"y":{"w":1200,"h":675,"hash":"nqvWMuwFigDGnjnQ1Y6_gw&ts=1787762070"},"i":{"bytes":"AXACg|C\/JKVkIDoOeQwPtT4X3A7mUnORj0oeNixIkIz2xnFCRuhyZMj02gUxEmTuxiqst1Ikm0RkR5wZGNWTIisFLDJ6Csu5u\/Ns3QoAG\/mDSeug0aFvL5oY7gwHpRWZoUmHmj9g1FCVkD1Zrnfu6rj6U6iimSNKISGKjI6GqMWnArL5hyHfcAO1FFIoWKzWC6EsZ24GCB3ooooA\/9k="}}}}},{"channel_id":1142915694,"post_id":5489,"date":1787289384000,"forwards":"1","views":"157","text":"Manic: Blend between Banking Malware & Spyware

is a new Android banking malware and mobile spyware:

https:\/\/www.threatfabric.com\/blogs\/manic-blend-between-banking-malware-and-spyware<\/a>","text_length":184,"media":{"root":"\/00b\/cRUAAG6CH0QAAAAAkcfjR9fHuYk","webpage":{"url":"https:\/\/www.threatfabric.com\/blogs\/manic-blend-between-banking-malware-and-spyware","type":"photo","title":"Manic: Blend between Banking Malware & Spyware","site_name":"ThreatFabric","display_url":"threatfabric.com\/blogs\/manic-blend-between-banking-malware-and-spyware","description":"Perseus is a new Device Takeover (DTO) malware family that specifically looks for user-generated content stored in note taking applications.","thumbs":{"m":{"w":320,"h":168,"hash":"A0aiIqo5xH9DAWHxX8oSGg&ts=1787762070"},"x":{"w":800,"h":419,"hash":"KX1aOl2QX1mmGLZ5b1Y84g&ts=1787762070"},"y":{"w":1280,"h":670,"hash":"kLMINLb2eDcVtqg0EjgoDA&ts=1787762070"},"w":{"w":2400,"h":1256,"hash":"qtnBaDZPr54IyF8YdCbbMw&ts=1787762070"},"i":{"bytes":"AVACg|CvHsKDOA3c5PNSDGeKgRSRkA1MoK9Q35UyLkhcIOajEnmHluKJAuMjcT7qajXaeiNn0pNlJJ9SzGY3zt5wcGiq8JILbUwc9ScUU0yXFLqMjcr0qZWJ60UUwJQeOlQN8rnFFFIQo4zjuc0UUUgP\/9k="}}}}},{"channel_id":1142915694,"post_id":5488,"date":1787138697000,"forwards":"1","views":"202","text":"Clop Returns with Custom Implant in Mass-Extortion Campaign<\/b>

..\u201cClop's\u201d exploitation of CVE-2026-12569 in PTC Windchill has returned the group to mass exploitation, delivering a custom web shell that provides full data-theft capability from the moment of deployment, with no additional tooling required..:

https:\/\/reliaquest.com\/blog\/clop-returns-with-custom-implant-in-mass-extortion-campaign\/<\/a>","text_length":395,"media":{"root":"\/003\/cBUAAG6CH0QAAAAAXD-vp9zh0nY","webpage":{"url":"https:\/\/reliaquest.com\/blog\/clop-returns-with-custom-implant-in-mass-extortion-campaign","type":"article","title":"Clop Returns with Custom Implant in Mass-Extortion Campaign","site_name":"ReliaQuest","display_url":"reliaquest.com\/blog\/clop-returns-with-custom-implant-in-mass-extortion-campaign","description":"Clop's exploitation of CVE-2026-12569 in PTC Windchill returns the group to mass exploitation with a custom web shell built for full data theft.","thumbs":{"m":{"w":320,"h":221,"hash":"TicF-wTlKyWA8_xsMUXx0A&ts=1787762070"},"x":{"w":512,"h":354,"hash":"43sn2u6C-vMCqIRkEGbfug&ts=1787762070"},"i":{"bytes":"AcACg|DMAzSUA8Uo6itQEIptSNjHFMxUtANopSKKQAKUHimhiOhozTTAk60dvelAyBTT1qgEopSeaKQH\/9k="}}}}},{"channel_id":1142915694,"post_id":5487,"date":1786621235000,"forwards":"2","views":"327","fwd_from":[],"text":"3 BILLION DNS queries.<\/b>

Almost +1 billion in one week.

OpenBLD started in 2019 as a homegrown project handling around 35K DNS queries a day.

Today:

\u2192 ~15M queries\/hour
\u2192 4K+ queries\/second
\u2192 servers distributed around the world
\u2192 billions of DNS queries processed

And it still runs mostly on regular VPS infrastructure - with plenty of performance headroom left.

Getting here required years of optimizing the entire stack: networking, DNS processing, caching, filtering, load balancing, observability, and the Go code itself.

Now the growth is public too:

Real-time OpenBLD network statistics are live on OpenBLD.net<\/a>.

From 35K\/day to 3 billion.

Still building. \ud83d\ude80

Fast. Private. Open.","text_length":694,"media":{"root":"\/003\/bxUAAG6CH0QAAAAAXD-vp9zh0nY","photo":{"thumbs":{"m":{"w":320,"h":175,"hash":"bQ7aMvnRw17eNwTTxSWpnA&ts=1787762070"},"x":{"w":800,"h":437,"hash":"G97AR0YYnNlyB7qSWKFMkQ&ts=1787762070"},"y":{"w":1280,"h":700,"hash":"chsPlIJsVgSenAY9U4UeNQ&ts=1787762070"},"i":{"bytes":"AWACg|DMUIR8zEH6UFU\/56H8qWI\/L9wGgnP8IFAiI4ycHIpQM9wKl3DA+QUgOM\/KDmgYwgjHINFK3b60UAIr7RjANHme1FFMBTLnsKPM+XGBRRQAhOaKKKBH\/9k="}}}}},{"channel_id":1142915694,"post_id":5486,"date":1786032974000,"forwards":"6","views":"93","text":"Claude in Chrome: From alert(1) to Full Account Takeover
<\/b>
https:\/\/labs.zenity.io\/post\/claude-in-chrome-from-alert-to-full-account-takeover<\/a>","text_length":138,"media":{"root":"\/002\/bhUAAG6CH0QAAAAAs3WE_c4nIyE","photo":{"thumbs":{"m":{"w":320,"h":176,"hash":"miGN_1eAEqmGUIfMq4vWWA&ts=1787762070"},"x":{"w":750,"h":413,"hash":"Y7LP5XZxXhPF9FAV0Mpn5Q&ts=1787762070"},"i":{"bytes":"AWACg|Cg0qkEZNR7h6\/pTO9LkelAEivGAPvZ7mnb1PTNQH6U5O9AEu72opn40UAR05CwztOKKKAG0+PvmiigCTc3l7dzbOuM8etFFFAH\/9k="}}}}},{"channel_id":1142915694,"post_id":5485,"date":1785933415000,"forwards":"4","views":"353","text":"7-Zip Leaves Extracted Malware Without Mark-of-the-Web, Bypassing Windows SmartScreen

evil 7-zip)

https:\/\/cyberpress.org\/7-zip-bypasses-smartscreen-protections\/<\/a>","text_length":162,"media":{"root":"\/013\/bRUAAG6CH0QAAAAAE7SviJSdRGU","webpage":{"url":"https:\/\/cyberpress.org\/7-zip-bypasses-smartscreen-protections","type":"photo","title":"7-Zip Leaves Extracted Malware Without Mark-of-the-Web, Bypassing Windows SmartScreen","site_name":"Cyber Security News","display_url":"cyberpress.org\/7-zip-bypasses-smartscreen-protections","description":"A 7-Zip flaw can allow malware extracted from a specially crafted archive to lose Windows\u2019 Mark-of-the-Web (MotW) label. Without that label","author":"Varshini","thumbs":{"m":{"w":320,"h":174,"hash":"EPcXtJKoLkZQJ0kJzyPdCw&ts=1787762070"},"x":{"w":800,"h":434,"hash":"zO0c2JWNN_okQqi7XnAWUg&ts=1787762070"},"y":{"w":1068,"h":580,"hash":"PeHr6NWAL1PaVuw1I43c0g&ts=1787762070"},"i":{"bytes":"AWACg|CLfge9AOTk1GsrqMBjj0qzAd6csc7sDmuflOnmsV5pWQqAoOfWk+0Tq23agHPP0qSXInQOCcZAzRn9+gAH3TxQrdgd+4wyzb1y6ld2DgUU6c4CgjHIoo0fQV2upT3mpY7hkOMZ5z1oorUzuO8wuxOBkmkmfEwAHTjNFFQtzSXwi3D7pcHpgfyoooprYxP\/2Q=="}}}}},{"channel_id":1142915694,"post_id":5484,"date":1785850622000,"views":"210","text":"Threat Actors Abuse Trusted Software Lures and Cloudflare Tunnels to Deploy ScreenConnect RMM Agents Across Windows and macOSScreenConnect RMM Agents Across Windows and macOS

Analyzing SMOKE#SCREEN:

https:\/\/www.securonix.com\/blog\/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels\/<\/a>","text_length":288,"media":{"root":"\/012\/bBUAAG6CH0QAAAAAGw-6gu2tHYg","webpage":{"url":"https:\/\/www.securonix.com\/blog\/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels","type":"photo","title":"SMOKE#SCREEN: ScreenConnect RMM Abuse, Cloudflare Tunnels, and Trusted Software Lures","site_name":"Securonix","display_url":"securonix.com\/blog\/smoke-screen-screenconnect-rmm-abuse-cloudflare-tunnels","description":"Securonix Threat Research: Analyze the SMOKE#SCREEN campaign abusing ScreenConnect RMM, Cloudflare Tunnels, and trusted software lures to gain persistent access across Windows and macOS.","thumbs":{"m":{"w":320,"h":194,"hash":"ZAsF96FDwuCek2drqngKJw&ts=1787762070"},"x":{"w":740,"h":448,"hash":"TpZ92jbz90ks25gNarrajg&ts=1787762070"},"i":{"bytes":"AYACg|Cmu3HOc+1P+Ttn8adEWCYB4z7VLub1P6VcmbIanlYG5Wz7GnDZ6GnZLcEn8xQqA9j+dc8mWhAKKdjmisyiquMU8YoorokQhwFPUUUVgyySiiipA\/\/Z"}}}}},{"channel_id":1142915694,"post_id":5483,"date":1785414222000,"forwards":"1","views":"236","text":"Welcome to Danglegeddon<\/b>

Silent Push Simulation Demonstrates Why Dangling Dns Domains Continue To Pose Global Threats..:

https:\/\/www.silentpush.com\/blog\/danglegeddon\/<\/a>","text_length":168,"media":{"root":"\/012\/axUAAG6CH0QAAAAAGw-6gu2tHYg","webpage":{"url":"https:\/\/www.silentpush.com\/blog\/danglegeddon","type":"photo","title":"Welcome to Danglegeddon","site_name":"Silent Push","display_url":"silentpush.com\/blog\/danglegeddon","description":"Silent Push conducted a simulation of dangling DNS subdomain takeovers; the cascading impact potential could reach global proportions.","author":"Peggy Kelly","thumbs":{"m":{"w":320,"h":180,"hash":"-xDOSINVOvPZ-wW8KpRKtA&ts=1787762070"},"x":{"w":800,"h":450,"hash":"QT5BZHHyghynFP-5Lbd15w&ts=1787762070"},"y":{"w":1030,"h":579,"hash":"TlVO4zketVYOPS9bj8H0Fg&ts=1787762070"},"i":{"bytes":"AXACg|CqeenaomyKmBw1RSYDcirbJQ1x0J5B9KdFgAkjkU0EA8dqVBubH86gpIdgjr+VFPOBx1oqWaIYTnoKaxDDnjFFFasyQ3b0461Migd+aKKhlIAR1oooqDVH\/9k="}}}}},{"channel_id":1142915694,"post_id":5482,"date":1784633830000,"views":"318","text":"ClickLock Stealer: Paste Once, Lose Everything<\/b>

Upon execution of the ClickFix command, the malicious script shows a terminal-based loading animation mimicking Cloudflare progress bar with browser verification flow..:

https:\/\/www.group-ib.com\/blog\/clicklock-stealer-macos-malware\/<\/a>","text_length":281,"media":{"root":"\/003\/ahUAAG6CH0QAAAAAXD-vp9zh0nY","webpage":{"url":"https:\/\/www.group-ib.com\/blog\/clicklock-stealer-macos-malware","type":"photo","title":"ClickLock Stealer: Paste Once, Lose Everything","site_name":"Group-IB","display_url":"group-ib.com\/blog\/clicklock-stealer-macos-malware","description":"Analysis of ClickLock, a modular macOS stealer delivered via ClickFix that uses fake dialogs, kill loops, and a GSocket backdoor to steal passwords, browser data, and crypto wallets.","thumbs":{"m":{"w":320,"h":168,"hash":"YlpCfb2ivJDvcr0JKJGxsQ&ts=1787762070"},"x":{"w":800,"h":420,"hash":"JEq9WUyRMoUwhbzZpyoVCQ&ts=1787762070"},"y":{"w":1280,"h":672,"hash":"QcuQT3bmhpjkxFspmuumkA&ts=1787762070"},"w":{"w":1800,"h":945,"hash":"PKIeziuS8is-pwlR-dC3DQ&ts=1787762070"},"i":{"bytes":"AVACg|DLDgD7in86QnPYClEbkcKTQI3PRTQAsUfmuEHU9KkmtZYfvqQPXtTYxJEwfaRg9a1zcpJGEG0l1yAen40i1sYeKKmlUhyCu0+lFFyvZkQfA6UpkPpRRTMg3E9aeCfXpRRSZtTEJLHJOSfWiiikaH\/\/2Q=="}}}}},{"channel_id":1142915694,"post_id":5481,"date":1784175887000,"views":"182","text":"Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI\/CD Pipelines in Two Repositories

https:\/\/www.stepsecurity.io\/blog\/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm<\/a>","text_length":258,"media":{"root":"\/006\/aRUAAG6CH0QAAAAAufPK_jVvA0Q","webpage":{"url":"https:\/\/www.stepsecurity.io\/blog\/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm","type":"photo","title":"Compromised next Branch Pushes Malicious @asyncapi\/generator, generator-helpers, and generator-components to npm - StepSecurity","site_name":"www.stepsecurity.io","display_url":"stepsecurity.io\/blog\/compromised-next-branch-pushes-malicious-asyncapi-generator-generator-helpers-and-generator-components-to-npm","description":"On July 14, 2026 at 07:10 UTC, three packages in the AsyncAPI generator monorepo (@asyncapi\/generator@3.3.1, @asyncapi\/generator-helpers@1.1.1, and @asyncapi\/generator-components@0.7.1) were published to npm carrying an obfuscated dropper that fires the moment the library is loaded, not on install. The packages were published through the project's own legitimate GitHub Actions release workflow and carry valid npm OIDC provenance attestations, because the attacker didn't steal an npm token: they gained push access to the repository's next branch and let the project's real CI\/CD pipeline do the publishing for them.","thumbs":{"m":{"w":320,"h":214,"hash":"yzq26oIK-HCeGSIqmgaVkw&ts=1787762070"},"x":{"w":800,"h":536,"hash":"3yPOabg4cDoVDzk9-laEAg&ts=1787762070"},"y":{"w":1280,"h":857,"hash":"clHwKF9LpmVHKJ0NZCrNNg&ts=1787762070"},"w":{"w":1992,"h":1334,"hash":"-tm8yF34oaAOmOb-f1kWkQ&ts=1787762070"},"i":{"bytes":"AbACg|DJqWOJ3AYAkfQ0xFyCcp6cmpSmBnMX4MKu4ybYSP8AVKPqDUMsDIu\/Ix7A0bBkDMfP+0KPLySA0XHqwpJobfcgoqSWIqud0Z\/3WBop3JIgCegzQQR1GKAcGjOTzSGG04zg4oAJ6UZOKUcGgAxjrRS9TRVWA\/\/Z"}}}}},{"channel_id":1142915694,"post_id":5480,"date":1784148836000,"forwards":"2","views":"173","text":"Cursor 0day: When Full Disclosure Becomes the Only Protection Left

https:\/\/mindgard.ai\/blog\/cursor-0day-when-full-disclosure-becomes-the-only-protection-left<\/a>","text_length":158,"media":{"root":"\/001\/aBUAAG6CH0QAAAAAmFApNOseCgU","webpage":{"url":"https:\/\/mindgard.ai\/blog\/cursor-0day-when-full-disclosure-becomes-the-only-protection-left","type":"photo","title":"Cursor 0day: When Full Disclosure Becomes the Only Protection Left - Mindgard","site_name":"mindgard.ai","display_url":"mindgard.ai\/blog\/cursor-0day-when-full-disclosure-becomes-the-only-protection-left","description":"The vulnerability nobody seems interested in fixing","thumbs":{"m":{"w":320,"h":112,"hash":"sqs9UthzcIlIh-w5YqHzZQ&ts=1787762070"},"x":{"w":800,"h":281,"hash":"jWMwdSpva0TKMRsrKKs-TQ&ts=1787762070"},"y":{"w":1280,"h":450,"hash":"7j6ymG_Z4_SBcExvZpnyyg&ts=1787762070"},"w":{"w":1748,"h":614,"hash":"nVa7pSe7sF-L9YWX9LdcLQ&ts=1787762070"},"i":{"bytes":"AOACg|DWqlJfGOTJj\/dZIznk46mrtV2s43k3FnwfmKZ+WgAnuhGAEG5sj6AZA\/rSfbofm+98pxwPr\/galkhjlYF1yV96Z9liXG1QoLAn3xyKAJ6KKKAP\/9k="}}}}},{"channel_id":1142915694,"post_id":5479,"date":1783959837000,"views":"165","text":"Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting

https:\/\/zerobec.com\/blog\/inside-forg365-telegram-distributed-sneaky2fa-style-phaas<\/a>","text_length":155,"media":{"root":"\/006\/ZxUAAG6CH0QAAAAAufPK_jVvA0Q","webpage":{"url":"https:\/\/zerobec.com\/blog\/inside-forg365-telegram-distributed-sneaky2fa-style-phaas","type":"photo","title":"Inside Forg365: A Telegram-Distributed Sneaky 2FA-Style PhaaS Targeting Microsoft 365 | ZeroBEC","site_name":"ZeroBEC","display_url":"zerobec.com\/blog\/inside-forg365-telegram-distributed-sneaky2fa-style-phaas","description":"ZeroBEC threat research on Forg365, a Kali365-class Microsoft 365 PhaaS that combines Telegram distribution, AI-assisted lure generation, device-auth phishing, AiTM routing, AntiBot evasion, token vaulting, and a Manifest V3 browser extension (ForgCookie) for persistent Microsoft SSO access.","author":"ZeroBEC Team","thumbs":{"m":{"w":320,"h":180,"hash":"2z7XLQOFlJn4XQmpQAoqsQ&ts=1787762070"},"x":{"w":800,"h":450,"hash":"6WqvRM-imi9HpbQqGfYrHQ&ts=1787762070"},"y":{"w":1280,"h":720,"hash":"IODYMz-qKl5FOvjg3PqivA&ts=1787762070"},"w":{"w":1672,"h":941,"hash":"xIxMNa5dfZfa3erXcvzdsg&ts=1787762070"},"i":{"bytes":"AXACg|ChEkJUb1cn\/ZIpssIyWThR2Y80xQfl5XkE80h5\/u9M0xDVGTTyqhRgc96EXB6jkUuOvtQAwjrRQe9FACA0ZHpRRQA5JChyvWpBcseoU\/VRRRQwshpZfLKgc+tFFFMR\/9k="}}}}},{"channel_id":1142915694,"post_id":5478,"date":1783685104000,"forwards":"1","views":"323","text":"Vishing actors target Entra passkey enrollment (mimics the Microsoft passkey enrollment)<\/b>

The threat actor registers domains that incorporate the word passkey as part of a voice-enabled phishing (\u201cvishing\u201d) scheme. The threat actor then calls targeted users on the phone in an attempt to persuade them that they need to register a new passkey.:

https:\/\/www.okta.com\/en-au\/blog\/threat-intelligence\/vishing-actors-target-microsoft-entra-passkey-enrollment-\/<\/a>","text_length":457,"media":{"root":"\/00e\/ZhUAAG6CH0QAAAAAsnQjnOIMx3M","photo":{"thumbs":{"m":{"w":320,"h":160,"hash":"GwbrYMZr670eQnF3uV-E8g&ts=1787762070"},"x":{"w":800,"h":401,"hash":"QuBnpbDVF91YZ9pp8C2iFQ&ts=1787762070"},"y":{"w":1280,"h":641,"hash":"25X9I0etEaS0Da7C8DjYSw&ts=1787762070"},"i":{"bytes":"AUACg|DXpCwBxg0tG0HBNACb19\/yNKCCuRQwAGducdhTUYtnMbJ9cUAOooooAKKKKACiiigAooooA\/\/Z"}}}}},{"channel_id":1142915694,"post_id":5477,"date":1782970669000,"views":"151","text":"DuneSlide: Two Critical RCE vulnerabilities via Zero-Click Prompt Injection in Cursor IDE

https:\/\/www.catonetworks.com\/blog\/duneslide-two-critical-rce-vulnerabilities\/<\/a>","text_length":168},{"channel_id":1142915694,"post_id":5476,"date":1781866482000,"forwards":"5","views":"277","text":"FortiBleed - Breach How 80,000+ Corporate= Firewalls Were Quietly Compromised<\/b>

If your organization uses a Fortinet firewall or VPN product and appears in this dataset, treat your network perimeter as already compromised and act immediately. SOCRadar rates this campaign Critical<\/b>..:

https:\/\/socradar.io\/blog\/fortibleed-fortinet-firewalls-compromised\/<\/a>","text_length":351,"media":{"root":"\/012\/ZBUAAG6CH0QAAAAAGw-6gu2tHYg","photo":{"thumbs":{"m":{"w":320,"h":187,"hash":"EDgrzqdci65gYXNQ_kgi-Q&ts=1787762070"},"x":{"w":800,"h":468,"hash":"-3Q2UxsILlX_9bmPzSr1sA&ts=1787762070"},"y":{"w":1280,"h":749,"hash":"LB9HYkoQNSOGWogfE5SWjA&ts=1787762070"},"i":{"bytes":"AYACg|DZqte3aWkeTyx6LnrVjABzgZrA1Yk37g9AAB+VNAWIL+WUtuAAHYE\/41pQTLKmRwR1HWsmxs5WhMnADdM96u20Ukc4yvHIJqXua2i4eZe3D3\/KilopmQVXmtIppkldcsvbsfrRRQBNg+lKBiiigYZ56GiiigR\/\/9k="}}}}}]