News

PG·AHAttackers hijack country-code domains to impersonate Google and other services

According to Google , attackers compromised infrastructure behind three country-code domain namespaces— .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and other organizations. These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere. This wasn’t a break in encryption, and Google’s systems weren’t compromised. Instead, attackers manipulated the internet’s addr

TW·U1UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing

Cisco Talos identified an advanced persistent threat (APT) spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility. The phishing emails exhibited highly consistent structure, rhetoric, and personalization patterns, suggesting the threat actor likely used AI-assisted content generation to rapidly customize invitation lures f

APAC·PSThe Psychedelic Stealer: When a CAPTCHA Becomes an Installer

A Ukrainian-branded ClickFix lure, a Russian-branded traffic panel, and victims from 32 countries across Europe, the Americas and Asia-Pacific. Summary Arctic Wolf Labs is tracking an ongoing campaign that compromises legitimate Ukrainian business websites and uses injected iframes to display a Ukrainian-language fake Cloudflare verification page. When a visitor interacts with the page, the lure … The Psychedelic Stealer: When a CAPTCHA Becomes an Installer Introduction to Malware Binary Triage

CN·HNHuWang—“Protect the Network”: Inside China’s Largest Nationwide Live-Fire Cyber Exercise

Every year, tens of thousands of Chinese organizations spend weeks bracing for an attack that could come at any hour, from any direction, with no advance warning of when or how – standing watch around the clock to defend their networks. The exercise is known as HuWang Operation (护网行动, hù wǎng , literally “protect the network”), or simply HW. Organized by the Ministry of Public Security (MPS), HW has evolved from a limited pilot covering “some important industries” into an annual nationwide stres

CN·WCWidening the Circle of Chinese Hacker Group QTFY: ELEX's Intelligence Client List and Lexbell's PLA Contracts

On August 26, 2026, the FBI, NSA, and U.S. Cyber Command’s Cyber National Mission Force released a joint cybersecurity advisory on China-linked hacking group QTFY, attributing it to Nanjing Xinjiuwei Network Technology Co. (XJW) (南京鑫玖维网络科技有限公司). Since at least 2018, QTFY has allegedly developed malicious tooling, traded malware and exploits within freelance hacking networks, established and maintained an obfuscation botnet, and targeted a wide range of U.S. government and critical-infrastructure