EvilBit Threat Digest - Turning the Tables: When Deception Becomes Defense

Newsletter on Resecurity's honeypot win, FortiWeb 0-day exploitation, and Chinese Office Assistant supply chain browser plugin attack.

EvilBit Threat Digest - New Year Breaches and Phishing at Scale

KryptoKat analyzes Coupang's 33.7M-record insider breach, GlassWorm's macOS pivot with Solana C2, Silver Fox tax-themed phishing in India, and Intellexa sanctions reversal.

ZeroDay Field Notes - New Year, Same Threat Actors: Supply-Chain Mayhem and APT Innovation

React/Next.js exploits compromise 59K servers, browser extensions steal $7M in crypto, and APT groups deploy kernel rootkits for stealthy persistence.

EvilBit Threat Digest - When Databases Leak and Developers Click: The Final Week of 2025

The threat landscape is ending the year with a bang rather than a whimper. We're seeing critical memory disclosure in one of the world's most popular databases, a ransomware group that's essentially become an industry unto itself, and supply-chain attacks have us jumping at every bump in the night.

EvilBit Threat Digest - When Your Browser and Build Pipeline Become the Backdoor

Supply-chain attacks target Maven Central with Cobalt Strike, Firefox extensions hide malware in PNG pixels, and APT groups weaponize DNS to hijack software updates.

ZeroDay Field Notes - When Your Firewall Becomes the Backdoor

Critical WatchGuard RCE exploited in the wild, 59K Next.js servers compromised, cross-platform APT36 campaigns, and code-signed macOS malware bypassing Gatekeeper.

EvilBit Threat Digest - When the Bots Come Knocking: Record DDoS, State Actors, and the Week in Malware

Record 29.7 Tbps DDoS botnet, fresh APT campaigns, mobile and browser malware, and OAuth device code phishing—what defenders must do now.

EvilBit Threat Digest - This Week in Security: Burning Platforms and Broken Trust

Fortinet and Cisco zero-days, React RCE, Kimwolf botnet, Node.js malware, parked domain abuse, NuGet typosquat, and new Nessus plugins.

ZeroDay Field Notes - Sleep Tight: SROP Obfuscation and the Rise of Local AI Exploitation

Two offensive tools to watch: SROP-based sleep obfuscation for Linux implants and a local AI auto-exploitation push, with defenses and caveats.

EvilBit Threat Digest - Multiple Actors, Multiple Platforms, Multiple Headaches

React2Shell exploitation surges, Android trojans and WhatsApp GhostPairing spread, 700Credit breach hits millions, new stealers and APT ops.

EvilBit Threat Digest - This Week in Security: React Like You Mean It

React2Shell RCE slams Next.js as threat actors pivot to BYOVD ransomware, eBPF rootkits, Teams scams, VS Code trojans, and OT bruteforce attacks.

ZeroDay Field Notes - React2Shell: From Theory to Practice in 72 Hours

React2Shell exploited within hours; patch now. Active Gladinet attacks persist. Malware tradecraft and AI-assisted reverse engineering insights.