ZeroDay Field Notes - Your Firewall is a Liar, and Your IDE is a Snitch

Fortinet firewalls compromised despite patches, malicious VS Code AI extensions steal code from 1.5M developers, and phishing kits exploit trusted cloud platforms.

EvilBit Threat Digest - Kernel Rootkits Get a Cloud-Native Upgrade

VoidLink malware compiles custom kernel rootkits on-demand, plus critical n8n and WordPress vulnerabilities, DLL side-loading campaigns, and more threats analyzed.

EvilBit Threat Digest - The Deserialization Blues

Critical RCE flaws in Sitecore, HPE OneView, and Magento face active exploitation. Plus: OAuth phishing tricks, RMM tool abuse, and new cloud-native Linux malware.

ZeroDay Field Notes - When Your Build Path Becomes Your Fingerprint

Weekly analysis of evasion and OPSEC failures: hardware-breakpoint AMSI bypass, unstripped Rust build paths ('Jacob'), cloud-native VoidLink, and markdown exfil.

EvilBit Threat Digest - When Tables Become Traps and Trust Turns Toxic

Attackers weaponize trust with HTML QR phishing, multi-stage AsyncRAT, fake Fortinet VPNs, OAST campaigns, LLM SSRF, SSH and RMM abuse.

EvilBit Threat Digest - EvilBit Threat Digest: The Walls Have AI Ears

Knownsec leak exposes Chinese cyber-espionage tools, npm supply-chain attacks use blockchain C2, malicious Chrome extensions steal AI chats, and WhatsApp becomes a worm vector.

ZeroDay Field Notes - When Package Managers Become Trojan Horses and AI Safety Gets Weaponized

Offensive-focused notes on npm supply chain backdoors, Pyarmor stealth stealers, socially engineered RATs, GRU phishing, and weaponized AI safety.

EvilBit Threat Digest - Turning the Tables: When Deception Becomes Defense

Newsletter on Resecurity's honeypot win, FortiWeb 0-day exploitation, and Chinese Office Assistant supply chain browser plugin attack.

EvilBit Threat Digest - New Year Breaches and Phishing at Scale

KryptoKat analyzes Coupang's 33.7M-record insider breach, GlassWorm's macOS pivot with Solana C2, Silver Fox tax-themed phishing in India, and Intellexa sanctions reversal.

ZeroDay Field Notes - New Year, Same Threat Actors: Supply-Chain Mayhem and APT Innovation

React/Next.js exploits compromise 59K servers, browser extensions steal $7M in crypto, and APT groups deploy kernel rootkits for stealthy persistence.

EvilBit Threat Digest - When Databases Leak and Developers Click: The Final Week of 2025

The threat landscape is ending the year with a bang rather than a whimper. We're seeing critical memory disclosure in one of the world's most popular databases, a ransomware group that's essentially become an industry unto itself, and supply-chain attacks have us jumping at every bump in the night.

EvilBit Threat Digest - When Your Browser and Build Pipeline Become the Backdoor

Supply-chain attacks target Maven Central with Cobalt Strike, Firefox extensions hide malware in PNG pixels, and APT groups weaponize DNS to hijack software updates.