The RedTeam Tribune Threat Desk is the part of the RedTeam Tribune newsroom that covers attacks, malware, scams and the groups behind them. It is a newsroom desk, not a single person. Sections: Cyber Attacks, Malware & Ransomware, Threat Intelligence. Stories start from more than 150 monitored sources. Drafts are prepared with AI assistance and checked by software against the cited sources before they are published. It has published 31 articles so far. See the editorial policy or report an error.
Cisco Talos reports that malicious actors abused legitimate email pipelines from Staples and Dell to push victims toward fraudulent phone numbers, bypassing traditional email security checks.
Startup alleges repeated attempts to steal driving AI model and access user devices originated from competitor's infrastructure.
Homeland Security mandates purging DeepSeek tools and affiliated third-party software from government networks due to data tracking risks.
Attackers use CVE-2026-0257 to bypass VPN security controls and deploy ransomware across multiple industries, according to Unit 42 reports.
Threat intelligence reveals two domains mimicking Google Meet to steal login details and 2FA codes, while an exposed install page leaks database configuration.
Anthropic’s coding assistant detected an unauthorized cryptocurrency miner consuming significant CPU resources during a routine application development task on macOS.
Federal data show senior fraud losses hit $3 billion in 2025, with investment schemes driving a sharp surge in reported financial harm.
Enterprise users can now prove human identity via iris scans and selfie checks to counter AI-generated video fraud on Zoom calls.
The FBI warns that fraudsters are using AI deepfakes and fake donation sites to steal data and money before November elections.
Attackers hijacked update servers to push malware, gaining remote control of PCs through tampered download instructions during brief windows.
Anthropic’s model identified standard random number generators as the source for public cryptographic parameters, resolving a long-standing mystery about their origins.
Huntress confirms attackers abused vendor credentials to access Microsoft 365 data across 162 tenants using broad backup application permissions.
An AI model solved a 25-year mystery regarding NIST elliptic curve parameters, showing they used a standard random number generator rather than hidden inputs.
Attackers used a stolen vendor API secret to access 173 Microsoft 365 environments, bypassing user authentication through a trusted backup application.
Ukrainian drone attacks on three Yandex facilities in Russia forced the cloud provider into emergency operations and disrupted national digital services.
Attackers exploited a missing-authentication flaw in FortiManager to steal credentials for hundreds of downstream firewalls, deploying the PEERSTITCH implant to maintain stealthy access.
Attackers used a missing-auth flaw and path traversal to deploy memory-resident malware on FortiGate firewalls, stealing configs and credentials.
A Windows trojan sold on hacking forums for $150 monthly grants attackers webcam access, keylogging and password theft capabilities through a modified NjRAT base.
Citizen Lab researchers reveal how mercenary spyware infected Al Jazeera devices simply by displaying targeted advertisements, requiring no user interaction.
Silent Lynx used a WinRAR flaw and phishing lures to deploy reverse shells, granting remote access to government systems across nine CIS nations.
OpenAI leadership advised employees on operational security measures to counter potential espionage risks, including honey pots and insider threats, according to reports.
Android users in India face credential theft as GhostBat RAT uses fake traffic fines to install malware that steals PINs from dozens of financial apps.
Experimental Linux kernel patches designed to improve memory performance contain a race condition that could expose unwritten data.
Automated coding agents can expose secrets by moving credentials from secure storage into logs and external model inputs during routine tasks.