🚨 Watch out as the new #PS1Bot malware steals crypto wallets, passwords, and sensitive data, spreading through #malvertising while evading detection. Read: hackread.com/malvertising... #CyberSecurity #Malware #Crypto #Keylogger

New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In-Memory Attacks thehackernews.com/2025/08/new-... via @thehackernews.bsky.social

Excited to announce that we just published our research into "PS1Bot" a multi-stage PowerShell-based modular malware framework being delivered via malvertising campaigns that we've been tracking throughout 2025. Check it out! blog.talosintelligence.com/ps1bot-malve... #malware #stealer

You Wouldn’t Download A Skateboard?

Attacker Specialization Puts Threat Modeling on Defensive www.darkreading.com/threat-intel...

Researchers Unveil New Mechanism to Track Compartmentalized Cyber Threats gbhackers.com/new-mechanis...

Attack kill chains are evolving, and defenders must, too. In this two-part blog, Talos examines how threat actors are working together like never before, and proposes an extension to the Diamond Model: http://cs.co/63324NVHbE

Huge thanks to @vertexproject.bsky.social for updating Synapse to support the new "relationship" context. We’re excited to see this research foster collaboration and push real change across the threat intelligence community. (3/3)

In blog 2, we dive into the challenges of investigating compartmentalized campaigns. We share our approach to identifying them and propose an extended Diamond Model with a new "relationship" layer to close the analytical gaps. (2/3) blog.talosintelligence.com/compartmenta...

📡 New blogs out: Compartmentalized attacks are no longer limited to financially motivated actors, state-sponsored groups are adopting them too. We propose a new taxonomy for initial access groups to reflect broader motivations and affiliations. (1/3)

In addition, we have also published a blog proposing an extension to the Diamond Model to support more accurate and comprehensive threat modeling support for compartmentalized intrusion sets. Check it out too! blog.talosintelligence.com/compartmenta...

Excited to announce that Asheer Malhotra, @ashl3y-shen.bsky.social, @vventura.bsky.social and I just published a new blog on how initial access groups are changing and propose a new taxonomy to support the latest threats that we are seeing. Check it out! blog.talosintelligence.com/redefining-i...

Come catch @infosec-nick.bsky.social and I in DC this coming week to talk compartmentalized intrusions!

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools blog.talosintelligence.com/spam-campaig...

Excited to announce that @infosec-nick.bsky.social and I will be presenting on compartmentalization in cyber threats at the CTA TIPS conference next month! Come check it out!

Come join us at the Ask A Security Expert session at Black Hat Asia on April 4th! I'll be there with Orange Tsai, Ryan Flores, and Dr. Marina Krotofil answering your cybersecurity questions. Submit your topics in advance using the form on the event page. Looking forward to seeing you there!

Physical Key Copying Starts With A Flipper Zero hackaday.com/2025/03/25/p...

Introducing: abuse.ch Hunting Platform abuse.ch/blog/introdu...

We are now hosting the DOGE contact list locally. www.2600.com/content/2600...

I am really proud and humbled for being accepted at Pivot on. This was a team effort with @ashl3y-shen.bsky.social , @b4n1shed.bsky.social and Asheer Malhotra

Honored and excited to be speaking at @pivotcon.bsky.social again this year! 🎉 Huge shoutout to the co-authors @_vventura, @b4n1shed.bsky.social and @asheermalhotra —couldn’t have done this research without you! Looking forward to seeing everyone in Málaga. This year I must join the Karaoke!😆

5 Things You Must Check Before Selling On eBay, Facebook Or Etsy www.forbes.com/sites/zakdof...

Just published a new blog on many of the threats and scams targeting sellers on online marketplaces like Ebay, Reverb, etc. along with recommendations for people using these platforms. Check it out! #phishing #infosec

They posted SECRET//NOFORN documents on their site related to IC headcount. Those of you reading this who have held a clearance know what a colossal no-no this is.

Scoop: The databases powering DOGE.gov are insecure, and people outside the government have already pushed their own updates to the site to prove it: www.404media.co/anyone-can-p...

REPOST if you support our federal workforce and know how dedicated they are to their jobs. Show them you appreciate them!

DOGE as a National Cyberattack www.schneier.com/blog/archive...

EFF Sues OPM, DOGE and Musk for Endangering the Privacy of Millions www.eff.org/press/releas...

The U.S. sanctioned #Zservers -- a Russian bulletproof hosting service used to facilitate ransomware attacks by #LockBit therecord.media/zservers-rus...

We can boycott companies for abandoning diversity goals, but we also need to celebrate the ones who stand firm by their diversity goals, like Cisco. Cisco is leading by example here, be more like Cisco.

Google Cloud Platform Data Destruction via Cloud Build blog.talosintelligence.com/gcp-data-des...

35% Year-over-Year Decrease in Ransomware Payments, Less than Half of Recorded Incidents Resulted in Victim Payments www.chainalysis.com/blog/crypto-... #infosec #crimeware #cybercrime #ransomware #malware

The Lost Story of Alan Turing's Secret "Delilah" Project spectrum.ieee.org/alan-turings...

Everyone knows your location: tracking myself down through in-app ads via timsh timsh.org/tracking-mys... #infosec #privacy #surveillance

Browser Syncjacking: How Any Browser Extension can Be Used to Takeover Your Device by Engineering labs.sqrx.com/browser-sync... #infosec #threathunting #dfir #malware

Operation Talent: FBI Seizes Nulled[.]to, Cracked[.]to, Sellix[.]io and more hackread.com/operation-ta... #malware #infosec #threatintel #cti

Small reminder: Some of the best, most precious artifacts during a chaotic time are the absolutely rushed, blasted-out and then much later rescinded/removed PDFs that entities make. Government, corporate, you name it. I've always found those PDFs are so rare but so easily kept in the moment.

Prompt Injection Tricks AI Into Downloading And Executing Malware #malware #infosec #ai hackaday.com/2025/01/26/p...

"The threat actors repeatedly leveraged remote services to facilitate lateral movement within the network. Their activity began with the deployment of SystemBC and GhostSOCKS proxy tools to a domain controller." 🌟New report out Monday, January 27th by @r3nzsec, @MyDFIR & @MittenSec!

A Network Threat Hunter’s Guide to C2 over QUIC www.activecountermeasures.com/a-network-th... #malware #c2 #infosec

First posts are hard - stick with the classics.

Super excited to share research that we just published related to activity associated with #TA866 #AsylumAmbuscade since 2021 as well as links to recent #WarmCookie/#BadSpace activity. Check it out! blog.talosintelligence.com/highlighting...

Just published our latest research into a series of ongoing malware campaigns abusing Google Cloud Run to distribute the #Astaroth #Mekotio & #Ousaban banking trojans, primarily across LATAM. Check it out!

Just published my latest research related to an an open source infostealer called #SapphireStealer and related malware activity over the course of 2023. Check it out! blog.talosintelligence.com/sapphirestea...

Not all Top Level Domains are created equal. Some TLDs do some pretty strange things in DNS. blog.talosintelligence.com/whats-in-a-n...

Talos Threat Hunters are the front lines of #cybersecurity. They actively keep businesses, countries, and the whole internet safer. 💻🌎🔐 Discover how Talos identifies new and evolving threats in the wild, and how their intel helps organizations build strong defenses.

It's downright disrespectful of Billboard create a list of "Top 50 Greatest Rap Groups Of All Time" and rank Geto Boys at #28 *behind* DJ Jazzy jeff & the Fresh Prince...