A new Android malware campaign has emerged, targeting banking customers in Brazil, India, and Southeast Asia, combining contactless fraud via NFC, call interception, and the exploitation of device vulnerabilities. Researchers at ThreatFabric have identified...
The post PhantomCard: The New Android Malware Using NFC to Steal Your Money appeared first on Penetration Testing Tools.
GooFuzz GooFuzz is a script written in Bash Scripting that uses advanced Google search techniques to obtain sensitive information in files or directories without making requests to the web server. GooFuzz performs fuzzing with an OSINT...
The post GooFuzz: enumerate directories, files, subdomains or parameters appeared first on Penetration Testing Tools.
Microsoft has released the seventh preview of .NET 10 (Preview 7), introducing updates to its runtime and frameworks. Among the most notable enhancements are a new wrapper that exposes WebSocket connections through a streaming...
The post .NET 10 (Preview 7): Microsoft Unveils WebSocket Streaming and Passkey Support appeared first on Penetration Testing Tools.
Ransomware operators and infostealers are adapting their tactics more swiftly than enterprises can recalibrate their defenses. Even substantial investments in ransomware resilience—primarily in backups and recovery—are increasingly failing to prevent tangible damage. According to...
The post The Quiet Threat: Why Ransomware and Infostealers Are Succeeding Where Encryption Fails appeared first on Penetration Testing Tools.
Japan has been struck by a new wave of cyberattacks involving CrossC2, a tool that extends the capabilities of Cobalt Strike to Linux and macOS platforms. According to the JPCERT/CC Coordination Center, these attacks...
The post Beyond Windows: How Attackers Are Using CrossC2 to Infiltrate Linux Networks appeared first on Penetration Testing Tools.
CrowdStrike has released its Global Threat Report 2025, documenting a profound shift in the behavior of both cybercriminals and state-sponsored groups. Analysts have described 2024 as “the year of the enterprising adversary”—threat actors are...
The post The AI-Powered Threat: Key Findings from the CrowdStrike Global Threat Report 2025 appeared first on Penetration Testing Tools.
Google has introduced a new requirement for developers of cryptocurrency exchange and wallet applications, mandating that they obtain official government licenses prior to publication. The company explains that this initiative is intended to foster...
The post Google’s New Crypto App Rules: A Game-Changer for a Safer Digital Ecosystem appeared first on Penetration Testing Tools.
Aced Aced is a tool to parse and resolve a single targeted Active Directory principal’s DACL. Aced will identify interesting inbound access allowed privileges against the targeted account, resolve the SIDS of the inbound...
The post aced: parse and resolve a single targeted Active Directory principal’s DACL appeared first on Penetration Testing Tools.
The Trustwave SpiderLabs research team has documented a fresh wave of EncryptHub attacks, in which the human element and the exploitation of a Microsoft Management Console (MMC) vulnerability converge into a single, cohesive campaign....
The post A New Wave of EncryptHub Attacks: How a Microsoft Vulnerability and Social Engineering Collide appeared first on Penetration Testing Tools.
A newly discovered attack on the HTTP/2 protocol, dubbed MadeYouReset, has been unveiled by researchers from Tel Aviv University and disclosed following coordinated reporting through Akamai’s bug bounty program. Although Akamai’s own HTTP/2 implementation...
The post “MadeYouReset”: A New HTTP/2 DDoS Attack Bypasses Rapid Reset Defenses appeared first on Penetration Testing Tools.
The Muddled Libra network—also known as Scattered Spider or Octo Tempest—lacks the rigid hierarchy and centralized control typical of many cybercriminal organizations. Instead, it resembles a loosely connected community of individual threat actors, bound...
The post Muddled Libra: The Evolving Cybercrime Collective That is a “Fool’s Errand” to Predict appeared first on Penetration Testing Tools.
Researchers from University College London and the University of the Mediterranean in Reggio Calabria, Italy, have conducted the first large-scale investigation into privacy practices among generative AI assistants for web browsers, revealing that even...
The post AI Browser Assistants Secretly Harvest Your Data, Study Finds appeared first on Penetration Testing Tools.
Israel’s military intelligence unit, Unit 8200—specializing in cyber-espionage and electronic surveillance—has been using Microsoft’s cloud servers to store a vast archive of data on residents of Gaza and the West Bank. This trove, leveraged...
The post Microsoft Azure Used to Store Vast Trove of Palestinian Surveillance Data, Investigation Reveals appeared first on Penetration Testing Tools.
Google has announced that the protected KVM (pKVM) hypervisor, used within the Android Virtualization Framework, has become the world’s first software component for mass-market consumer electronics to achieve the SESIP Level 5 security certification....
The post Google’s Android Hypervisor Achieves Highest Security Certification for Consumer Electronics appeared first on Penetration Testing Tools.
Microsoft has alerted Windows 11 users to a new false notification that appears after installing the July 2025 preview update and subsequent 24H2 releases. The issue is linked to the CertificateServicesClient (CertEnroll) component and...
The post Microsoft Confirms Harmless Bug in Windows 11 Update That Generates Misleading Error Logs appeared first on Penetration Testing Tools.
Microsoft has released a new video interview with Pavan Davuluri, head of Windows, in which he outlined the company’s vision for the platform’s evolution and the transformative role artificial intelligence will play. When asked...
The post Ambient and Multi-modal”: Windows Head Outlines a Radical AI-Powered Future for the OS appeared first on Penetration Testing Tools.
Fortinet has disclosed a critical vulnerability in its FortiSIEM system, already accompanied by a working exploit circulating publicly. The flaw enables a remote, unauthenticated attacker to execute arbitrary commands on the targeted system, making...
The post Critical FortiSIEM Flaw: Fortinet Urges Immediate Patching as Public Exploit Circulates appeared first on Penetration Testing Tools.
The Matrix Foundation, the organization behind the eponymous federated communication protocol, has announced the release of an unscheduled update addressing two high-severity vulnerabilities which, if successfully exploited, could have had critical consequences. According to...
The post High-Severity Flaws Found in Matrix Protocol, Posing Risk to Government Communications appeared first on Penetration Testing Tools.
Although passkeys are promoted as a passwordless, phishing-resistant, and inherently secure authentication method, Proofpoint researchers warn that such protection can be bypassed with relative ease. Under certain conditions, an attacker can force a user...
The post Passkeys Are Not Phishing-Proof: A New Attack Bypasses Passwordless Security appeared first on Penetration Testing Tools.
Whonix 17.4, a distribution purpose-built for uncompromising anonymity online, has been released. Based on Debian GNU/Linux, the system routes all network traffic exclusively through Tor, with its source code available under the GPLv3 license....
The post Whonix 17.4 Is Here: A New Era of Uncompromising Online Anonymity appeared first on Penetration Testing Tools.
