BloodHound Attack Research Kit BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on...
The post BARK: BloodHound Attack Research Kit appeared first on Penetration Testing Tools.
Compromising an organization’s cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire...
The post AWSGoat: Damn Vulnerable AWS Infrastructure appeared first on Penetration Testing Tools.
The developers of the Python Package Index (PyPI) have announced the introduction of a new email domain verification mechanism aimed at curbing attacks that exploit expired domains and reducing the risk of package compromise....
The post PyPI Fights Back: New Security Feature Prevents Account Takeovers via Expired Domains appeared first on Penetration Testing Tools.
The Noodlophile malware campaign has entered a new phase, steadily expanding its reach across more countries. Morphisec researcher Shmuel Uzan has reported that attackers have shifted to using phishing emails disguised as copyright infringement...
The post Beyond the Inbox: How a New Phishing Campaign Leverages Copyright Claims to Deliver Noodlophile Malware appeared first on Penetration Testing Tools.
Google, Kairos Power, and the Tennessee Valley Authority (TVA), a federal energy corporation, have entered into an agreement to supply nuclear energy for data centers in the United States. The deal forms part of...
The post The AI-Nuclear Alliance: Google and TVA Partner to Power Data Centers with Next-Gen Reactors appeared first on Penetration Testing Tools.
On a well-known data leak forum, a post has surfaced advertising the sale of a database allegedly containing 15.8 million PayPal accounts, complete with email addresses and plaintext passwords. The seller claims the information...
The post A “15.8 Million” Account Leak? Hackers Claim New PayPal Data Dump, Company Denies Breach appeared first on Penetration Testing Tools.
Washington and London have at last managed to reach an accord on an issue that threatened to escalate into a serious diplomatic and technological conflict. U.S. Director of National Intelligence Tulsi Gabbard announced that...
The post UK Government Drops Demand for iCloud Backdoor appeared first on Penetration Testing Tools.
A serious incident was recently uncovered on Lenovo’s website involving its corporate chatbot, Lena, designed to assist customers. Cybernews researchers revealed that Lena was vulnerable to an XSS-based attack chain, enabling attackers—through nothing more...
The post A Single Prompt Is All It Takes: Lenovo Chatbot Vulnerability Exposes Customers and Staff appeared first on Penetration Testing Tools.
At the beginning of 2025, Trellix specialists uncovered a sweeping cyber-espionage campaign targeting diplomatic missions in Seoul. Between March and July, at least nineteen phishing attacks were recorded, in which North Korean–linked actors impersonated...
The post Inside Kimsuky’s GitHub-Powered Cyber-Espionage Campaign appeared first on Penetration Testing Tools.
TikTok has found itself at the center of a new scandal following an investigation by 404 Media: through TikTok Shop, vast numbers of GPS trackers and covert audio devices are being sold, brazenly advertised...
The post TikTok Shop Is Selling GPS Trackers and Audio Recorders for Stalking Partners appeared first on Penetration Testing Tools.
The HexStrike AI repository has released HexStrike AI MCP Agents v6.0—a powerful framework for automating penetration tests. The system integrates more than 150 security tools and 12 autonomous AI agents operating through the FastMCP...
The post “Automated and Dangerous”: A New AI Framework Can Run 150+ Hacking Tools Autonomously appeared first on Penetration Testing Tools.
In the latest issue of the hacker magazine Phrack, a vast archive has been published detailing the operations of North Korean cybercriminal groups. The leak includes exploitation techniques, information on compromised systems, and a...
The post “A True Nightmare”: Leaked Archive Reveals a Highly Sophisticated Linux Rootkit appeared first on Penetration Testing Tools.
Cybercriminals have discovered a way to weaponize Cisco’s own security mechanisms against its users. Researchers at Raven have documented a credential theft campaign in which attackers learned to exploit Cisco’s Safe Links technology—a tool...
The post The Ultimate Betrayal: How Attackers Are Weaponizing Cisco’s Own Safe Links to Phish Users appeared first on Penetration Testing Tools.
The U.S. Department of Justice has announced the seizure of more than $2.8 million in cryptocurrency from Yanis Alexandrovich Antroppenko, who stands accused of computer fraud and money laundering. Antroppenko is linked to the...
The post DOJ Seizes $2.8 Million in Crypto from Suspected Zeppelin Ransomware Operator appeared first on Penetration Testing Tools.
Researchers at Hunt.io have published an in-depth analysis of the Android banking trojan ERMAC 3.0, uncovering not only its enhanced capabilities but also severe flaws within its infrastructure. This iteration expands upon the functionality...
The post Leaked Source Code Exposes ERMAC 3.0: A Dangerous Trojan with Flawed Security appeared first on Penetration Testing Tools.
Experts at Censys have released their State of the Internet 2025 report, focusing on the infrastructure of cybercriminals—specifically Command-and-Control (C2) servers and other tools used to coordinate attacks and maintain access to compromised systems....
The post The State of Cybercrime: How C2 Servers Fuel the Global Threat appeared first on Penetration Testing Tools.
Groups of cybercriminals specializing in mobile phishing have discovered a new way to profit from stolen credentials. Whereas they once focused on transferring compromised cards into digital wallets and selling them for fraudulent transactions,...
The post Beyond the Email: How New Mobile Phishing Scams Are Causing a “Ramp-and-Dump” Stock Frenzy appeared first on Penetration Testing Tools.
A former moderator of the dark web forum XSS, known by the alias Rehub, has launched his own platform under the name Rehubcom. This move coincides with the arrest of the XSS administrator in...
The post The King Is Dead, Long Live the King: A New Cybercrime Forum Rises from the Ashes of XSS appeared first on Penetration Testing Tools.
The China-linked group UAT-7237 has become the subject of a new report from Cisco Talos. According to researchers, this team has been active since 2022, specializing in long-term persistence within victim infrastructure. In one...
The post Beyond the Firewall: Inside UAT-7237, a Chinese APT Group Targeting Taiwan appeared first on Penetration Testing Tools.
Researchers have demonstrated that the latest Gemini models consistently interpret hidden Unicode Tag characters as executable instructions—rendering invisible text within the interface into direct commands for the AI. This flaw endangers all Gemini-based integrations,...
The post The Invisible Attack: Hidden Characters Can Make Gemini Models Implant Backdoors appeared first on Penetration Testing Tools.
