TikTok has found itself at the center of a new scandal following an investigation by 404 Media: through TikTok Shop, vast numbers of GPS trackers and covert audio devices are being sold, brazenly advertised...
The post TikTok Shop Is Selling GPS Trackers and Audio Recorders for Stalking Partners appeared first on Penetration Testing Tools.
The HexStrike AI repository has released HexStrike AI MCP Agents v6.0—a powerful framework for automating penetration tests. The system integrates more than 150 security tools and 12 autonomous AI agents operating through the FastMCP...
The post “Automated and Dangerous”: A New AI Framework Can Run 150+ Hacking Tools Autonomously appeared first on Penetration Testing Tools.
In the latest issue of the hacker magazine Phrack, a vast archive has been published detailing the operations of North Korean cybercriminal groups. The leak includes exploitation techniques, information on compromised systems, and a...
The post “A True Nightmare”: Leaked Archive Reveals a Highly Sophisticated Linux Rootkit appeared first on Penetration Testing Tools.
Cybercriminals have discovered a way to weaponize Cisco’s own security mechanisms against its users. Researchers at Raven have documented a credential theft campaign in which attackers learned to exploit Cisco’s Safe Links technology—a tool...
The post The Ultimate Betrayal: How Attackers Are Weaponizing Cisco’s Own Safe Links to Phish Users appeared first on Penetration Testing Tools.
The U.S. Department of Justice has announced the seizure of more than $2.8 million in cryptocurrency from Yanis Alexandrovich Antroppenko, who stands accused of computer fraud and money laundering. Antroppenko is linked to the...
The post DOJ Seizes $2.8 Million in Crypto from Suspected Zeppelin Ransomware Operator appeared first on Penetration Testing Tools.
Researchers at Hunt.io have published an in-depth analysis of the Android banking trojan ERMAC 3.0, uncovering not only its enhanced capabilities but also severe flaws within its infrastructure. This iteration expands upon the functionality...
The post Leaked Source Code Exposes ERMAC 3.0: A Dangerous Trojan with Flawed Security appeared first on Penetration Testing Tools.
Experts at Censys have released their State of the Internet 2025 report, focusing on the infrastructure of cybercriminals—specifically Command-and-Control (C2) servers and other tools used to coordinate attacks and maintain access to compromised systems....
The post The State of Cybercrime: How C2 Servers Fuel the Global Threat appeared first on Penetration Testing Tools.
Groups of cybercriminals specializing in mobile phishing have discovered a new way to profit from stolen credentials. Whereas they once focused on transferring compromised cards into digital wallets and selling them for fraudulent transactions,...
The post Beyond the Email: How New Mobile Phishing Scams Are Causing a “Ramp-and-Dump” Stock Frenzy appeared first on Penetration Testing Tools.
A former moderator of the dark web forum XSS, known by the alias Rehub, has launched his own platform under the name Rehubcom. This move coincides with the arrest of the XSS administrator in...
The post The King Is Dead, Long Live the King: A New Cybercrime Forum Rises from the Ashes of XSS appeared first on Penetration Testing Tools.
The China-linked group UAT-7237 has become the subject of a new report from Cisco Talos. According to researchers, this team has been active since 2022, specializing in long-term persistence within victim infrastructure. In one...
The post Beyond the Firewall: Inside UAT-7237, a Chinese APT Group Targeting Taiwan appeared first on Penetration Testing Tools.
Researchers have demonstrated that the latest Gemini models consistently interpret hidden Unicode Tag characters as executable instructions—rendering invisible text within the interface into direct commands for the AI. This flaw endangers all Gemini-based integrations,...
The post The Invisible Attack: Hidden Characters Can Make Gemini Models Implant Backdoors appeared first on Penetration Testing Tools.
A team of researchers has unveiled a new framework, SNI5GECT, which exposes vulnerabilities in fifth-generation mobile networks at the very earliest stages of connection establishment. Unlike attacks that rely on counterfeit base stations—complex to...
The post SNI5GECT: A New Framework Exposes Major Vulnerabilities in 5G Networks appeared first on Penetration Testing Tools.
A security researcher named Wayne has unveiled a new tool for Windows 11 that circumvents the PatchGuard protection mechanism in the system’s latest release (24H2). The project, called Kurasagi, has already been published on...
The post New Tool Bypasses Windows 11 PatchGuard, Opening a New Debate on Security appeared first on Penetration Testing Tools.
Researchers at Cymulate Research Labs have disclosed a new vulnerability in Windows that allows attackers to bypass Microsoft’s recent patch and once again exfiltrate NTLM hashes without any user interaction. The flaw, tracked as...
The post The Patch Isn’t a Fix: New Flaw Lets Attackers Steal NTLM Hashes from Windows appeared first on Penetration Testing Tools.
Microsoft has introduced a new mechanism known as Nested App Authentication (NAA), which is steadily becoming a key component of the company’s cloud ecosystem. The concept is straightforward: if a user has already signed...
The post Nested App Authentication: Microsoft’s New Feature Is a Double-Edged Sword for Azure Security appeared first on Penetration Testing Tools.
monkey365 Monkey365 is an Open Source security tool that can be used to easily conduct not only Microsoft 365 but also Azure subscriptions and Azure Active Directory security configuration reviews without the significant overhead...
The post monkey365: conduct Microsoft 365, Azure subscriptions and Azure Active Directory security configuration reviews appeared first on Penetration Testing Tools.
SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection “Error based” by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. The...
The post SQLiDetector: detect SQL injection Error based appeared first on Penetration Testing Tools.
The APT-C-36 group (Blind Eagle) intensified its operations in May 2025, focusing attacks on Colombian government institutions and major corporations, as well as on organizations in other South American countries, including Ecuador, Chile, and...
The post Beyond Phishing: A Closer Look at Blind Eagle’s New, More Stealthy Attacks appeared first on Penetration Testing Tools.
The British company Stock in the Channel (STIC), which provides a digital platform for monitoring the availability and pricing of IT equipment, has reported a cyberattack that caused a large-scale disruption of its services....
The post Zero-Day Attack Takes Down Stock in the Channel, Disrupting IT Supply Chain appeared first on Penetration Testing Tools.
The first release of the Linux 6.17 kernel has arrived—yet it contains no updates related to the bcachefs file system. And the reason lies not in technical shortcomings. On August 10, Linus Torvalds announced...
The post The “Human Factor”: Why a Next-Gen Linux Filesystem Is on the Ropes appeared first on Penetration Testing Tools.
