Experts at Kaspersky Lab have uncovered a new remote access trojan, GodRAT, which is being distributed through .scr files disguised as financial documents. Until March 2025, attackers relied on Skype to deliver the malware,...
The post GodRAT Emerges: A New Remote Access Trojan Poses a Threat to Businesses appeared first on Penetration Testing Tools.
Thailand’s Cyber Police, in collaboration with the local telecom operator AIS, carried out a large-scale operation dubbed “KHAO SAN”, during which two young Thai nationals were arrested for executing tasks on behalf of a...
The post Bangkok’s “Phantom Cell Tower” Busted: Inside the Mobile Phishing Scam appeared first on Penetration Testing Tools.
Palo Alto Networks CEO Nikesh Arora has sounded the alarm over the dawn of a new wave of “browser wars.” Speaking during the company’s Q4 2025 earnings call, he observed that Microsoft, Google, OpenAI,...
The post A New “Browser War” Is Coming: How AI Agents Are Reshaping Cybersecurity appeared first on Penetration Testing Tools.
Apple has released critical security updates for iOS, iPadOS, and macOS addressing a newly discovered zero-day vulnerability already being actively exploited in the wild. Tracked as CVE-2025-43300, the flaw affects the ImageIO framework and...
The post Update Now: Apple Patches Critical Zero-Day Vulnerability Found in the Wild appeared first on Penetration Testing Tools.
Inotiv, a U.S.-based company headquartered in West Lafayette, Indiana, has disclosed a serious cybersecurity incident in a filing with the U.S. Securities and Exchange Commission. On August 8, 2025, the organization detected unauthorized access...
The post Inotiv Under Siege: Ransomware Attack Encrypts Biomedical Research Systems appeared first on Penetration Testing Tools.
The Australian telecommunications provider TPG Telecom has reported a serious security incident affecting the infrastructure of its subsidiary brand iiNet, which offers Australians fixed-line and mobile internet, telephony, and television services. An unidentified attacker...
The post TPG Telecom Data Breach: How One Hack Exposed 300,000 Customers appeared first on Penetration Testing Tools.
A vulnerability in the widely used AI deployment tool Ollama exposed users to the risk of drive-by attacks, enabling malicious actors to surreptitiously interfere with the local application through a specially crafted website. Exploitation...
The post Flawed AI Tool: How a Simple Website Could Have Hijacked Your Ollama App appeared first on Penetration Testing Tools.
A hacker who targeted websites across North America, Yemen, and Israel, stealing the credentials of millions of users, has been sentenced to prison. 26-year-old Al-Taheri Al-Mashriki, from Rotherham, South Yorkshire, was arrested in August...
The post The Spider Team Hacker: How a UK Man Stole 4 Million Passwords appeared first on Penetration Testing Tools.
The United Kingdom has formally accused North Korea of stealing £17 million ($22.8 million) in cryptocurrency from Lykke, a London-registered exchange. The breach forced the platform to suspend operations, cease activity altogether, and ultimately...
The post North Korea’s Digital Heist: The £17M Crypto Theft That Brought Down an Exchange appeared first on Penetration Testing Tools.
The book From Day Zero to Zero Day, published by No Starch Press, has been released, offering a comprehensive introduction to the fundamentals of vulnerability research. The author presented it at DEF CON 33...
The post Beyond the Cookie Jar: Uncovering Privacy Flaws in Google’s New Ad Tech appeared first on Penetration Testing Tools.
Experts at Red Canary have uncovered an unusual campaign leveraging a newly identified strain of malware, DripDropper, specifically targeting cloud-based Linux servers. The attackers gained initial access through CVE-2023-46604 in Apache ActiveMQ, after which...
The post The DripDropper Paradox: Why Attackers Are Patching the Vulnerabilities They Exploit appeared first on Penetration Testing Tools.
The legendary hacker journal Phrack has turned forty, marking the occasion with its anniversary 72nd issue, published on August 19, 2025. Founded in the mid-1980s, this iconic publication is regarded as one of the...
The post Phrack at 40: The Legendary Hacker Zine Celebrates Four Decades of Security and Subversion appeared first on Penetration Testing Tools.
Cybercriminal groups are building entire infrastructures to propagate infostealers—malicious programs designed to steal passwords, payment card details, and other sensitive information from infected devices. Analysts describe what they call the “Stealer Ecosystem,” where the...
The post Inside the “Stealer Ecosystem”: How the Cybercrime Economy Professionalized Data Theft appeared first on Penetration Testing Tools.
SSTImap SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to...
The post SSTImap: About Automatic SSTI detection tool appeared first on Penetration Testing Tools.
exifLooter ExifLooter finds geolocation on all image urls and directories and also integrates with OpenStreetMap. Installation go install github.com/aydinnyunus/exifLooter@latest Exif Looter depends on exiftool, so make sure it is on your PATH. Use Analyze Image...
The post exifLooter: finds geolocation on all image urls and directories also integrates with OpenStreetMap appeared first on Penetration Testing Tools.
BloodHound Attack Research Kit BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on...
The post BARK: BloodHound Attack Research Kit appeared first on Penetration Testing Tools.
Compromising an organization’s cloud infrastructure is like sitting on a gold mine for attackers. And sometimes, a simple misconfiguration or a vulnerability in web applications, is all an attacker needs to compromise the entire...
The post AWSGoat: Damn Vulnerable AWS Infrastructure appeared first on Penetration Testing Tools.
The developers of the Python Package Index (PyPI) have announced the introduction of a new email domain verification mechanism aimed at curbing attacks that exploit expired domains and reducing the risk of package compromise....
The post PyPI Fights Back: New Security Feature Prevents Account Takeovers via Expired Domains appeared first on Penetration Testing Tools.
The Noodlophile malware campaign has entered a new phase, steadily expanding its reach across more countries. Morphisec researcher Shmuel Uzan has reported that attackers have shifted to using phishing emails disguised as copyright infringement...
The post Beyond the Inbox: How a New Phishing Campaign Leverages Copyright Claims to Deliver Noodlophile Malware appeared first on Penetration Testing Tools.
Google, Kairos Power, and the Tennessee Valley Authority (TVA), a federal energy corporation, have entered into an agreement to supply nuclear energy for data centers in the United States. The deal forms part of...
The post The AI-Nuclear Alliance: Google and TVA Partner to Power Data Centers with Next-Gen Reactors appeared first on Penetration Testing Tools.
