5+ hour, 44+ min ago   (367+ words) Rescana Technical Analysis of Malware/TTPs The attack chain began with the automated mass-download of 1.8 million Android APKs from multiple app stores using a distributed pipeline orchestrated on ten AWS EC2 instances. The APKs were decompiled and scanned for hardcoded secrets…...

1+ week, 23+ hour ago   (772+ words) rescana.com Large-Scale Phishing Campaign Uses Invisible Unicode and ActiveCampaign to Evade Email Security Filters A newly identified, large-scale phishing campaign is actively exploiting invisible Unicode characters to bypass traditional email security filters, sending millions of malicious emails globally. This…...

1+ week, 1+ day ago   (299+ words) The breach demonstrates a pattern of targeting CI/CD platforms for supply chain compromise, credential theft, and lateral movement. The lack of timely patching, even by the vendor, highlights the importance of rapid vulnerability management in environments with access to…...

1+ week, 1+ day ago   (517+ words) Rescana Active Exploitation Alert: North Korean APTs Deploy Ted Backdoor in Compromised HAProxy Builds to Hijack Web Traffic Technical Analysis of Malware/TTPs The Ted backdoor is not a vulnerability in the official HAProxy codebase, but rather a malicious plugin…...

2+ week, 1+ day ago   (126+ words) Indicators of compromise include anomalous minting or burning of tokens, transactions involving vesting accounts with balances wrapping to 2^256, and the rapid creation and exploitation of vesting accounts. The exploit contracts were deployed to precomputed addresses and immediately used to trigger…...

3+ week, 3+ day ago   (698+ words) Rescana Active Exploitation of MLflow SSRF Vulnerability (CVE-2026-64849) Enables Cloud Credential Theft and Account Compromise A critical vulnerability has been identified and is being actively exploited in MLflow, a widely used open-source platform for managing the machine learning lifecycle. The…...

3+ week, 6+ day ago   (392+ words) The exposure of service accounts and privileged users provides attackers with a roadmap for subsequent social engineering, spear-phishing, and privilege escalation attacks. The structured nature of the data enables highly targeted Business Email Compromise (BEC) and impersonation campaigns, as attackers…...

3+ week, 6+ day ago   (371+ words) This workflow was triggered on the issues: opened event, allowing any GitHub user to initiate it. The vulnerability originated from a change introduced in commit 094038e and merged via PR #1218 on June 18, 2026. The change replaced a previously safe pattern using environment…...