Latest security news

[This is a Guest Diary by Aaron Ng, an ISC intern as part of the SANS.edu BACS program]

The new document appears to be part of a broader shift by the US government towards the proactive disruption of cyber threat actors

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Trezor warned customers on Wednesday that threat actors who breached its third-party email provider are targeting them in phishing attacks.

The high-severity, unauthenticated vulnerability tracked as CVE-2025-25249 was patched in January 2026.

A phishing campaign routes victims through genuine Microsoft OAuth and Teams infrastructure before showing them a fake login page built entirely inside their own browser, according to researchers at Barracuda. “Instead of delivering a phishing page from a web server, the malicious content is assembled inside the victim’s browser using a blob URL — a temporary browser-generated URL that points to content stored locally in memory rather than on a website,” researchers explained. The attack … More →

About a week ago, Proxmox published an advisory revealing a vulnerability in older versions of Proxmox VE, its flagship Virtual Environment product. The vulnerability only affects version 7, which has not been supported for a couple of years now.

ClickFix campaign uses browser-injected JavaScript and Google Sheets to steal cryptocurrency

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.