Boost global trust with ISO 27001 Certification

Talk to an Expert
>

Threat Intelligence

Daily Cybersecurity Threat Coverage With Actionable Response Context

Fresh analysis on breaches, active exploitation, phishing campaigns, and security trends, tied back to concrete response steps and the right FemtoSec service path.

Need help validating your exposure?

If a similar threat could impact your environment, FemtoSec can help you validate exposure, prioritize response, and strengthen controls before it becomes an incident.

Book a free risk assessment

Services

Penetration Testing
Vulnerability Management
Dark Web Monitoring
Attack Surface Management
Red Team Operations
Smart Contract Auditing
Source Code Review
AI Agentic Pentesting
Security Awareness

Solutions

For Enterprise
For Government
For Finance
For Web3
For Healthcare
For SMEs

Platform

CyberSec365
Compliance Hub
ISO 27001 Certification

Resources

Threat Intelligence
Security Training
vCISO Services
Blog

Free Tools

Dark Web Scanner

Company

Careers
Contact

Threat Intelligence | Femto Security

Filters

Narrow the feed by threat type and severity.

Category

Category

Severity

Severity

AI Commerce Platform Zero-Day Breach Analysis

highvulnerability

AI Commerce Platform Zero-Day Breach Analysis

August 28, 2026 · pwnforums.st

A threat actor has claimed the exfiltration of 25 million records and 14 GB of internal data from conversational commerce platform bitbybit Studio, allegedly exploiting an unpatched zero-day vulnerability in public-facing infrastructure.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

data breachzero-day vulnerabilityconversational ai

Black Nevas Ransomware Targets Omani Enterprise

highransomware

Black Nevas Ransomware Targets Omani Enterprise

August 19, 2026 · ctyfftrjgtwdjzlgqh4avbd35sqrs6tde4oyam2ufbjch6oqpqtkdtid.onion

A confirmed ransomware attack by the Black Nevas group has targeted Oman-based conglomerate OTE Group. The threat actors claim to have exfiltrated sensitive organizational data, signaling a rising risk to critical enterprise supply chains and automotive distributors across the GCC region.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

ransomwareblack nevasoman

ZXCHECKER Malware Exploits Cryptographic Seed Phrases

highmalware

ZXCHECKER Malware Exploits Cryptographic Seed Phrases

August 19, 2026 · forum.exploit.in

A threat actor on the Exploit forum is selling ZXCHECKER, a multi-chain cryptocurrency wallet validator designed to check balances across BTC, LTC, DOGE, DASH, and ETH. Discover the threat profile, technical attack chain, and steps to protect enterprise keys.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

cyber attackzxcheckermalware

SafePal Customer Data Leak Highlights E-Commerce Security

highdata breach

SafePal Customer Data Leak Highlights E-Commerce Security

August 17, 2026 · SafePal

A critical web-facing vulnerability in a third-party order-tracking plugin has exposed the personal information and physical shipping addresses of 39,798 hardware wallet users, raising severe secondary threat vectors including high-precision spear-phishing and regional social engineering campaigns.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

Data BreachWeb SecurityBOLA

Securing APIs Against BOLA: The Click to Pray Leak

highvulnerability

Securing APIs Against BOLA: The Click to Pray Leak

August 11, 2026 · allaboutcookies.org

A critical security flaw in the Vatican's Click to Pray application exposed the personal data of over 700,000 global users. This analysis highlights the technical details of the BOLA vulnerability, the registration hash leak, and practical steps to detect and prevent automated database harvesting.

Relevant FemtoSec Service

Penetration Testing

Validates exploitable weaknesses across applications, APIs, networks, and infrastructure.

data breachapi securityidor

Qilin Supply Chain Attack Exposes Loyalty Program Data

highsupply chain

Qilin Supply Chain Attack Exposes Loyalty Program Data

August 11, 2026 · dutchnews.nl

A critical third-party supply chain cyberattack by the Qilin ransomware group against CEVA Logistics has exposed customer shipping data from downstream enterprises, including ING Bank. Discover the key attack vectors, technical implications, and robust mitigation strategies to defend your logistics perimeter.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

supply-chain-attackqilin-ransomwaredata-breach

MyBB Plugin SQL Injection Zero-Days Sold on Dark Web

highvulnerability

MyBB Plugin SQL Injection Zero-Days Sold on Dark Web

August 9, 2026 · breached.su

An underground threat actor is actively selling two unauthenticated SQL injection zero-day vulnerabilities affecting widely used MyBB plugins with over 20,000 downloads. Learn the technical mechanics of the threat, the attack chain, and actionable detection strategies to secure your forum infrastructure.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

mybbsqlizero-day

Storm Ransomware Targets Exposed RMM Infrastructure

highransomware

Storm Ransomware Targets Exposed RMM Infrastructure

August 9, 2026 · yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion

The Storm ransomware group (Storm-1175) has targeted exposed remote monitoring and management (RMM) consoles to gain administrative network control within 24 hours. By exploiting vulnerability CVE-2026-18577 in N-able N-central, the threat actors establish persistence, exfiltrate data, and deploy ransomware.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

ransomwarestorm-1175cve-2026-18577

Anonymous Mobile RAT v6 Analysis

highmalware

Anonymous Mobile RAT v6 Analysis

August 6, 2026 · xforums.st

Underground threat actors have announced the release of Anonymous Mobile RAT v6, an advanced Android Remote Access Trojan designed to capture credentials, record screens, and abuse accessibility settings, creating severe risks for enterprise mobile security.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

mobile securityandroid malwareremote access trojan

Keyv npm Worm Poisons Hundreds of Downstream Packages

criticalsupply chain

Keyv npm Worm Poisons Hundreds of Downstream Packages

August 5, 2026

A devastating self-propagating npm supply chain worm has compromised over 800 packages, including the keyv library. The malware targets developer tools, exfiltrates AWS and Kubernetes secrets, and installs a destructive dead-man's switch.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

npmsupply-chainkeyv

Everest Ransomware Group Extorts Rx Networks Inc

highransomware

Everest Ransomware Group Extorts Rx Networks Inc

July 31, 2026 · everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion

The Everest ransomware group has compromised Canadian telecommunications provider Rx Networks Inc, claiming to have exfiltrated 321 GB of corporate data. Discover the deep technical mechanics of Everest's attack chain, defense evasion, hostile Wake-on-LAN sweeps, and enterprise detection rules.

Relevant FemtoSec Service

Attack Surface Management

Continuously discovers exposed assets, misconfigurations, and internet-facing risks.

ransomwareeverestdata-exfiltration

Oracle PeopleSoft Zero-Day Hack Exposed Employee Records

criticaldata breach

Oracle PeopleSoft Zero-Day Hack Exposed Employee Records

July 28, 2026 · securityweek.com

Exploit scripts targeting enterprise resource planning applications have compromised personal records of employees in North and South America, following a zero-day attack on Oracle PeopleSoft systems. Discover the technical attack chain, from initial deserialization flaws to automated lateral propagation.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

cyber attackdata breachzero-day

Adobe PDF Reader DLL Sideloader Offered on Exploit Forum

highmalware

Adobe PDF Reader DLL Sideloader Offered on Exploit Forum

July 27, 2026 · forum.exploit.in

A commercial Adobe PDF Reader DLL sideloader is currently being advertised on the Exploit.in underground forum. The tool is engineered to bypass Microsoft SmartScreen and Google Chrome protections, leveraging legitimate Adobe binaries to achieve defense evasion and execute malicious payloads within enterprise networks.

Relevant FemtoSec Service

Red Team Operations

Simulates advanced adversaries to test detection, response, and organizational resilience.

cyber attackadobe pdf reader dll sideloadermalware

Zero-Day Exploit Compromises Diplomatic Academy Server

highdata breach

Zero-Day Exploit Compromises Diplomatic Academy Server

July 27, 2026 · chosun.com

An online learning management system belonging to a diplomatic academy was breached via a zero-day authentication bypass exploit. Threat actors maintained persistent access for ten months, compromising the personal data of 10,000 diplomatic personnel, including encrypted passwords and email addresses.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

data breachzero-day exploitdiplomatic security

Alleged PagBank Breach Exposes 10 Billion Transactions

highdata breach

Alleged PagBank Breach Exposes 10 Billion Transactions

July 26, 2026 · pwnforums.st

An alleged data breach targeting Brazilian payment gateway and digital banking platform PagBank has surfaced on underground forums. A threat actor claims to possess a database containing information related to 10 billion transactions, highlighting the growing cybersecurity risks facing the fintech sector.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

data breachfintechbanking security

Aura Drainer Toolkit-Threat Analysis

highmalware

Aura Drainer Toolkit-Threat Analysis

July 26, 2026 · forum.exploit.in

Cryptocurrency assets across EVM, TRON, TON, and XRP networks face heightened exposure following the public sale of the Aura Drainer toolkit on underground crime forums. This Drainer-as-a-Service threat utilizes social engineering and smart contract abuse to bypass wallet security controls.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

aura drainercryptocurrency drainerweb3 phishing

BEC Phishing Attack Exposes Patient and Veteran Card Data

highphishing

BEC Phishing Attack Exposes Patient and Veteran Card Data

July 26, 2026 · cyberdaily.au

A localized business email compromise at an Australian healthcare provider has exposed sensitive patient communications and Department of Veterans' Affairs (DVA) ID numbers from an active shared mailbox. Learn how credential-harvesting attacks bypass legacy controls and how to secure cloud email environments.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

data breachbusiness email compromisehealthcare security

BTMOB RAT v4.6 Mobile Malware Threat Analysis

highmalware

BTMOB RAT v4.6 Mobile Malware Threat Analysis

July 25, 2026 · forum.exploit.in

Defenders prioritizing mobile endpoint integrity must immediately audit Android Accessibility Service authorizations to counter BTMOB RAT v4.6. This technical analysis explores the malware's delivery vectors, capabilities like 2FA bypass, and step-by-step containment protocols.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

btmob rat v4.6malwaremobile security

Krybit Ransomware Targets Delhi Heart and Lung Institute

highransomware

Krybit Ransomware Targets Delhi Heart and Lung Institute

July 25, 2026 · krybitxdpxohsmjooeb3gbgpmdddreh6mnflzac6bnezz74b7yje67yd.onion

The Delhi Heart and Lung Institute has fallen victim to a major breach by the Krybit ransomware syndicate. The threat actors claim to have exfiltrated 22 GB of sensitive hospital, patient, employee, and corporate data, threatening public release within a short four-day window.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

ransomwarekrybithealthcare-security

DarkSword iOS Exploit Kit Source Code Leaked Online

highmalware

DarkSword iOS Exploit Kit Source Code Leaked Online

July 24, 2026 · forum.exploit.in

The full-chain DarkSword iOS exploit kit source code has been leaked on an underground forum. We analyze the technical mechanics of the multi-stage execution framework, its in-memory implants, and critical containment steps for enterprise environments.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

malwareexploit kitios security

Exploiting Trust Wallet: QR-Code Multi-Chain Drainer Threat

highmalware

Exploiting Trust Wallet: QR-Code Multi-Chain Drainer Threat

July 23, 2026 · forum.exploit.in

A sophisticated cryptocurrency drainer targeting Trust Wallet users on Tron, Ethereum, and Solana is being commercialized on Exploit.in. Utilizing deep link abuse and ERC-20 approval exploitation, this tool allows threat actors to bypass standard warnings and drain corporate virtual asset wallets.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

malwarecryptocurrency-drainertrust-wallet-exploit

SARA Node.js Android Ransomware Code Leaked on Forum

highransomware

SARA Node.js Android Ransomware Code Leaked on Forum

July 22, 2026 · breached.su

The source code for SARA, a Node.js-based Android ransomware tool, has been distributed on underground hacking forums. Discover how this lightweight malware exploits legacy Android permission models and learn critical containment procedures to safeguard enterprise mobile assets.

Relevant FemtoSec Service

Vulnerability Management

Discovers, prioritizes, and tracks known vulnerabilities across your environment.

sara-ransomwareandroid-malwarenode-js-malware

Inside the 300M Database Leak: Infostealer Log Exposure

highdata breach

Inside the 300M Database Leak: Infostealer Log Exposure

July 22, 2026 · darkforums.ru

An alleged 300-million-user database leak highlights the growing threat of repackaged infostealer logs on the dark web. While promoted as a direct corporate breach, research shows the data stems from distributed endpoint infections, exposing enterprises to intense credential stuffing and session hijacking risks.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

Data BreachInfostealersCredential Stuffing

New Phishing Kits Evade MFA to Hijack Microsoft 365 Accounts

highphishing

New Phishing Kits Evade MFA to Hijack Microsoft 365 Accounts

July 21, 2026 · ascarding.net

Technical analysis of Jalisco and OmegaLord, two advanced phishing kits designed to exploit the OAuth 2.0 Device Authorization Grant and bypass multi-factor authentication, leading to rapid SaaS data exfiltration within minutes of initial access.

Relevant FemtoSec Service

Dark Web Monitoring

Detects leaked credentials, breach exposure, and underground mentions before they escalate.

phishingoauth-abusemfa-bypass