Decipher
All stories
Every story since Decipher went independent.
- 186
- stories
- OCT 20
- latest
Everything · page 3
Researchers Find New GhostApproval Bug in Many AI Coding Assistants
The bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links.
Dennis Fisher · 4 min
Chinese APT UAT-7810 Expands Malware Arsenal
The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.
Dennis Fisher · 2 min
DoJ: Alleged Scattered Spider Member Extradited to US
19-year-old Peter Stokes is one of several to be arrested for their alleged participation in Scattered Spider.
Lindsey O'Donnell-Welch · 2 min
Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
Dennis Fisher · 2 min
New Turla Stockstay Backdoor Emerges
Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.
Dennis Fisher · 2 min
Targeting Cybercrime ‘Assembly Lines:’ Europol Announces Malware Crackdown
As part of the takedown, SocGholish infrastructure tied to fake browser-update scams was heavily impacted, including remediation of nearly 15,000 compromised WordPress sites.
Lindsey O'Donnell-Welch · 2 min
macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts
Gaslight is a Rust-based backdoor that researchers from SentinelOne have attributed to DPRK-aligned threat actors.
Dennis Fisher · 3 min
FortiBleed Credential Theft Campaign Marches On
The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.
Dennis Fisher · 2 min
Mastra AI Hit By npm Compromise
The unknown threat actor gained unauthorized access to legitimate npm accounts, allowing them to inject malicious dependencies into widely used packages.
Dennis Fisher · 2 min
Oracle Zero-Day Linked to Latest ShinyHunters Attacks
“Because this activity predates Oracle’s June 10, 2026 advisory, the vulnerability was exploited as a zero-day,” said Mandiant researchers.
Lindsey O'Donnell-Welch · 2 min
Anthropic Warns of LLMs’ Impact on (Already Shrinking) N-Day Exploit Gap
Anthropic researchers warned that modern AI tools are further intensifying the existing issue of threat actors creating N-day exploits.
Lindsey O'Donnell-Welch · 4 min
The Ugly Roots of the Surveillance State
We’ve arrived at a point where billions of us have opted in to types of surveillance that would have caused massive demonstrations just a couple of decades ago.
Dennis Fisher · 1 min
Check Point VPN Flaw Targeted by Ransomware Actors
The vulnerability is a critical one and Check Point Research said that it’s likely that the actor targeting the bug is a financially motivated group.
Dennis Fisher · 2 min
New Shai Hulud Variant Hits Red Hat npm Packages
Researchers said that they found a Red Hat employee’s GitHub account had been compromised and was used by threat actors to push malicious orphan commits directly to several repositories.
Lindsey O'Donnell-Welch · 3 min
The Past is Always Present in Vulnerability Disclosure
Microsoft’s reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.
Dennis Fisher · 4 min
FBI: Silent Ransom Group Turns to IT Support Ploy
The Silent Ransom Group, a data exfiltration and extortion actor, started posing as IT teams via phone calls and phishing emails sent to legal sector firms.
Lindsey O'Donnell-Welch · 2 min
Coordinated Takedown Cripples Glassworm Malware Network
The disruption, which was a joint effort among CrowdStrike, Google, and the Shadowserver Foundation, targeted Glassworm’s C2 architecture, which was deliberately engineered for extreme resilience.
Dennis Fisher · 3 minAuthorities Disrupt First VPN Cybercriminal Service
Law enforcement is increasingly targeting the “infrastructure layer” of cybercrime, rather than ransomware operators themselves.
Lindsey O'Donnell-Welch · 2 minGitHub Confirms Internal Breach
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
Dennis Fisher · 3 min
Data Shows Thousands of Automatic Tank Gauges Exposed Across the US
As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.
Dennis Fisher · 2 min
