Decipher
All stories
Every story since Decipher went independent.
- 188
- stories
- OCT 27
- latest
Everything · page 9
Three Takeaways From the EU Airport Outages
The incident is a pointed example of how an intrusion at a key point in the software supply chain can have a wide range of downstream effects.
Dennis Fisher · 2 min
Mac Malware Campaign Uses Fake GitHub Pages, LastPass Lure
LastPass researchers who found the “ongoing, widespread” campaign said that it involves two fake GitHub pages that deliver the Atomic Stealer malware.
Lindsey O'Donnell-Welch · 3 min
Russian APT Groups Turla, Gamaredon Collaborate to Target High-Profile Ukrainian Entities
In a new report, ESET researchers have detailed several instances when the two groups’ tools have been found on the same compromised machines in Ukraine.
Dennis Fisher · 3 min
Two British Teens Charged Over Scattered Spider Hacks
Two British teenagers have been arrested by UK authorities for their alleged ties to the Scattered Spider cybercriminal collective.
Lindsey O'Donnell-Welch · 3 min
Microsoft, Cloudflare Disrupt RaccoonO365 Phishing Kit Service
Microsoft and Cloudflare this week announced that they paired up to disrupt RaccoonO365, a phishing-as-a-service cybercriminal enterprise.
Lindsey O'Donnell-Welch · 3 min
New Automated npm Attack Campaign Targets Dozens of Packages
The campaign does not appear to be connected to the previous npm phishing attacks, but it does seem to be related to a rash of GitHub and npm token and secret thefts from the end of August.
Dennis Fisher · 3 min
Senator Flags Microsoft’s Role in the Ascension Ransomware Hack
Sen. Ron Wyden (D-Ore.) wants the U.S. government to hold Microsoft responsible “for contributing to ransomware attacks against critical U.S. infrastructure” like Ascension.
Lindsey O'Donnell-Welch · 2 min
US Indicts LockerGoga, MegaCortex, Nefilim Ransomware Admin
The Justice Department has charged a Ukrainian national who is behind ransomware attacks of at least 200 U.S. companies tied to LockerGoga, MegaCortex, and Nefilim.
Lindsey O'Donnell-Welch · 3 min
Attack Compromises Popular NPM Packages
The affected packages include Chalk and Debug, and one of the contributors to those packages said the compromise was the result of him clicking on a phishing email related to setting up 2FA on his account.
Dennis Fisher · 4 min
Wyden Slams Federal Judiciary After Court Hack
In a scathing letter, Sen. Ron Wyden (D-Ore.) blasted the federal judiciary for its handling of a (second) hack of the federal courts’ case management system earlier this year.
Lindsey O'Donnell-Welch · 3 min
Cloudflare Details Salesloft Drift Breach
This incident is the latest to stem from an intrusion at Salesloft in which attackers used OAuth tokens to target Salesloft customers’ Salesforce integrations.
Dennis Fisher · 3 min
Decipher is Everyone
We’re optimists, and that’s reflected in the mission statement we coined when we first launched in 2018: Security without fear.
Dennis Fisher · 2 min
UNC6395 Expands Data Theft Campaign to Email OAuth Tokens
Google researchers discovered the new attacks and are advising all customers to treat any authentication tokens for those integrations as compromised.
Dennis Fisher · 2 min
US Gov Links Private Chinese Firms to Salt Typhoon Hacks
Salt Typhoon has not been observed exploiting zero-day flaws, but instead targeting known bugs in exposed network edge devices – some of which are years old.
Lindsey O'Donnell-Welch · 3 min
Citrix CVE-2025-7775 Under Active Attack
The vulnerability (CVE-2025-7775) is a buffer overflow that can lead to remote code execution and attackers were already targeting it before the public disclosure.
Dennis Fisher · 2 min
DoJ Seizes $2.8M Linked to Zeppelin Ransomware
The DoJ raked back $2.8 million in crypto, as well as cash and a stolen vehicle, belonging to an alleged operator of the Zeppelin ransomware.
Lindsey O'Donnell-Welch · 2 min
CISA, Microsoft Warn of Exchange CVE-2025-53786 Risk
CISA has issued an emergency directive regarding the recently disclosed and somewhat weird vulnerability in Microsoft Exchange hybrid deployments (CVE-2025-53786), ordering all civilian federal agencies to address the flaw by Aug. 11.
Dennis Fisher · 2 min
The Emerging Ecosystem Dedicated to AI Accountability
A new ecosystem of security researchers is emerging, looking to sniff out data security and privacy issues in AI systems and grappling with issues like a lack of transparency into and understanding of LLMs.
Lindsey O'Donnell-Welch · 7 min
Attacks Hit Possible SonicWall Zero Day
Attackers are exploiting a likely zero day vulnerability in some versions of SonicWall Firewall devices with the SSL VPN functionality enabled, and in some cases are able to bypass MFA protections. The intrusions have been ongoing since at least the end of last week, and researchers have observed some attackers deploying the Akira ransomware after…
Dennis Fisher · 2 min
New PXA Stealer Campaign Hits Victims Worldwide
A group of attackers with ties to the Vietnamese cybercrime underground ecosystem are running a significant campaign across many different countries that is delivering the PXA Stealer malware and uses novel sideloading and anti-analysis techniques to slip past defensive measures. The campaign has targeted victims in more than 60 countries and the attackers have harvested…
Dennis Fisher · 2 min
