Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, large language models have reshape
2026-07-02 归档
今日共收录 1714 条安全情报，包含 914 个 CVE，384 篇安全通告，以及 113 篇研究论文。
← 返回归档列表Unmasking the crawls with Attribution Business Insights
Cloudflare’s new Attribution Business Insights dashboard helps website owners understand crawler behavior, appetite, and
Medtronic notifies customers impacted by ShinyHunters data breach
Healthcare device firm Medtronic is notifying affected customers about a data breach that exposed their personal data to
Kubota says hackers had month-long access to network systems
Kubota North America Corporation disclosed that hackers had access to some of its network systems for more than a month
New ChocoPoC malware targets researchers via trojanized PoC exploits
Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan
DHS confirms hackers breached HSIN info-sharing platform
The Department of Homeland Security is investigating a cyberattack that compromised the Homeland Security Information Ne
Webinar: Why traditional email security is no longer enough
Modern phishing, business email compromise, and account takeover attacks increasingly exploit trusted identities and leg
Hackers target Microsoft 365 accounts with 81 million login attempts
An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attem
Turning Indicators into Intelligence in OpenCTI with Criminal IP
Threat intelligence is only as useful as the context behind it. Criminal IP explains how its integration enriches threat
Over 900 Oracle E-Business instances exposed to ongoing attacks
Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critic
Microsoft fixes GIF functionality in the Windows Emoji Panel
Microsoft has fixed the GIF functionality in the Emoji Panel for Windows 11 users after the provider shut down its servi
Adobe patches seven max severity ColdFusion, Campaign flaws
Adobe has released security patches for seven maximum-severity vulnerabilities in the ColdFusion web app development pla
AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android
Cybersecurity researchers have flagged a new malware artifact generated using DeepSeek that constructed a novel attack p
Dawnguard Raises $6.3 Million for Security Architecture Automation Platform
The company has publicly launched its solution to help organizations design, build, and operate secure cloud systems. Th
Massive Password Spray Campaign Targeting Azure CLI
Hackers were seen making over 81 million login attempts originating from systems associated with hosting provider LSHIY.
Forensic Trajectory Signatures for Agent Memory Poisoning Detection
本文提出了一种基于行为轨迹签名的LLM代理内存投毒攻击检测方法。作者发现在持久化内存投毒攻击场景下，存在一个行为不变性：在通过可观察的内存工具调用检索路由信息的架构中，成功的攻击必须依次调用 `memory_recall_fact` 和 `
Certified Speculative Execution for Untrusted AI Agents
该论文针对非可信AI代理（如大型语言模型或学习策略）在硬约束序列决策系统中的计算资源分配问题，提出了一种名为“证书门控前缀接受”（Certificate-Gated Prefix Acceptance, CGPA）的认证推测执行框架。核心挑
On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting
本文研究LLM驱动的Web Agent（基于大语言模型的自动化浏览器代理）的检测问题。自2023年以来，这类新型机器人能够自动化复杂网络任务，超越传统Selenium等工具，通过模仿人类行为甚至绕过多重反机器人机制。然而，网站管理员难以区分
Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detection
该论文首次系统性地探索了大型语言模型（LLM）在代码漏洞检测中受到认知启发（cognitive heuristics）影响的现象。作者设计了一个可控框架，保持代码本身不变，仅改变周围上下文来触发三种认知启发：晕轮效应（通过作者归属）、框架效
Antaeus: Hunting Repository-Level Logic Vulnerabilities via Context-Grounded LLM Reasoning
本文提出 Antaeus，一个基于仓库级代码上下文的大语言模型（LLM）推理框架，用于检测逻辑漏洞。与内存安全等可通过既定安全属性表达的漏洞不同，逻辑漏洞需要推断应用特定的安全不变量和关于预期行为的隐含假设，现有基于 LLM 的漏洞检测器（