⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Google Cloud Security explores how active ADFS signing keys can be recovered through machine DPAPI, enabling the Golden SAML attack technique first described in 2017. The research highlights that this persistence method remains a significant threat to federated identity environments.
This article details how manually rotated ADFS certificates can leave active signing keys exposed in Machine DPAPI, creating 'ghost' certificates. Attackers can exploit these to forge SAML tokens without touching LSASS or the live ADFS service.
This article details a new attack vector where manually rotated ADFS certificates leave active signing keys exposed in Machine DPAPI, creating 'ghost certificates.' Attackers can extract these certificates to forge high-privilege SAML tokens, bypassing MFA and other controls, while avoiding monitored components like LSASS.
In Q1 2026, Kaspersky reported a continued decline in cyber threats targeting industrial control system (ICS) computers, with only 19.6% of systems affected—the lowest rate in three years. Regional variations were significant, with Africa experiencing the highest attack rate (27.4%) and Northern Europe the lowest (9.1%).
In Q1 2026, the percentage of ICS computers with blocked malicious objects dropped to 19.6%, the lowest in three years, according to Kaspersky's report. Regional variations were significant, with Africa experiencing the highest rate (27.4%) and Northern Europe the lowest (9.1%).
A WhatsApp scam is spreading via compromised accounts, tricking users into authorizing malicious linked devices. Attackers send seemingly harmless messages—often from known contacts—asking victims to vote in fake contests (e.g., ballet, dog competitions).