Grivyonx Intelligence Hub
Zero-days, ransomware, data breaches and active exploitation, explained with practical defence advice.
A new threat campaign called Offside Wallet Theft Factory uses 40 malicious Firefox extensions disguised as popular Web3 products to steal cryptocurrency wallet credentials. Security researchers at Socket Threat Report have identified these extensions as part of a larger network affecting over 77 browser add-ons.
By Gourav Rajput
Researchers have uncovered a critical vulnerability in Elementor Pro that enables unauthorized file uploads and remote code execution. This high-severity flaw, trackable as CVE-2026-32475, threatens WordPress sites using the plugin. Grivyonx Cloud offers automated security solutions to mitigate such threats.
By Gourav Rajput
Researchers discovered a remote Spectre attack that leaked JWT tokens from Cloudflare Workers at an astonishing rate of 12 bits per second—a dramatic increase over a similar 2021 incident, highlighting fresh risks in containerized environments.
By Gourav Rajput
A sophisticated Chinese-nexus threat actor identified as SilkParasite has initiated a targeted cyber espionage campaign against organizations in Central Asia. The campaign leverages spear-phishing techniques combined with an array of remote access trojans (RATs), demonstrating advanced operational capabilities and strategic intent.
By Gourav Rajput
A newly identified espionage operation dubbed SilkParasite has been observed targeting government bodies across Central Asia. The campaign leverages seven remote access tool families, five of which have never been documented before.
By Gourav Rajput
Cybersecurity researchers at Hunt.io revealed a coordinated assault on more than 14,500 Dahua surveillance devices between June 17 and July 22, 2026. Using stolen credentials, authentication‑bypass exploits, and a peer‑to‑peer relay strategy, attackers gained control over thousands of cameras. The investigation, dubbed Operation CameraSwarm, was pieced together from a 407 MB exposed directory containing 2,616 files, providing unprecedented insight into the attackers’ tactics and the scale of the breach.
By Gourav Rajput
The U.S. Cybersecurity and Infrastructure Security Agency has flagged four newly discovered flaws in macOS, SharePoint, vCenter, and Microsoft IKE as actively exploited. Administrators are urged to apply patches immediately to mitigate risk.
By Gourav Rajput
Microsoft Defender Experts have mapped a sprawling infrastructure of over 30 rotating domains tied to MacSync Stealer, a macOS-targeting information stealer. The attribution relied on correlating persistent endpoint and network behaviors across shifting infrastructure, revealing the full kill chain from initial payload retrieval to final data exfiltration.
By Gourav Rajput
Cybersecurity researchers have uncovered a sophisticated web shell deployment targeting PTC Windchill and FlexPLM servers through critical vulnerabilities. This specialized attack platform is designed specifically for enterprise Product Lifecycle Management systems, enabling threat actors to map sensitive engineering data and decrypt credentials for potential extortion schemes.
By Gourav Rajput
A newly identified zero-click flaw in GitLab has sent ripples through the DevSecOps community. The lack of technical specifics makes it particularly difficult for organizations to defend themselves.
By Gourav Rajput
The new docuseries titled 'Declassified' pulls back the curtain on the lives of chief information security officers, revealing a mix of daring cyber thefts, personal upheavals, and the relentless pressure that can end careers. Through candid interviews and behind‑the‑scenes footage, the series shows how multimillion‑dollar breaches, marital strain, and burnout intersect with the high‑stakes world of modern security leadership.
By Gourav Rajput
A group calling itself Ransom Busters has started reaching out to organizations hit by ransomware, promising to purge stolen information from the attackers' infrastructure in exchange for a payment ranging from $20,000 to $60,000. The tactic has raised eyebrows among researchers, who see it as an unusual third‑party intervention in a crisis.
By Gourav Rajput
A ransomware group has begun masquerading as legitimate incident‑recovery providers, offering victims assistance while secretly rerouting ransom payments to their own accounts. This deceptive approach not only undermines trust in recovery services but also complicates law‑enforcement efforts to trace illicit funds. Organizations must now remain vigilant against sophisticated social‑engineering tactics that blur the line between help and exploitation.
By Gourav Rajput
A newly discovered campaign exploits common typing errors when installing RubyGems packages, deploying a Windows‑based information stealer that siphons browser credentials and crypto wallet information. Researchers have identified multiple deceptive package names, each designed to mimic legitimate gems.
By Gourav Rajput
SafePal has confirmed a significant data breach affecting nearly 40,000 customers after an authorization flaw in their order-tracking plugin exposed sensitive personal information. The hardware wallet manufacturer notified affected users via email on August 16, detailing the scope of exposed data including names, shipping addresses, phone numbers, and purchase histories.
By Gourav Rajput
Researchers uncovered two critical bugs in Unisoc cellular modems that, when combined, enable attackers to hijack Android video calls by delivering a malicious payload during a call. The attack chain exploits a SIP validation flaw and a buffer‑overflow in audio processing, granting full device control without requiring additional user interaction.
By Gourav Rajput
A high-severity vulnerability has been discovered in GitLab's GraphQL implementation, posing a significant risk to public projects and user data integrity.
By Gourav Rajput
Cybersecurity researchers at Wiz have uncovered a critical GitHub Actions workflow injection vulnerability in Snowflake's public repository. The flaw, found in the snowflakedb/snowflake-connector-net repository, could be exploited by submitting a specially crafted GitHub issue to execute arbitrary commands within workflows containing sensitive internal Jira credentials. This discovery highlights the growing risks associated with automated CI/CD pipelines and third-party integrations in modern software development environments.
By Gourav Rajput
