Sign in Subscribe
InfoSources
InfoSources is a cybersecurity intelligence briefing focused on cybercrime, cyberwarfare, and digital espionage. Trusted by decision-makers worldwide.

Featured articles

A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

North Korea just made its malware payload host itself on the blockchain- 252

North Korea just made its malware payload host itself on the blockchain- 252

The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

China-Linked CL-STA-1062 Shifts From Taiwan to Critical Infrastructure Across Southeast Asia- 249

China-Linked CL-STA-1062 Shifts From Taiwan to Critical Infrastructure Across Southeast Asia- 249

The Microsoft bug leaker treating vulnerability disclosure as a countdown- 248

The Microsoft bug leaker treating vulnerability disclosure as a countdown- 248

When "unauthorized AI app" becomes an SEC disclosure category of its own- 247

When "unauthorized AI app" becomes an SEC disclosure category of its own- 247

The worm that infects the tools developers trust to catch it- 246

The worm that infects the tools developers trust to catch it- 246

A malware sample built for single-core Windows XP may be the first cyberweapon ever found- 245

A malware sample built for single-core Windows XP may be the first cyberweapon ever found- 245

ClawSwarm proves you can hijack an AI agent without writing a single line of malware- 244

ClawSwarm proves you can hijack an AI agent without writing a single line of malware- 244

Ten months later, nobody knows why Huawei routers took down Luxembourg's phone network- 243

Ten months later, nobody knows why Huawei routers took down Luxembourg's phone network- 243

THORChain's breach is a rounding error in 2026's record year for crypto theft- 242

THORChain's breach is a rounding error in 2026's record year for crypto theft- 242

Operation Ramz shows where Southeast Asia's scam compounds go when they get shut down- 241

Operation Ramz shows where Southeast Asia's scam compounds go when they get shut down- 241

Turla's botnet redesign is about surviving disruption, not just evading detection- 240

Turla's botnet redesign is about surviving disruption, not just evading detection- 240

Three times through the same door: FamousSparrow's patient campaign against Azerbaijan's energy sector- 239

Three times through the same door: FamousSparrow's patient campaign against Azerbaijan's energy sector- 239

Device code phishing didn't need new code — it needed a legitimate Microsoft login flow- 238

Device code phishing didn't need new code — it needed a legitimate Microsoft login flow- 238

London's police made 700,000 data requests last year. Nobody had to ask a judge- 237

London's police made 700,000 data requests last year. Nobody had to ask a judge- 237

Europe wrote the rules for surveillance exports, then left its own member states to enforce them-236

Europe wrote the rules for surveillance exports, then left its own member states to enforce them-236

The FTC just proved a settlement can end a data broker's harm without ending its punishment- 235

The FTC just proved a settlement can end a data broker's harm without ending its punishment- 235

An unclaimed breach at a critical drug-packaging supplier tests healthcare's newest fault line- 234

An unclaimed breach at a critical drug-packaging supplier tests healthcare's newest fault line- 234

A single breach at Foxconn just exposed how concentrated the electronics supply chain really is- 233

A single breach at Foxconn just exposed how concentrated the electronics supply chain really is- 233

When a ransomware gang gets ransomware'd: what The Gentlemen's leak reveals about the RaaS economy- 232

When a ransomware gang gets ransomware'd: what The Gentlemen's leak reveals about the RaaS economy- 232

WannaCry at nine years: the day a stolen NSA tool became a lesson in negligence- 231

WannaCry at nine years: the day a stolen NSA tool became a lesson in negligence- 231

Poland's Signal exodus reveals a pattern too consistent to call coincidence- 230

Poland's Signal exodus reveals a pattern too consistent to call coincidence- 230

The offense-defense balance in cyber has a shelf life, and CNAS just estimated it- 229

The offense-defense balance in cyber has a shelf life, and CNAS just estimated it- 229

The Fed's financial stability survey just put a name to what markets have been pricing quietly- 228

The Fed's financial stability survey just put a name to what markets have been pricing quietly- 228

Mythos becomes a regulatory event before it becomes a household name- 227

Mythos becomes a regulatory event before it becomes a household name- 227

The UK's AI Security Institute just watched the offensive capability clock start speeding up- 226

The UK's AI Security Institute just watched the offensive capability clock start speeding up- 226

The UK's NCSC just told the world its technical debt bill is coming due- 225

The UK's NCSC just told the world its technical debt bill is coming due- 225

Taiwan's rail hack proves the threshold for infrastructure disruption has collapsed- 221

Taiwan's rail hack proves the threshold for infrastructure disruption has collapsed- 221

From Signatures to Behavior: How Real-Time AI Attacks Disrupted Global Cyber Defense- 224

From Signatures to Behavior: How Real-Time AI Attacks Disrupted Global Cyber Defense- 224

Google's GTIG report confirms AI has crossed from cybercrime convenience to zero-day creation- 223

Google's GTIG report confirms AI has crossed from cybercrime convenience to zero-day creation- 223

CISA's CI Fortify quietly concedes that eviction alone has failed- 222

CISA's CI Fortify quietly concedes that eviction alone has failed- 222

A university researcher just proved a city's EV chargers can be switched off with one script- 220

A university researcher just proved a city's EV chargers can be switched off with one script- 220

Two years of silence: what South Staffordshire Water's fine reveals about detection failure- 219

Two years of silence: what South Staffordshire Water's fine reveals about detection failure- 219

Poland's water utilities become the latest target in Russia's shadow campaign- 218

Poland's water utilities become the latest target in Russia's shadow campaign- 218

Iran's ransomware proxies and the collapse of the line between crime and state power- 217

Iran's ransomware proxies and the collapse of the line between crime and state power- 217

Beijing's Deniable Army: A Breach in Rome and a Warrant in Washington- 216

Beijing's Deniable Army: A Breach in Rome and a Warrant in Washington- 216

Belarus's Oldest Digital Weapon Returns to Kyiv- 215

Belarus's Oldest Digital Weapon Returns to Kyiv- 215

The ShinyHunters Playbook: One Extortion Crew, Four Industries, One Spring- 214

The ShinyHunters Playbook: One Extortion Crew, Four Industries, One Spring- 214

MuddyWater's Double Game: Iran's Cyber Unit Trades Precision for Reach- 213

MuddyWater's Double Game: Iran's Cyber Unit Trades Precision for Reach- 213

The Bilateral Cyber War: APT28's Persistent Reach and Ukraine's Offensive Doctrine- 212

The Bilateral Cyber War: APT28's Persistent Reach and Ukraine's Offensive Doctrine- 212

From Disruption to Destruction: Russia's Escalating War on European Infrastructure- 211

From Disruption to Destruction: Russia's Escalating War on European Infrastructure- 211

The 8200 Pipeline: How Israel's Military Intelligence Became the Architecture of Global Cybersecurity- 210

The 8200 Pipeline: How Israel's Military Intelligence Became the Architecture of Global Cybersecurity- 210

North Korea's Two-Tier Crypto War: Precision Heists and Industrial Harvesting- 209

North Korea's Two-Tier Crypto War: Precision Heists and Industrial Harvesting- 209

When Cyberspace Became the Last Battlefield: Iran's Digital War and Its Limits- 208

When Cyberspace Became the Last Battlefield: Iran's Digital War and Its Limits- 208

Proprietary by Design: The Ransomware Ecosystem's Shift Toward Custom Tooling- 207

Proprietary by Design: The Ransomware Ecosystem's Shift Toward Custom Tooling- 207

The Student Who Stopped the Trains: TETRA, SDR, and the Infrastructure Vulnerability Nobody Fixed- 206

The Student Who Stopped the Trains: TETRA, SDR, and the Infrastructure Vulnerability Nobody Fixed- 206

Patient by Design: FrostyNeighbor's Return and the Human Operator as Evasion Mechanism- 205

Patient by Design: FrostyNeighbor's Return and the Human Operator as Evasion Mechanism- 205

The Convenience Trap: How Rentable IoT Became a City-Scale Attack Surface- 203

The Convenience Trap: How Rentable IoT Became a City-Scale Attack Surface- 203

The Worm in the Toolchain: How TeamPCP Built a Credential Extraction Economy Inside Open Source- 201

The Worm in the Toolchain: How TeamPCP Built a Credential Extraction Economy Inside Open Source- 201

Identity at Risk: The ANTS Breach and France's Digital Public Service Exposure- 200

Identity at Risk: The ANTS Breach and France's Digital Public Service Exposure- 200

The Long Game: How China's Cyber Harvest Became a Western Intelligence Priority- 199

The Long Game: How China's Cyber Harvest Became a Western Intelligence Priority- 199

The Art of Looking Innocent: Iran's Dual-Track Tradecraft Evolution- 198

The Art of Looking Innocent: Iran's Dual-Track Tradecraft Evolution- 198

Grey Zone Britain: The NCSC's Doctrinal Shift at CYBERUK 2026- 197

Grey Zone Britain: The NCSC's Doctrinal Shift at CYBERUK 2026- 197

The Extortion Machine: How ShinyHunters Engineered the Pay-or-Leak Economy- 196

The Extortion Machine: How ShinyHunters Engineered the Pay-or-Leak Economy- 196

The Shadow Economy: Pig-Butchering and the Industrialization of Trust Fraud- 195

The Shadow Economy: Pig-Butchering and the Industrialization of Trust Fraud- 195

The Discovery Gap: How AI Is Breaking the Economics of Cybersecurity- 194

The Discovery Gap: How AI Is Breaking the Economics of Cybersecurity- 194

The Containment Problem: How the Surveillance Industry Escaped Its Own Market- 193

The Containment Problem: How the Surveillance Industry Escaped Its Own Market- 193

The Forecast That Confirmed Itself: Agentic AI and the Acceleration of Cybercrime- 192

The Forecast That Confirmed Itself: Agentic AI and the Acceleration of Cybercrime- 192

The Deniability Architecture: How Beijing Outsourced Its Cyber Footprint- 191

The Deniability Architecture: How Beijing Outsourced Its Cyber Footprint- 191

Humanitarian Cover: Operation HumanitarianBait and the Surveillance Campaign Nobody Has Attributed- 190

Humanitarian Cover: Operation HumanitarianBait and the Surveillance Campaign Nobody Has Attributed- 190

The Financial Data Layer: Shadow AI, Product Integration, and a Bank That Reported Itself- 189

The Financial Data Layer: Shadow AI, Product Integration, and a Bank That Reported Itself- 189

Code and Command: The Pentagon's AI-First Military Doctrine and Its Attack Surface- 188

Code and Command: The Pentagon's AI-First Military Doctrine and Its Attack Surface- 188

The Door Left Open: FamousSparrow's Three-Wave Intrusion into Azerbaijani Energy Infrastructure- 187

The Door Left Open: FamousSparrow's Three-Wave Intrusion into Azerbaijani Energy Infrastructure- 187

The Elected Leader: How Turla Rebuilt Kazuar as a Peer-to-Peer Espionage Botnet- 186

The Elected Leader: How Turla Rebuilt Kazuar as a Peer-to-Peer Espionage Botnet- 186

The State Messenger: Poland Abandons Signal for Sovereign Encrypted Communications- 185

The State Messenger: Poland Abandons Signal for Sovereign Encrypted Communications- 185

The Disgruntled Researcher and the Dead Man's Switch: Nightmare-Eclipse's Zero-Day Campaign- 184

The Disgruntled Researcher and the Dead Man's Switch: Nightmare-Eclipse's Zero-Day Campaign- 184

The Undisclosed Flaw: How a Huawei Zero-Day Took Down Luxembourg's Entire Telecoms Network- 183

The Undisclosed Flaw: How a Huawei Zero-Day Took Down Luxembourg's Entire Telecoms Network- 183

When the Medicine Cannot Ship: West Pharmaceutical's Ransomware and Healthcare's Systemic Exposure- 182

When the Medicine Cannot Ship: West Pharmaceutical's Ransomware and Healthcare's Systemic Exposure- 182

The Sleeper Strategy: GlassWorm's Evolution Into Delayed-Activation Supply Chain Attacks- 181

The Sleeper Strategy: GlassWorm's Evolution Into Delayed-Activation Supply Chain Attacks- 181

The Most Attacked Country: Israel's Cyber Threat Landscape in 2025-180

The Most Attacked Country: Israel's Cyber Threat Landscape in 2025-180

The Invisible Guest: How QEMU Became a Ransomware Delivery Vehicle- 179

The Invisible Guest: How QEMU Became a Ransomware Delivery Vehicle- 179

The Authentication Trap: How Device Code Phishing Became the Credential Theft of Choice- 178

The Authentication Trap: How Device Code Phishing Became the Credential Theft of Choice- 178

Inside the Machine: What The Gentlemen Ransomware Leak Reveals- 177

Inside the Machine: What The Gentlemen Ransomware Leak Reveals- 177

Platform Down, Market Open: The Crimenetwork Lesson in Enforcement Durability- 176

Platform Down, Market Open: The Crimenetwork Lesson in Enforcement Durability- 176

Shifting the Battleground: The Evolution from Cyberwarfare to Cognitive Warfare- 174

Shifting the Battleground: The Evolution from Cyberwarfare to Cognitive Warfare- 174

AI, Geopolitics and Emerging Financial Risks- 173

AI, Geopolitics and Emerging Financial Risks- 173

Operation PowerOFF: Global Crackdown on the DDoS-for-Hire Ecosystem- 172

Operation PowerOFF: Global Crackdown on the DDoS-for-Hire Ecosystem- 172

The Global Expansion of Commercial Cyberespionage- 171

The Global Expansion of Commercial Cyberespionage- 171

Chinese Advanced Cyber Espionage Across the Dutch-Taiwanese Semiconductor Axis- 170

Chinese Advanced Cyber Espionage Across the Dutch-Taiwanese Semiconductor Axis- 170

Cyber-Enabled Transnational Repression: The "Carp" Campaigns China-Linked Outsourced Phishing and Digital Impersonation Operations- 169

Cyber-Enabled Transnational Repression: The "Carp" Campaigns China-Linked Outsourced Phishing and Digital Impersonation Operations- 169

Geopolitical Friction: How Cyberespionage and Institutional Neglect Exposed Cuban Diplomacy- 168

Geopolitical Friction: How Cyberespionage and Institutional Neglect Exposed Cuban Diplomacy- 168

The Gentlemen Ransomware Operation: Industrialized Intrusion and SystemBC-Driven Expansion- 167

The Gentlemen Ransomware Operation: Industrialized Intrusion and SystemBC-Driven Expansion- 167

The Convergence of Global Risk: Redefining Corporate Insurance in an Age of Interconnected Exposures- 166

The Convergence of Global Risk: Redefining Corporate Insurance in an Age of Interconnected Exposures- 166

Ransomware as a Geopolitical Weapon: The Convergence of Cybercrime, State Power, and Industrial Targeting- 165

Ransomware as a Geopolitical Weapon: The Convergence of Cybercrime, State Power, and Industrial Targeting- 165

China-backed hackers hit Asian governments, defense sectors- 164

China-backed hackers hit Asian governments, defense sectors- 164

Threat Intelligence Report: The Sistemi Informativi Breach and the Vulnerability of Europe’s Digital Backbone- 163

Threat Intelligence Report: The Sistemi Informativi Breach and the Vulnerability of Europe’s Digital Backbone- 163

Industrial Espionage in Aerospace: The Song Wu Spear-Phishing Campaign- 162

Industrial Espionage in Aerospace: The Song Wu Spear-Phishing Campaign- 162

Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks: A Landmark Case in Transnational Cyber Espionage- 161

Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks: A Landmark Case in Transnational Cyber Espionage- 161

The Edge Infrastructure Peril: Tracking the Corporate-State Botnet Evolution-160

The Edge Infrastructure Peril: Tracking the Corporate-State Botnet Evolution-160

Dubai Scam Network Takedown Signals Emerging U.S.-China Convergence Against Transnational Cyber Fraud- 159

Dubai Scam Network Takedown Signals Emerging U.S.-China Convergence Against Transnational Cyber Fraud- 159

Signal Phishing Campaign — Espionage Through Trust in European Political Circles- 158

Signal Phishing Campaign — Espionage Through Trust in European Political Circles- 158

Cyber Cargo Theft — Hijacking the Invisible Layer of Logistics- 157

Cyber Cargo Theft — Hijacking the Invisible Layer of Logistics- 157

Latest

20
Jul
A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

A Quiet Patch with a Familiar Shape: 7-Zip's Latest Reminder About Archive Trust- 259

July 19, 2026 7-Zip’s release of version 26.02 closes a heap-based buffer overflow in the utility’
1 min read
20
Jul
Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

Trust as the Attack Surface: Inside the ClickFix Campaigns Powering ACR Stealer- 258

July 19, 2026 No vulnerability was patched, no exploit chain engineered, in the campaigns Microsoft disclosed distributing ACR Stealer through
2 min read
20
Jul
Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

Listening to the Seabed: Denmark's Bet on Acoustic Sensing as a First Line of Maritime Defense- 257

July 19, 2026 Europe's undersea infrastructure — power interconnectors, data cables, offshore wind arrays — has become one of the
2 min read
20
Jul
Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

Beneath the Radar: A Reawakened Espionage Toolkit Targets Southeast Asian Governments- 256

July 18, 2026 For over a year, an intrusion set moving through government and diplomatic networks across Southeast Asia left
1 min read
20
Jul
The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

The Certificate Authority's Blind Spot: How a Trusted Signing Chain Became a Weapon- 255

July 18, 2026 In April 2026, a routine support interaction at DigiCert — a customer service chat, a screenshot-disguised ZIP
2 min read
19
Jul
The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

The ransomware gang that used a training-data BTC address by mistake was actually the AI's mistake- 254

July 4, 2026 Researchers at Sysdig have documented what they believe is the first fully autonomous ransomware operation on record:
3 min read
19
Jul
A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

A breach nobody's attributed yet, hitting the platform that's coordinating World Cup security- 253

July 1, 2026 The Department of Homeland Security has confirmed that an unknown threat actor breached the Homeland Security Information
2 min read
19
Jul
North Korea just made its malware payload host itself on the blockchain- 252

North Korea just made its malware payload host itself on the blockchain- 252

July 5, 2026 North Korean threat actors behind the long-running Contagious Interview campaign have distributed more than 100 malicious
3 min read
19
Jul
The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

The lawyers MSG banned with facial recognition are now the plaintiffs suing over it - 251

July 4, 2026 Madison Square Garden spent years building one of the most extensive facial recognition surveillance systems of any
2 min read
19
Jul
Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

Anubis's real innovation isn't the ransomware — it's making destruction irreversible- 250

July 1, 2026 Anubis, a ransomware-as-a-service operation that emerged in late 2024 as a spinoff of the
2 min read