Category: Tacklebox
The Tacklebox is your one-stop reference guide to unraveling the intricate world of scams and fraudulent schemes. This comprehensive resource is designed to equip you with the knowledge and insights needed to recognize, understand, and protect yourself against various types of scams and social engineering tactics.
-
Exploiting MLflow SSRF Vulnerability: Emerging Attack Techniques
Explore the exploitation of MLflow’s SSRF vulnerability (CVE-2026-64849) with real-world attack examples and operator insights.
-
Exploiting Cloud Metadata Services for Credential Theft: Current Tactics
Explore how threat actors exploit cloud metadata services via REST API endpoint 169.254.169.254 for credential theft.
-
Exploiting Metabase SQL Injection: Current Threat Actor Campaign Patterns
An in-depth look at the exploitation of Metabase SQL Injection vulnerability by threat actors, detailing methods and impacts on organizations.
-
Metabase SQL Injection Vulnerability in Real-World Phishing Campaigns
Explore how attackers utilize the CVE-2026-72898 vulnerability in Metabase to steal data in modern phishing operations.
-
Metabase Pre-Authentication SQL Injection Exploitation: A Current Threat Landscape
Explore the Metabase pre-authentication SQL injection vulnerability and its exploitation in active campaigns, impacting application configurations and data security.
-
Exploiting Metabase SQL Injection Vulnerability: Real-World Phishing Campaign Patterns
Explore the exploitation of Metabase SQL injection vulnerabilities within recent phishing campaigns, highlighting integrated techniques that lead to data theft.
-
Metabase SQL Injection Vulnerability Exploitation in the Wild
Explore the recent SQL injection vulnerability in Metabase (CVE-2026-72898) exploited to gain unauthorized access. Understand the attack pattern, its construction, and impact.
-
Progress LoadMaster Command Injection Exploitation: Real-World Campaign Analysis
Delve into the exploitation of a command injection vulnerability in Progress LoadMaster appliances, based on CISA’s exploited vulnerabilities catalog.
-
Inside the keyv/cacheable npm Worm: A Supply-Chain Attack Case Study
A deep dive into the recent keyv/cacheable npm worm incident, revealing its mechanisms and unexplored attack patterns on the software supply chain.
-
22 Seconds to Compromise: Automated SSH Actors and Fast-Paced Attacks
Explore how automated SSH actors leverage compromised credentials for rapid attack progression, achieving persistence in just 22 seconds.
-
Don’t Revoke That Token Yet: Inside the keyv/cacheable npm Worm
Explore the unique dynamics of the keyv/cacheable npm worm, where revoking tokens could be counterproductive in managing this supply chain threat.
-
keyv/cacheable NPM Worm: When Revoking Tokens Backfires
Explore the keyv/cacheable npm worm’s unique twist on supply-chain security incidents and why immediate token revocation can worsen the situation.
-
Recent Phishing Campaigns Exploiting AI Services Like ChatGPT
Discover how phishing campaigns are exploiting AI services like ChatGPT, leveraging urgency and fear to target users.
-
Phishing Campaigns Targeting AI Solutions Providers: Latest Developments
Explore the latest phishing campaigns targeting AI solution providers, with insights into methods, impersonation tactics, and targeted services like ChatGPT.
-
Atomic MacOS (AMOS) Stealer: In-Depth Analysis of Recent Infection Patterns
Explore the sophisticated AMOS Stealer campaign: its infection techniques, target profiles, and the vulnerabilities exploited in MacOS systems.
-
Phishing Campaigns Targeting AI Solutions Providers
Explore phishing campaigns targeting AI solutions providers, impersonating major AI platforms like ChatGPT to exploit trust and capture credentials.
-
SSH Bot Reconnaissance: Sizing Up Hardware for Crypto Mining
Exploring a novel SSH bot campaign that assesses hardware capabilities before deploying cryptocurrency mining software.
-
SSH Bot Campaign: Reconnaissance First, Mining Next
A case study of an SSH bot campaign that conducts reconnaissance before deploying a cryptocurrency miner, maximizing illegal profits by targeting capable hosts.
-
Rondo Malware Campaign: Intersection with GeoServer Installations
Explore the Rondo malware campaign aligning with GeoServer installations, detailing threat actor techniques and implications for GeoServer security.
-
Rondo Malware Campaign Targeting GeoServer Implementations
Dive into the Rondo malware campaign targeting GeoServer implementations, revealing tactics, impact, and red team takeaways.