Threat actors are targeting the AI attack surface to deliver malware and steal data. See how trusted AI tools are being exploited today.

From the panels to the villages, Huntress researchers and SOC analysts were all over Hacker Summer Camp this year. Here’s what stood out at Black Hat and DEF CON.

A Shopify fake refund scam has been making the rounds over the past few months, targeting Shopify’s Shop app users directly within the app. Here’s what to know.

See how a threat actor used SQL injection and BadIIS to gain persistence, disable Windows Defender, and quietly install a cryptominer.

During the June Tradecraft Tuesday, Huntress researchers looked at device code phishing variations and why threat actors love this attack so much.

A recent investigation uncovered an Akira affiliate abusing a website owned by file-sharing app LimeWire for data exfiltration. Here's how the attack unfolded.

The ransomware name on the ransom note doesn't tell the full story. See how RaaS affiliates drive initial access, persistence, and exfiltration and what defenders should watch for.

A few weeks after the major axios npm supply chain attack, a group of researchers from Huntress, Wiz, and Aikido Security debriefed on the compromise’s lasting impacts.

ScreenConnect keeps showing up in ransomware chains, not because of a new exploit, but because of social engineering. The Huntress SOC documents the tactics.

If you work in security, someone at the holiday dinner table is going to ask about a suspicious pop-up. Huntress CISO Chris Henderson covered the threats you'll actually need to explain.

The threat reports make every attacker sound like they're running a perfect playbook. The telemetry tells a different story: typos, failed attempts, and a lot of trial and error before anything works.

It's 4:59 pm on a Friday and there's one more email in your inbox. This is exactly when attackers want you. Here are the 5 phishing techniques designed to exploit that moment.

Huntress analysts caught threat actors exploiting a WSUS vulnerability, then turning a legitimate open-source forensic tool into command-and-control infrastructure. Part 1 of a two-part investigation.

Cyberattacks on education hit differently, where the data can belong to students. After PowerSchool exposed records for millions of kids, the education sector's attack surface demands a closer look.

AutoIT, Base64, compiled executables, and a cryptocurrency stealer buried inside obfuscated code. This Huntress CTF 2025 retrospective walks through the challenges that made participants earn their flags.