Cloud VMs offer unmatched speed, scale and flexibility – all of which could eventually count for little if they’re left to fend for themselves
As IT infrastructure expands, visibility and control often lag behind – until an incident forces a reckoning
What you do – and how fast – after an account is compromised often matters more than it may seem
A powerful iPhone-hacking technique called DarkSword has been discovered actively used by Russian threat actors in the wild. The attack is capable of compromising millions of iPhones, representing a significant threat to iOS users globally.
ESET researchers examine the broader EDR killer ecosystem, revealing tactics attackers use to abuse vulnerable drivers in order to disable endpoint detection and response solutions. This analysis extends beyond initial driver-based research to provide deeper insight into how adversaries exploit these weaknesses against enterprise security infrastructure.
🎉 New for 2026! In this episode, we’ll look at Fuji — a free, open-source tool for performing live, logical forensic acquisitions of Mac computers (Intel or Apple Silicon). You’ll see how Fuji leverages built-in macOS tools to generate a DMG image, ready for analysis in your forensic tool of choice.
Bitdefender researchers have identified a malicious Windsurf IDE extension that leverages the Solana blockchain to deliver and host a multi-stage NodeJS stealer payload. This attack chain represents an unconventional approach to malware distribution, using blockchain infrastructure to obscure and deploy the theft functionality against developers using the compromised IDE extension.
Iris scan-backed tokens could help stop agent swarms from overwhelming online systems.
Internet-exposed devices that give BIOS-level access? What could possibly go wrong?
ESET researcher Jake Moore demonstrated vulnerabilities in widely-used facial recognition systems using smart glasses, deepfakes, and face swaps to bypass their security controls. Moore will present these attack techniques and findings at RSAC 2026, highlighting practical methods for compromising biometric authentication systems.
The cybersecurity implications of the war in the Middle East extend far beyond the region. Here’s where to focus your defenses.
Bitdefender Labs has identified a malicious Google Ads campaign impersonating Claude, Anthropic's large language model, to distribute malware across Windows and macOS systems. The threat leverages search traffic from users looking to download Claude, exploiting the popularity of the AI tool to increase infection rates. This attack demonstrates how threat actors continue to abuse legitimate advertising platforms to deliver multi-platform malware at scale.
The resurgence of one of Russia’s most notorious APT groups
In February-March 2026, Bitdefender Labs identified and mapped a sprawling global scam infrastructure and scalable disinformation-for-profit network that uses trusted news brands, real personalities, fabricated media narratives, emotional hooks, and advanced evasion techniques to drive victims into investment fraud funnels. On February 9-March 5, 2026, we analyzed 310 malvertising campaigns distributed through paid advertising on Meta platforms. Key findings: * This is a global, coordinated
The ability to continue operating safely in an unsafe environment where competitors cannot is a competitive advantage that is rarely measured or discussed
AI Security Insights – March 2026
We speak to Director of ESET Threat Research Jean-Ian Boutin about where solutions that blend advanced technology with human expertise provide the most practical value for businesses
Mutational grammar fuzzing, while effective at finding complex bugs, suffers from two key limitations: coverage gains don't necessarily correlate with bug discovery, especially when bugs require chaining multiple function calls, and the technique tends to produce overly similar samples that lack diversity. A simple but effective mitigation strategy involves periodically restarting fuzzing workers with empty corpora while maintaining a server corpus, allowing workers to generate fresh diverse samples independently before syncing with accumulated coverage, which empirical testing on libxslt demonstrated could uncover unique crashes more quickly than continuous fuzzing sessions.