Threat Intelligence Center

Security researchers have identified a large-scale campaign distributing fake AI Chrome extensions that compromised approximately 900,000 users. The malicious extensions impersonate legitimate tools including ChatGPT for Chrome with GPT-5, Claude Sonnet, DeepSeek AI, and AI Sidebar variants, collectively tracked as VoidLink. These counterfeit extensions harvest sensitive user data and credentials.

LastPass has identified a targeted phishing campaign using fraudulent maintenance messages to compromise user master passwords. Attackers are impersonating legitimate system notifications to trick users into revealing their most sensitive credentials.

Security researchers have disclosed critical vulnerabilities in the AutomationDirect CLICK Programmable Logic Controller platform, identified as CVE-2025-25051 and CVE-2025-67652. These vulnerabilities present substantial risks to critical manufacturing environments that depend on PLC systems for operational continuity.

Security researchers have identified a critical vulnerability in GitLab that allows attackers to bypass two-factor authentication protections and gain unauthorized access to user accounts. This authentication bypass represents a significant risk to organizations relying on GitLab for source code management and CI/CD operations.

The Cybersecurity and Infrastructure Security Agency has issued a critical warning regarding active exploitation of vulnerabilities in Gogs, a self-hosted Git service. CVE-2024-55947 and CVE-2025-8110 are being actively exploited in the wild to achieve remote code execution on vulnerable systems.

Mandiant's release of NTLMv1 cracking techniques underscores a persistent security gap in enterprise environments. NTLMv1, despite being deprecated for over two decades, remains active in many organizations' networks, creating exploitable weaknesses. This demonstration serves as a critical reminder that legacy authentication protocols pose significant risks to network security.