C

Check Point Research

https://research.checkpoint.com/feed (RSS订阅地址)

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

<p>Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text generation. Modern systems can execute code, install additional dependencies, analyze user files, and access data through connected services. These capabilities significantly increase the practical value of LLMs, but they also change the security model: protecting user [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/">The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/9/8
阅读更多

7th September – Threat Intelligence Report

<p>For the latest discoveries in cyber research for the week of 7th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Thomson Reuters, a global information and technology company, has disclosed a breach of its C-Track court case-management platform affecting courts across 11 US states and Canada. An unauthorized party obtained C-Track files [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/7th-september-threat-intelligence-report/">7th September – Threat Intelligence Report</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/9/7
阅读更多

Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon

<p>Research by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first&#160;documented&#160;targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-weapon/">Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/9/2
阅读更多

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

<p>Research by:&#160;hasherezade Key Points Introduction JSCeal is a stealer delivered as compiled V8 bytecode (.jsc) and executed by a bundled Node.js runtime, targeting cryptocurrency applications (other vendors also tag it with the names WEEVILPROXY or MeadowLocust). Its campaign activity dates back to March 2024 [1]; Check Point Research has been tracking the malware since early [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode/">Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/31
阅读更多

31st August – Threat Intelligence Report

<p>For the latest discoveries in cyber research for the week of 31st August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Manchester Airports Group, the UK operator of Manchester, London Stansted, and East Midlands airports, has disclosed a cyberattack that exposed data belonging to about 8.7 million customers. The compromised information includes contact details, [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/31th-august-threat-intelligence-report/">31st August – Threat Intelligence Report</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/31
阅读更多

24th August – Threat Intelligence Report

<p>For the latest discoveries in cyber research for the week of 24th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Latvia’s Road Traffic Safety Directorate (CSDD) has confirmed a breach affecting payment records of more than 1.2 million people &#8211; roughly two-thirds of the country’s population &#8211; as well as 200,000 organizations. The [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/">24th August – Threat Intelligence Report</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/24
阅读更多

BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive

<p>Research by: Jiří Vinopal (@vinopaljiri) Abstract What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute arbitrary file and registry operations from Ring 0 &#8211; without exploits, vulnerabilities, or memory corruption? In this publication, we present the first full [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/btr-reforged-weaponizing-defenders-remediation-driver-as-a-kernel-operation-primitive/">BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/20
阅读更多

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

<p>Research by: Jaromír Hořejší (@JaromirHorejsi) Key points Introduction We first noticed a ransomware family called StopAndProtect in the middle of May 2026. Further analysis of the infrastructure reveals that the infection chain starts with a ClickFix social-engineering technique, which prompts victims to execute a PowerShell command. This leads to two stages of additional downloaders and [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stopandprotect/">Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/18
阅读更多

17th August – Threat Intelligence Report

<p>For the latest discoveries in cyber research for the week of 17th August, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Colombia’s Ministry of Justice has experienced a ransomware attack that affected part of its technology infrastructure and disrupted public services related to illicit-drug monitoring and legal processes. Officials confirmed that some files were [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/">17th August – Threat Intelligence Report</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/17
阅读更多

The State of Ransomware Q2 2026

<p>For the past year, the ransomware conversation has centered on concentration: a handful of dominant RaaS operations controlling most of the damage, and a shrinking pool of active groups fighting over the same territory. The State of Ransomware Q2 2026 report from Check Point Research shows that picture&#160;starting&#160;to shift. The leaders are still winning, but [&#8230;]</p> <p>The post <a href="https://research.checkpoint.com/2026/the-state-of-ransomware-q2-2026/">The State of Ransomware Q2 2026</a> appeared first on <a href="https://research.checkpoint.com">Check Point Research</a>.</p>

2026/8/13
阅读更多

推荐订阅

Threat Intelligence

Cofense

Google Android Security Bulletins

Adobe Security Bulletins and Advisories

VirusTotal Blog