Netcrook
Cybercrime / North America
The Scam That Began with a Polished Profile
A nearly yearlong romance fraud that started on LinkedIn shows how credibility signals can be weaponized long before a victim realizes money is leaving the account.
PyPI Locks the Back Door on Aging Releases
By refusing late file uploads to older package releases, the Python registry is tightening a trust boundary that attackers have long tried to exploit.
PyPI Puts a Time Lock on Package Tampering
A new 14-day upload restriction narrows one of the cleaner routes for package poisoning when publishing access is compromised.
Inside the Small Login That Became a Criminal Case
A 76-month sentence tied to more than 750 Snapchat accounts shows how a single unauthorized login can turn private images into criminal evidence.
How a Trusted Build Pipeline Became a Launchpad for Server Attacks
A campaign involving compromised GitHub repositories and tainted Packagist releases shows how software delivery systems can be turned against cPanel and WHM operators.
When Hosting Panels and CI Runners Become the Same Attack Surface
A credential-hunting campaign is turning GitHub Actions into a distribution layer for probing cPanel systems, showing how trusted automation can be repurposed into offensive infrastructure.
When a Video Call Becomes a Payment Weapon
AI-fueled impersonation is not just a media problem anymore - it is a workflow problem that can exploit the seams between fraud, cyber, AML, and payments teams.
Inside the $23.75 Million Ostium Loss: When Off-Chain Trust Becomes the Weakest Link
A trading platform’s reported crypto theft shows how a compromise outside the chain can still hit on-chain vaults hard.
When a Game Ecosystem Becomes a Theft Route
An FBI arrest tied to alleged Steam-distributed malware shows how attackers can turn familiar gaming trust into a path toward crypto theft, even without a breach of the platform itself.
When a Terminal Agent Becomes a Criminal Sidekick
A reported case involving Gemini CLI and eight dental clinic PCs shows how command-capable AI tools can shorten the path from stolen access to hands-on control.
Seven-Year Probe Ends in a Criminal Filing That Maps a Ransomware Economy
U.S. authorities have unsealed an indictment against three Russian nationals, a case that highlights how ransomware, phishing, and malware can sit inside the same criminal pipeline.
When Fraud Money Becomes the Mission: The $43 Million Laundering Case
A charging case in New York shows how the financial cleanup phase can become the centerpiece of a cyber-enabled fraud operation.
When Trusted Admin Access Becomes the Attack Surface
Managed service providers can turn one compromised management plane into a multi-customer security event, which is why cybercrime keeps circling the same trusted chokepoints.
Printer Supply Chains Are Not Just a Pricing Fight Anymore
A major rupee penalty over cartridges and PCs shows how reseller incentives, counterfeit risk, and product trust can become part of the security story.
Prison Term Puts the Ransomware Support Layer Under the Spotlight
A Florida resident’s federal sentence highlights an alleged role tied to ransomware negotiation, while the criminal conduct itself remains the central proven fact.
When an AI Gateway Starts Mining: The Quiet Cloud Layer That Can Turn Rogue
A Bedrock-connected gateway linked to cryptomining traffic shows why the security boundary in generative AI often sits in the middleware, not the model.
The Fake SDK That Turns Payments Code Into a Theft Vector
A lookalike NuGet package built to imitate Braintree's .NET client shows how one deceptive dependency can put card data and gateway secrets in reach of an application.
When a Payment Package Waits for Production, the Supply Chain Has Already Been Crossed
Researchers reported a NuGet package named Braintree.Net that mimics a payment SDK and is said to steal card data only in live environments, a reminder that build-time trust can become runtime risk.
When an AI Gateway Turns Into a Miner: The Quiet Theft of Cloud Compute
A compromised AWS-hosted AI gateway tied to Amazon Bedrock shows how generative AI middleware can become valuable enough to hijack for cryptocurrency mining.
When the Login Box Becomes the Breach: Device-Code Phishing and MFA Persistence
Identity abuse is replacing noisy malware in some intrusions, and the sharp edge now sits in legitimate sign-in flows, token replay, and methods added to keep access alive.