Javier Conejo del Cerro

Security teams spend years monitoring suspicious domains, malicious IP addresses, and unusual network traffic. HollowGraph simply chooses a destination no one thinks to inspect. Instead of communicating with attacker-controlled infrastructure, this espionage implant hides commands and stolen data inside Microsoft 365 calendar events scheduled decades into the future, transforming one of the most trusted enterprise services into an invisible command-and-control channel. Phase 1 – Hiding in...

Cybercriminals no longer need sophisticated exploits to compromise a system. Sometimes, all they need is a convincing error message and a user willing to press Ctrl+V. TELEPUZ, a newly discovered modular malware distributed through ClickFix campaigns, demonstrates how social engineering has evolved beyond phishing. Instead of exploiting software vulnerabilities, it exploits human trust, turning an ordinary copy-and-paste action into the first stage of a sophisticated malware infection capable...

AI assistants are becoming increasingly integrated with our daily workflows, helping us read emails, summarize documents, and manage calendars. But what happens when another browser extension can quietly tell that assistant what to do? Researchers from Manifold Security have identified two weaknesses in Claude for Chrome that could allow a rogue extension interacting with claude.ai to trigger predefined tasks targeting Gmail, Google Docs, and Google Calendar. Rather than exploiting Claude...