kyber.today

daily cyber × ai intelligence

browse by

Attack vectors

Every story about a real attack — observed or attempted against real systems — filed by how it arrived. Disclosed flaws, proofs of concept and lab demonstrations are not here: they did not arrive anywhere. 585 stories across 22 channels.

  1. 01 Phishing email A message that carried a lure, an attachment or a link. 137 stories latest Nov 4
  2. 02 Package registry A poisoned or typosquatted package on npm, PyPI, crates, RubyGems and the like. 83 stories latest Nov 5
  3. 03 Exposed service An internet-facing server, admin panel, database or API reached directly. 69 stories latest Nov 8
  4. 04 Supply chain A vendor, build pipeline, CI system or trusted upstream used as the way in. 49 stories latest Nov 8
  5. 05 AI agent An autonomous agent or coding assistant acting on the attacker’s behalf or on their instructions. 38 stories latest Oct 31
  6. 06 Stolen credentials Valid accounts, tokens or keys taken elsewhere and reused. 31 stories latest Nov 5
  7. 07 Browser extension A malicious or hijacked extension in Chrome, Firefox or Edge. 26 stories latest Nov 2
  8. 08 Malvertising An advert that leads to malware or a fake download. 20 stories latest Oct 25
  9. 09 Software update A trojanised update or an abused update channel. 17 stories latest Nov 6
  10. 10 Drive-by A compromised or malicious site that exploits the visitor. 17 stories latest Nov 5
  11. 11 Fake recruiter A job offer, interview task or coding test that delivers malware. 17 stories latest Nov 8
  12. 12 Edge device A VPN, firewall, router or gateway appliance at the perimeter. 14 stories latest Oct 29
  13. 13 Voice call Vishing: a phone call to a help desk, an employee or a customer. 13 stories latest Sep 22
  14. 14 SEO poisoning Search results steered to a malicious page. 11 stories latest Nov 1
  15. 15 Other A channel the story names but none of the above. 10 stories latest Nov 4
  16. 16 Messaging app Teams, Slack, Telegram, Discord, WhatsApp or Signal as the way in. 6 stories latest Oct 29
  17. 17 Physical An implanted device, a tampered unit or someone on the premises. 6 stories latest Oct 15
  18. 18 Credential stuffing Leaked passwords replayed against other services. 5 stories latest Nov 2
  19. 19 SMS Smishing: a text message with a link. 5 stories latest Nov 8
  20. 20 Removable media A USB drive or similar carried across the air gap. 5 stories latest Nov 4
  21. 21 Insider An employee, contractor or ex-employee with legitimate access. 5 stories latest Oct 31
  22. 22 Prompt injection Instructions smuggled into content a model reads. 1 story latest Sep 25