Infostealer riding the AI Train
Key Points Aokigahara, a newly observed infostealer, has been spotted in the wild. An earlier version may have been known as Kamidere or Stygian. The malware…
Read more
October 20, 2026
The Risk of AI-Powered Antidetect Browsers in Online Fraud and Influence Operations
Key Findings Antidetect browsers obscure the digital identity of their users, enabling a single operator to silently manage thousands of isolated accounts across multiple platforms (including…
Read more
October 13, 2026
When LLM Gateways Go Wrong: Findings from LiteLLM
TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been resolved as…
Read more
October 3, 2026
Business travel in 2026: trends and security
Record spending, fewer extra trips and more risk per journey: why travel risk is now a duty of care, compliance, cyber and geopolitical question.
Read more
October 3, 2026
Strait of Hormuz: the untold collateral global effects
Six months into the closure of the Strait of Hormuz, the most acute consequences are materialising in Africa: fuel-driven unrest, mobility disruption and rising risk for…
Read more
September 17, 2026
AI Threat Landscape Digest: July–August 2026
The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real…
Read more
September 10, 2026
PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector
In this research we introduce a prompt-crafting technique for bypassing quick LLM-based policy checks — using plain English (no emojis, base64, invisible formatting, etc.) A policy-violating…
Read more
September 8, 2026
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Check Point Research discovered a covert cross-account command channel through which an attacker could use a victim’s ChatGPT session to execute hidden tasks with the tools,…
Read more
September 2, 2026
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
A Chinese-speaking actor is now targeting Brazil. Check Point Research has uncovered a sustained campaign against Brazilian organizations, primarily government and educational institutions since…
Read more
August 31, 2026
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
Since early 2025, Check Point Research has been tracking JSCeal, a sophisticated cryptocurrency-focused stealer with broader credential-theft, surveillance, and traffic-interception capabilities…
Read more
August 20, 2026
BTR Reforged: Weaponizing Defender’s Remediation Driver as a Kernel Operation Primitive
What if a trusted security component could be repurposed into an attacker-controlled kernel primitive? What if a signed Microsoft remediation driver could be instructed to execute…
Read more
August 18, 2026
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using…
Read more