VIVEK KUMAR
A structured archive of real-world cyber incidents, vulnerabilities, ransomware activity, fraud investigations and defensive research β organised by year and month so the library can grow to 100+ investigations without becoming one endless page.
Select a month to reveal its research cards. Keep older months closed and jump directly to the period you want.
How trusted Google redirects, compromised sender accounts and a live reverse proxy were used to capture authenticated Google sessions despite conventional MFA.
Read Research β83 research investigations published so far.
How trusted Google redirects, compromised sender accounts and a live reverse proxy were used to capture authenticated Google sessions despite conventional MFA.
Read Research βA reported launchd job and console-input weakness that could let a standard local user execute commands through a root-privileged shell.
Read Research βHow suspicious DLL loading, remote archive retrieval and a trusted endpoint-management agent can be abused to create an unauthorised remote-access path.
Read Research βA reported Pune case involving a fictitious investment scheme followed by a coercive digital-arrest impersonation scam.
Read Research βPractical guide to Android camera and microphone indicators, Privacy Dashboard history, permission controls and unexpected access.
Read Research βFake AI installers, SEO poisoning, DLL sideloading, staged Yoba payload delivery and XMRig cryptomining.
Read Research βAnalysis of a malformed WAP Push data SMS that can crash the Android telephony process and interrupt calls, with disclosure and patch-status caveats.
Read Research βTeamViewer disclosed three client vulnerabilities involving possible code execution and macOS privilege escalation.
Read Research βSource classifies this indicator as payload delivery associated with Strelastealer activity.
Read Research βResearch into reported World Cup-themed Instagram malvertising associated with P7 DarkSword, the iOS exploit chain, attribution caveats, and practical protection.
Read Research βHow quantum computing could challenge DNSSEC, why post-quantum migration is complex, and practical preparation steps for users, organisations and DNS operators.
Read Research βExplains OTP social-engineering fraud, the reported TRAI proposal for clearer OTP SMS formats, and practical protection steps.
Read Research βExplains DLL sideloading and related defensive investigation pivots, with careful distinctions between observed indicators and unconfirmed conclusions.
Read the Research βSBI reported a data-loss incident involving a dark-web dataset in which preliminary analysis identified 3,897 customer records containing PII. This research focuses on customer protection, abuse scenarios and what remains unconfirmed.
Read the Research βSBI reported a data-loss incident after a preliminary review identified 3,897 records containing customer PII. The responsible actor, source, complete scope and access method remain unconfirmed.
Read the Research βPHP announced a security release for two critical vulnerabilities rated CVSS v4.0 9.2. Reported RCE classification and CVE details remain preliminary pending the official advisory.
Read the Research βA Dussehra awareness feature linking phishing, ransomware, malware, identity theft, deepfakes, AI-powered scams and financial fraud with practical defensive habits.
Read the Research βOpenCode reported that 1.4% of Console users were affected by a breach. Third-party provider API keys saved in affected workspaces may have been exposed; key misuse and the full intrusion path are not yet established.
Read Research βA counterfeit Chrome-branded listing reportedly appeared as a sponsored Play Store result with 100,000+ displayed downloads. Reporting links it to the earlier Ball Bounce app, so the figure is not a verified count of fake-Chrome installs.
Read Research βCitizen Lab and Confiant describe a targeted-advertising chain linked to Discover-Tech and Candiru that could deliver mercenary spyware without a click. The article distinguishes targeting from confirmed infection and provides practical defensive guidance.
Read Research βA reported Android 17 Bionic regression affects wcscspn() and wcspbrk() under a specific Unicode/delimiter condition. The article explains the reported build scope, compatibility impact and validation priorities without claiming confirmed exploitation.
Read Research βCVE-2026-0322 can enable authenticated root-level code execution through the PAN-OS management interface. Review the vendor-confirmed scope, exact branch-specific fixes, exposure controls and SOC response guidance.
Read Research βMicrosoftβs October 2026 updates address CVE-2026-96951, an actively exploited Windows Shell security-feature bypass affecting Mark of the Web. The article separates confirmed reporting from unknown actor, payload and affected-build details.
Read Research βAmantya Technologies appeared in public Orova victim listings on 12 October; the listing warrants investigation but does not independently prove data theft, encryption or initial access.
Read Research βA public AnyPwn proof of concept targets AnyDesk Linux 8.0.2 with potential pre-auth root command execution. Review the affected scope, release timeline and defensive response.
Read Research βHow a reported βΉ17 lakh offer escalated into repeated advance-fee demands and a reported βΉ1,06,400 loss over three days, with practical evidence-preservation and victim-response guidance.
Read Research βA source-attributed analysis of GhostActionβs October 2026 GitHub Actions wave, including deceptive workflow changes, credential-harvesting scope, evidence limits and defensive response.
Read Research βHow a reported Navi Mumbai case combined unauthorised loan apps, financial pressure and threats involving morphed images β with practical steps to preserve evidence and get help.
Read Research βHow ccTLD compromise, authoritative DNS control and unauthorized HTTPS certificates can undermine trust in familiar domains.
Read Research βHow a convincing developer interview can become the delivery mechanism for hidden SVG payloads, credential theft and remote access.
Read Research βHow a crafted Calc document can abuse external data mappings and a remote Java driver to reach code execution.
Read Research βHow attackers can abuse a genuine, digitally signed ScreenConnect client configured to an attacker-controlled instance β turning trusted RMM into remote access.
Read Research βGoogle Gemini's proposed broader desktop access could expand an AI agent's authority across files, native apps and the web β raising important privacy, prompt-injection and endpoint-security questions.
Read Research βA dark-web claim alleges compromise of a Ukraine MFA visa application platform and presents sample documents; the claim and breach scope remain unverified.
Read Research βA threat-intelligence review of a dark-web compromise claim targeting cag.gov.in, with apparent admin-panel evidence but unverified database and web-shell access.
Read Research βInside the SC βself-healingβ WordPress malware that can rebuild persistence across files, database and memory.
Read Research βHow stale CPU branch predictions can survive JIT memory reuse and create a speculative-execution attack primitive.
Read Research βHow a reported corporate SIM-swap fraud shows that sudden loss of mobile service can become an early warning signal for business-banking compromise.
Read Research βA newly observed dark-web listing claims to offer a 21 GB ICMR database; the research focuses on provenance, validation and why a listing is not proof of a new breach.
Read Research #045 βHow a PMAY-themed WhatsApp APK reportedly became the starting point for a serious mobile and financial compromise.
Read Research βHow a reported βΉ1ββΉ5 entertainment offer can become a gateway to recurring payment mandates, malicious APK installation or payment-data theft.
Read Research βHow an AI-enabled cybercrime service can turn compromised mailboxes into actionable intelligence for business email compromise.
Read Research βHow a live documentation-style domain can become a ClickFix malware delivery point β and why developer, AI and MCP references need trust validation.
Read Research #041 βWhy a fraudulent transaction can happen without an SMS OTP β and how SIM swap, phishing, malicious apps, device compromise and authentication factors change the investigation.
Read Research βHow a reported local Muse zero-day illustrates the risk of malware abusing delegated AI-agent permissions, authentication and connected services.
Read Research βHow a suspicious archive, trojanized WebView2/NVIDIA-themed DLL, UAC-bypass activity, persistence and encrypted C2 traffic revealed a multi-stage malware operation.
Read Research βHow a reported fake Facebook identity, social engineering, a βcurrency machineβ and a physical bag-switching operation were used in an Odisha fraud.
Read Research βWhy AI security should focus on data, permissions, agent access, monitoring and meaningful human control.
Read Research βHow RatHat combines Accessibility abuse, ADB, credential and OTP theft, persistence, reverse tunneling and AI-assisted navigation.
Read Research βHow a reported diplomatic-parcel scam used WhatsApp social engineering, authority impersonation and repeated advance-fee demands.
Read Research βHow VectraRAT illustrates the growing Malware-as-a-Service economy and modular cybercrime attack chains.
Read Research βHow AI can amplify deepfakes, voice cloning, impersonation and social engineering into a financial fraud chain.
Read Research βThree common password mistakes and the credential attack chain that can turn one exposed password into multiple account compromises.
Read Research βAI photo trends, facial data, deepfakes, impersonation and practical privacy protection.
Read Research βAnalysis of an Android malware family combining spyware, OTP theft, surveillance, remote control, ransomware and psychological harassment.
Read Research βHow a Pune bank manager noticed suspicious behaviour and helped prevent another βΉ14 lakh transfer in a reported digital-arrest scam.
Read Research βHow fake IT support, MFA abuse, AiTM/device-code phishing and cloud reconnaissance can turn a legitimate authentication action into an identity compromise.
Read Research βA practical emergency response guide: block the card, contact the bank, call 1930, file the cybercrime complaint, preserve evidence and secure compromised accounts.
Read Research βAnalysis of CVE-2025-61882, the Bimbo Bakeries USA breach, Oracle EBS exploitation, third-party risk and defensive actions.
Read Research βA practical guide to your rights and next steps after a personal-data breach.
Read Research βA Cybersecurity Investigation into Data Extortion, Dark-Web Publication and the Secondary Fraud Risk
Read Research βMultiple Indian Organisations Appear on Ransomware Leak Sites β What We Know, What Attackers Could Do With Stolen Data, and How Organisations Should Defend
Read Research βTechnical analysis of CVE-2026-52924, a remote Linux kernel SCTP use-after-free vulnerability, its memory-safety impact, exposure risks, remediation, detection and defensive response.
Read Research βCyberRakshakLabs threat intelligence analysis of the reported Licindia/LIC India MedusaLocker ransomware listing, the distinction between threat-intelligence disclosure and independently verified compromise, documented attack techniques, early detection indicaβ¦
Read Research βCyberRakshakLabs threat intelligence analysis of unexpected X password-reset emails, potential phishing and social-engineering risk, Password Reset Protect, two-factor authentication, connected-app review and account-security response steps.
Read Research βCyberRakshakLabs analysis of a reported Mumbai banking data-breach incident involving a compromised employee email account, sensitive customer information, identity risk, mailbox compromise indicators, data exfiltration and enterprise incident response.
Read Research βCyberRakshakLabs threat intelligence analysis of a malicious Android APK campaign promoted through Instagram and Facebook ads, including Accessibility abuse, secondary APKs, VPN abuse, financial-fraud risk and defensive actions.
Read Research βCyberRakshakLabs analysis of WhatsApp's newer account-security features, including stronger two-step verification, multiple passkeys, unknown-caller context, Strict Account Settings, Scam Alert, linked-device monitoring and practical account-protection steps.
Read Research βCyberRakshakLabs threat intelligence and vulnerability analysis of the PaperCut NG/MF active exploitation, CVE-2026-81578 and CVE-2026-82078, emergency patch bypasses, attack chain, hunting clues and defensive actions.
Read Research βCyberRakshakLabs post-recovery security checklist for a compromised X / Twitter account covering password reset, email security, 2FA, active sessions, third-party apps, X Pro or Teams access, DMs, device security and monitoring.
Read Research βCyberRakshakLabs Instagram account recovery security checklist covering password reset, 2FA, login sessions, recovery contacts, linked accounts, third-party apps, DMs, device security, session access and post-recovery monitoring.
Read Research βCyberRakshakLabs analysis of a fake traffic-challan SMS campaign delivering a malicious Android APK impersonating mParivahan, with indicators of compromise and defensive actions.
Read Research βA practical CyberRakshakLabs guide to data breaches, megaleaks, infostealer logs, credential reuse, session-token risk, phishing, account takeover and defensive actions.
Read Research βAnalysis of the reported βΉ30,000 crore transaction trail, digital-arrest social engineering, mule accounts, shell companies, cash withdrawals, foreign exchange and money laundering.
Read Research βWarning signs of high-return investment fraud, fake profits, withdrawal problems, social engineering and pressure to invest more.
Read Research βA software supply-chain security analysis of reported malicious npm packages, import-time execution, the RedShell Linux beacon and the defensive actions developers, DevOps and security teams should take.
Read Research βAnalysis of a reported Mangaluru cyber-fraud case involving unauthorised access to mobile/SIM connectivity and the broader risks of mobile identity compromise.
Read Research βCyberRakshak Labs analysis of CVE-2026-76404, a reported stored XSS issue affecting Splunk Apps, with security impact and defensive checks.
Read Research βIncident analysis of the reported fake accommodation booking network, its attack flow and practical defenses.
Read Research βWhy expired domains, inherited reputation, DNS dependencies and forgotten integrations can create an attack path.
Read Research βA CyberRakshak Labs security alert covering the reported NetScaler vulnerability, affected configurations and defensive actions.
Read Research βHow fake tax refunds, PAN alerts and urgent verification messages can lead to phishing and financial fraud.
Read Research βMobile number exposure, phishing, OTP abuse, SIM-swap warning signs and digital identity protection.
Read Research βEvery research item aims to separate evidence from claims and turn cybersecurity events into practical defensive knowledge.