Company

Push Security

Security research team credited by Wiz with prior documentation of the same attack flow.

Known aliases

Push
Pushsecurity

Current stories

securityOne report1 publisher

Fake Claude installer ads on Google borrow Bing's click tracker to display a trusted domain

Attackers route Google ads through Bing's click-tracking redirect to show bing.com and send Mac users to a fake Claude installer, Push Security found. The setup appears built to pass ad vetting, so the domain an ad displays no longer says where a click lands.

Publishers:bleepingcomputer.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+10
Incentives: Insufficient
Confidence55

securityConfirmed3 publishers

Attackers bought the top result for "codex macos download" and kept the payload swappable

Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.

Publishers:helpnetsecurity.cominfosecurity-magazine.comscworld.com

Perspective Coverage

3 publishers

Builder: Builder 34%
Operator: Operator 58%
Investor: Investor 8%

Reality

Evidence60
Adoption: Insufficient
Hype gap+10
Incentives35
Confidence65

securityOne report1 publisher

AFP charges two men near Perth over the self-spreading worm behind the TeamPCP compromises

Two suspects in Western Australia are in custody over the supply-chain worm that hit Trivy, KICS, LiteLLM and Telnyx. The 500,000 credentials it harvested stay valid until someone rotates them. Only 78,000 have surfaced publicly.

Publishers:news.risky.biz

Reality

Evidence50
Adoption62
Hype gap+14
Incentives45
Confidence52

securityConfirmed2 publishers

Seven RAT families, one actor: what SilkParasite does to behavioural clustering

Bitdefender ties seven remote access tool families to a single Central Asia espionage actor and finds traces of AI-assisted development. Its own numbers show where clustering still held.

Publishers:bitdefender.combusinessinsights.bitdefender.comnews.risky.biz

Perspective Coverage

3 publishers

Builder: Builder 27%
Operator: Operator 55%
Investor: Investor 18%

Reality

Evidence61
Adoption42
Hype gap+17
Incentives71
Confidence60

securityOne report1 publisher

"Work PC" beats DESKTOP-XXXXXXXX: Entra device-join detection needs a new anchor

Wiz says rogue device registrations are drifting toward benign names, while nearly one in seven Entra tenants saw such an attack in 90 days. Naming strings were never the signal.

Publishers:wiz.io

Reality

Evidence42
Adoption55
Hype gap+30
Incentives78
Confidence45