Talos Takes

Browser betrayal: When your tabs turn against you

Back-to-school cybersecurity: Protecting education networks from ransomware and threats

Don't scan that! QR code phishing and cloud-native threats

Q2 Talos IR Trends: Phishing and authentication abuse spike

ARToken: How attackers are bypassing MFA and maintaining access

From evasion to detection: A guide to analyzing COM-based threats

Patching in the dark: Managing unknown threats in complex environments

When synthetic logs don’t lie: Generating coherent attack stories for better detection

The trust paradox: How attackers weaponize legitimate SaaS platforms

It's not you, it's your printer: State-sponsored and phishing threats in 2025

2025's ransomware trends and zombie vulnerabilities

Cybersecurity’s double-header: 2025 insights from Talos and Splunk

Modernizing your threat hunt

Holding the line: Service provider security

IR Trends Q4 2025: Ransomware chills and phishing heats up

Cracking the code: What encryption can (and can’t) do for you

Cybersecurity certifications and you

2015 vs 2025: What the Last Decade of Threats Taught Us

When You’re Told “No Budget”: The Blueprint for Staying Secure

How Attackers Use Your Own Tools Against You (IR trends Q3 2025)

Passwordless Security: Debunking the Biggest Myths

You Can't Patch Burnout: When Cybersecurity Takes a Toll

Tampered Chef: When Malvertising Serves Up Infostealers

Inside the Black Hat NOC: Lessons in Securing One of the Wildest Networks

Breaking Down Chaos: Tactics and Origins of a New RaaS Operation

Why Attackers Love Your Remote Access Tools

Teaching LLMs to spot malicious PowerShell scripts

How cybercriminals are camouflaging threats as fake AI tool installers

Inside the attack chain: A new methodology for tracking compartmentalized threats

Follow the motive: Rethinking defense against Initial Access Groups

Year in Review special pt. 4: How AI is influencing the threat landscape?

Year in Review special part 3: Identity and MFA attacks

Year in Review special part 2: The biggest ransomware trends

Year in Review special part 1: vulnerabilities, email threats, and adversary tooling

A blueprint for protecting major events

Why attackers are using hidden text salting to evade email filters

How to establish a threat intelligence program (Cisco Live EMEA preview)

Web shell frenzies, the first appearance of Interlock, and why hackers have the worst cybersecurity: IR Trends Q4 2024

Exploring vulnerable Windows drivers

It's the 35th anniversary of ransomware - let's talk about the major shifts and changes

Unwrapping the emerging Interlock ransomware attack

It's Taplunk! Talos and Splunk threat researchers meet to put the security world to rights

The biggest takeaways from Talos IR's new report: New ransomware variants, EDR tool uninstallation, and password spray attacks increasing

How Talos IR and Splunk are teaming up

Why the BlackByte ransomware group may be more active than we initially thought

AI, critical infrastructure dominate conversation at Hacker Summer Camp

A 1-on-1 with Talos VP Matt Watchinski

What should we be doing to better support open-source software?

Threat actor trends and the most prevalent malware from the past quarter

You got a data breach notification. Now what?