 | Inside Russia’s Camera-Hacking Espionage Campaign | 2026-07-16 | True | | True | | |
| Roblox, Minecraft, and the Insidious Internet for Children | 2026-07-02 | True | | True | | |
| Why Are WordPress Sites Still Running EOL PHP? | 2026-07-01 | True | | True | | |
| AsyncRAT Family Threat Overview | 2026-06-26 | True | | True | | |
| UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign | 2026-06-26 | True | | True | | |
| AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale | 2026-06-17 | True | | True | | |
| REDCap on the Internet: An Exposure Analysis | 2026-06-16 | True | | True | | |
| How a Dangling DNS Entry Can Lead to a Subdomain Takeover | 2026-06-05 | True | | True | | |
| MCP Servers on the Internet | 2026-05-27 | True | | True | | |
| Iran-Linked Operators Suspected in ATG Breaches | 2026-05-18 | True | | True | | |
| The Ultimate Guide to Detection Engineering with Censys | 2026-05-12 | True | | True | | |
| Password Manager Infrastructure in the Wild: Surveying Prevalence, Internet Footprint, and Exposure | 2026-05-06 | True | | True | | |
| Microsoft: DigiCert Root Certificates Are Malware? Censys in SOC Triage | 2026-05-04 | True | | True | | |
| The cPanel Situation Is… | 2026-05-01 | True | | True | | |
| Oluomo: Microsoft OAuth AiTM Phishing Using a Naturalization-Form Lure | 2026-04-22 | True | | True | | |
| Beyond The Alert: Smarter and Faster IAM Triage with Censys | 2026-04-17 | True | | True | | |
| Rhadamanthys and the Limits of Private Sector Operations | 2026-04-15 | True | | True | | |
| Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs | 2026-04-08 | True | | True | | |
| Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet | 2026-04-06 | True | | True | | |
| Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware | 2026-04-02 | True | | True | | |
| BrewJack: Censys Researchers Uncover First Malware Campaign Targeting IP over Avian Carriers | 2026-04-01 | True | | True | | |
| ICS & Iran, Part 2: Revisiting Exposure of Previously Targeted Devices | 2026-03-30 | True | | True | | |
| Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework | 2026-03-27 | True | | True | | |
| Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker | 2026-03-17 | True | | True | | |
| NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure | 2026-03-12 | True | | True | | |
| Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do | 2026-03-10 | True | | True | | |
| ResidentBat: Belarusian KGB Android Spyware at Internet Scale | 2026-02-24 | True | Kate Lake; Aidan Holland; Senior Security Researcher | True | | |
| Vshell: A Chinese-Language Alternative to Cobalt Strike | 2026-02-24 | True | Kate Lake; Silas Cutler; Principal Security Researcher | True | | |
| Odyssey Stealer: Inside a macOS Crypto-Stealing Operation | 2026-02-11 | True | Ivonne Francia; Aidan Holland; Senior Security Researcher | True | | |
| Malicious Notepad++ Network Infrastructure | 2026-02-03 | True | Ivonne Francia; The Censys Research Team | True | | |
| Hiding in Plain Sight: Tracking Bulletproof Hosting and Abused RDP Infrastructure | 2026-02-03 | True | Ivonne Francia; Himaja Motheram | True | | |
| Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access | 2026-02-02 | True | Ivonne Francia | True | | |
| AsyncRAT C2 Activity at Internet Scale | 2026-01-29 | True | Andrew Northern; Principal Security Researcher | True | | |
| Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface | 2026-01-22 | True | Andrew Northern; Principal Security Researcher | True | | |
| ErrTraffic: Inside a GlitchFix Attack Panel | 2026-01-20 | True | Aidan Holland; Senior Security Researcher | True | | |
| Unauthenticated Message Queues are a Problem | 2026-01-06 | True | Mark Ellzey; Senior Security Researcher | True | | |
| Recap of a Suspicious Surge in Cobalt Strike | 2025-12-23 | True | Mark Ellzey; Senior Security Researcher | True | | |
| Investigating the Infrastructure Behind DDoSia's Attacks | 2025-12-15 | True | Silas Cutler; Principal Security Researcher | True | | |
| Using Cobalt Strike to Find (More) Cobalt Strike | 2025-12-01 | True | Mark Ellzey; Senior Security Researcher | True | | |
| EtherHiding: Fake CAPTCHAs, Click-Fix Lures, and Blockchain-Backed Payload Delivery | 2025-11-21 | True | Andrew Northern; Principal Security Researcher | True | | |
| Censys Threat Overview: Mapping Remcos C2 Activity at Internet Scale | 2025-11-14 | True | Andrew Northern; Principal Security Researcher | True | | |
| Who's Knocking on Your Door? An Analysis of Exposed Services and Their Risks | 2025-11-07 | True | Jean Pierre Ruiz Ocampo; Jonas Gyllenhammar | True | | |
| From Evasion to Evidence: Exploiting the Funneling Behavior of Injects | 2025-11-03 | True | Jean Pierre Ruiz Ocampo; Andrew Northern; Principal Security Researcher | True | | |
| Unpacking the Oracle EBS Debacle: Industries, Geography, and MOVEit Comparisons | 2025-10-23 | True | Ivonne Francia; Emily Austin | True | | |
| Disallow: /security-research? Crypto Phishing Sites' Failed Attempt to Block Investigators | 2025-09-29 | True | Ivonne Francia; Emily Austin | True | | |
| Ollama Drama: Investigating the Prevalence of Ollama Open Instances with Censys | 2025-09-24 | True | Ivonne Francia; The Censys Research Team | True | | |
| A Look at PolarEdge Adjacent Infrastructure | 2025-09-23 | True | Ivonne Francia; The Censys Research Team | True | | |
| Internet Archaeology: A Decade of Defaced Routers? | 2025-09-03 | True | Ivonne Francia; Emily Austin | True | | |
| A look at PolarEdge Adjacent Infrastructure | 2025-08-28 | True | Jean Pierre Ruiz Ocampo; The Censys Research Team | True | | |
| 2025 State of the Internet Report: Summary and Conclusions | 2025-08-25 | True | Ivonne Francia; The Censys Research Team | True | | |
