 | Neither Malware nor Harmless: Tracking the NPS Proxy Across the Internet | 2026-09-04 | True | | True | | |
| So Your CFO's Phone Has Been Pwned: A DFIR Journey | 2026-08-31 | True | | True | | |
| The Video That Plays You: Fake MP4 File Carries Malicious Payload | 2026-08-28 | True | | True | | |
| What the ERMAC Source Leak Says About HookBot | 2026-08-25 | True | | True | | |
| Mirai and Its Heirs: A Decade of Structural Neglect in IoT Security | 2026-08-07 | True | | True | | |
| Introducing Censys IOC Investigator: Run Every Lead Like You’ve Got Hours | 2026-07-31 | True | | True | | |
| DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster | 2026-07-31 | True | | True | | |
| CISA Alert: Water Sector PLC Targeting | 2026-07-31 | True | | True | | |
| A Chill in the Air: Cl0p Targets Windchill, Another Enterprise Software Product | 2026-07-30 | True | | True | | |
| The State of the Internet Is Changing: AI Exposures Surge While Global ICS Trends Shift | 2026-07-23 | True | | True | | |
| Censys Is The OmniFeed: Crunch Your Own Threat Intelligence | 2026-07-21 | True | | True | | |
| Inside Russia’s Camera-Hacking Espionage Campaign | 2026-07-16 | True | | True | | |
| Roblox, Minecraft, and the Insidious Internet for Children | 2026-07-02 | True | | True | | |
| Why Are WordPress Sites Still Running EOL PHP? | 2026-07-01 | True | | True | | |
| AsyncRAT Family Threat Overview | 2026-06-26 | True | | True | | |
| UNC1151 Phishing Email Targeting Belarusian Politician Points to Multi-National Campaign | 2026-06-26 | True | | True | | |
| AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale | 2026-06-17 | True | | True | | |
| REDCap on the Internet: An Exposure Analysis | 2026-06-16 | True | | True | | |
| The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data | 2026-06-12 | True | | True | | |
| How a Dangling DNS Entry Can Lead to a Subdomain Takeover | 2026-06-05 | True | | True | | |
| MCP Servers on the Internet | 2026-05-27 | True | | True | | |
| Iran-Linked Operators Suspected in ATG Breaches | 2026-05-18 | True | | True | | |
| The Ultimate Guide to Detection Engineering with Censys | 2026-05-12 | True | | True | | |
| Password Manager Infrastructure in the Wild: Surveying Prevalence, Internet Footprint, and Exposure | 2026-05-06 | True | | True | | |
| Microsoft: DigiCert Root Certificates Are Malware? Censys in SOC Triage | 2026-05-04 | True | | True | | |
| The cPanel Situation Is… | 2026-05-01 | True | | True | | |
| Oluomo: Microsoft OAuth AiTM Phishing Using a Naturalization-Form Lure | 2026-04-22 | True | | True | | |
| Beyond The Alert: Smarter and Faster IAM Triage with Censys | 2026-04-17 | True | | True | | |
| Rhadamanthys and the Limits of Private Sector Operations | 2026-04-15 | True | | True | | |
| Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs | 2026-04-08 | True | | True | | |
| Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet | 2026-04-06 | True | | True | | |
| Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware | 2026-04-02 | True | | True | | |
| BrewJack: Censys Researchers Uncover First Malware Campaign Targeting IP over Avian Carriers | 2026-04-01 | True | | True | | |
| ICS & Iran, Part 2: Revisiting Exposure of Previously Targeted Devices | 2026-03-30 | True | | True | | |
| Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework | 2026-03-27 | True | | True | | |
| Exposure Brief: Iranian-Linked Wiper Attack on Global Medtech Firm Stryker | 2026-03-17 | True | | True | | |
| NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure | 2026-03-12 | True | | True | | |
| Hunting Cameras in the Dark: Finding Internet Cameras Before Adversaries Do | 2026-03-10 | True | | True | | |
| ResidentBat: Belarusian KGB Android Spyware at Internet Scale | 2026-02-24 | True | Kate Lake; Aidan Holland; Senior Security Researcher | True | | |
| Vshell: A Chinese-Language Alternative to Cobalt Strike | 2026-02-24 | True | Kate Lake; Silas Cutler; Principal Security Researcher | True | | |
| Odyssey Stealer: Inside a macOS Crypto-Stealing Operation | 2026-02-11 | True | Ivonne Francia; Aidan Holland; Senior Security Researcher | True | | |
| Malicious Notepad++ Network Infrastructure | 2026-02-03 | True | Ivonne Francia; The Censys Research Team | True | | |
| Hiding in Plain Sight: Tracking Bulletproof Hosting and Abused RDP Infrastructure | 2026-02-03 | True | Ivonne Francia; Himaja Motheram | True | | |
| Voicemail Trap: German-Language Voicemail Lure Leads to Remote Access | 2026-02-02 | True | Ivonne Francia | True | | |
| AsyncRAT C2 Activity at Internet Scale | 2026-01-29 | True | Andrew Northern; Principal Security Researcher | True | | |
| Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface | 2026-01-22 | True | Andrew Northern; Principal Security Researcher | True | | |
| ErrTraffic: Inside a GlitchFix Attack Panel | 2026-01-20 | True | Aidan Holland; Senior Security Researcher | True | | |
| Unauthenticated Message Queues are a Problem | 2026-01-06 | True | Mark Ellzey; Senior Security Researcher | True | | |
| Recap of a Suspicious Surge in Cobalt Strike | 2025-12-23 | True | Mark Ellzey; Senior Security Researcher | True | | |
| Investigating the Infrastructure Behind DDoSia's Attacks | 2025-12-15 | True | Silas Cutler; Principal Security Researcher | True | | |
