Hacking Techniques Tracker
How the hacking techniques behind today's attacks work, how they are advancing, and what actually stops them. Every page is built from the attacks we report, and updated as new cases come in.
New
Exploiting VPNs, firewalls and edge devices
Breaking in through internet-facing equipment (VPN gateways, firewalls, remote-access appliances) using unpatched or unknown flaws.
New
Phishing and session hijacking
Fake sign-in pages and messages that steal passwords, one-time codes or the session cookie that keeps you logged in.
New
Attacks using or targeting AI
Criminals using AI to scale attacks, and attacks on AI systems themselves, such as prompt injection against AI assistants and agents.
New
Software supply-chain attacks
Planting malicious code in software people already trust: open-source packages, browser extensions, updates or build systems.
New
Help-desk and phone social engineering
Callers impersonating staff or IT support to reset passwords, enrol new devices or talk employees into handing over access.
New
Crypto wallet and exchange theft
Stealing digital assets: draining exchange hot wallets, hijacking signing keys, exploiting smart contracts or cross-chain bridges.
Steady
Ransomware and data extortion
Locking an organisation's systems and/or stealing its data, then demanding payment to unlock or not publish it.
Steady
MFA fatigue and MFA bypass
Getting past two-factor sign-in: flooding a user with approval prompts, stealing codes, or abusing account recovery.
Steady
Infostealer malware
Malware that quietly copies saved passwords, browser cookies and crypto wallets from a computer and sends them to criminals.
Steady
Cloud account and token abuse
Using stolen cloud logins, API keys or access tokens to get into company cloud accounts and the data in them.
Steady
Fake IT workers and insider access
Fraudsters, often working for North Korea, getting hired under false identities to earn money and gain inside access.
Steady
Deepfake voice and video fraud
AI-cloned voices and faces used to impersonate executives, relatives or officials and push victims into paying or sharing access.
Steady
SIM swapping
Taking over someone's phone number by tricking or bribing a mobile carrier, then using it to receive their security codes.
Steady
Business email compromise and invoice fraud
Hijacked or spoofed business email used to redirect payments, change bank details or request urgent transfers.
How we track this: each story we publish about an attack is matched to the techniques it involves. "Rising" means more attacks in our reporting over the last 90 days than the 90 before; "Cooling" means fewer. It measures what we have reported, not every attack in the world. Deep dives are written from our own fact-checked stories, reviewed by an editor, and never include instructions for carrying out an attack.