Malware & Threats
Supply chain attack compromises the popular rand-user-agent NPM package to deploy and activate a backdoor.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Malware & Threats
The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.
Malware & Threats
Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms.
Malware & Threats
Three NPM packages posing as developer tools for Cursor AI code editor’s macOS version contain a backdoor.
Malware & Threats
Russia-linked APT Star Blizzard is using the ClickFix technique in recent attacks distributing the LostKeys malware.
Malware & Threats
Meta has won its WhatsApp hacking lawsuit against Israeli spyware company NSO Group in an “important step forward for privacy and security”.
Malware & Threats
Noteworthy stories that might have slipped under the radar: NullPoint Stealer source code leaked, researcher earns $17,500 from Apple for vulnerability, BreachForums down after...
Malware & Threats
ESET has analyzed Spellbinder, the IPv6 SLAAC spoofing tool Chinese APT TheWizards uses to deploy its WizardNet backdoor.
Data Breaches
The latest Verizon DBIR landed this week with a startling statistic about the security posture of VPNs and network edge devices.
Malware & Threats
Security researchers detail various malware campaigns that use bulletproof services linked to Proton66 ASN.
Fraud & Identity Theft
North Korean cryptocurrency thieves abusing Zoom Remote collaboration feature to target cryptocurrency traders with malware.
Malware & Threats
Windows versions of the BrickStorm backdoor that the Chinese APT used in the MITRE hack last year have been active for years.
Malware & Threats
The vulnerabilities are described as code execution and mitigation bypass issues that affect Apple’s iOS, iPadOS and macOS platforms.
Malware & Threats
In recent attacks, the state-sponsored backdoor BPFDoor is using a controller to open a reverse shell and move laterally.
Malware & Threats
In the past months Microsoft has seen multiple campaigns involving Node.js to deliver malware and other malicious payloads.
Incident Response
The business services provider confirms personal information such as names and Social Security numbers was stolen in a January cyberattack.
Malware & Threats
The flaw, tagged as CVE-2025-30406, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in early April.
Malware & Threats
A threat actor claims to offer a zero-day exploit for an unauthenticated remote code execution vulnerability in Fortinet firewalls.
Cybercrime
Organizations in the healthcare and pharmaceutical sectors have been targeted with ResolverRAT, a new malware family with advanced capabilities.
Incident Response
The CVE-2025-22457 has already been exploited by a China-nexus hacking gang notorious for breaking into edge network devices.
Malware & Threats
Law enforcement agencies in multiple countries have announced the arrests of users of the malicious Smokeloader botnet.
Malware & Threats
CAPTCHA-evading Python framework AkiraBot has spammed over 80,000 websites with AI-generated spam messages.
Join this live webinar for a practical framework for evolving your AI security program from a single application to an enterprise AI ecosystem and autonomous agents.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)