Malware & Threats
Published through five accounts, the extensions appear part of a coordinated campaign based on shared C&C infrastructure.
Hi, what are you looking for?
SecurityWeek
Malware & Threats
The spyware-equipped Manic, a persistent Grandoreiro campaign in Latin America and Europe, and an expanded ToxicPanda 2.0 malware.
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Malware & Threats
The Rust-based macOS infostealer harvests users’ passwords, keychain information, Chromium-based browser data, and Safari cookies.
Malware & Threats
Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms.
Malware & Threats
Researchers found adware capable of killing cybersecurity products and pushing more dangerous payloads to infected systems.
Malware & Threats
Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT.
Malware & Threats
The malware mimics the legitimate Anthropic installation, relies on DLL sideloading, and cleans up after itself.
Malware & Threats
Focused on persistence, the botnet does not engage in widespread infection and avoids blacklisted IPs and critical infrastructure entities.
Malware & Threats
The APT28 threat group exploited vulnerable TP-Link and MikroTik routers to conduct adversary-in-the-middle (AitM) attacks.
Malware & Threats
Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.
Malware & Threats
Other noteworthy stories that might have slipped under the radar: Symantec vulnerability, anti-ClickFix mechanism added to macOS, FBI hack classified as major incident.
Malware & Threats
Using automated scanning and the Nexus Listener collection framework, the hackers compromised over 750 systems.
Malware & Threats
The malware can spy on victims, steal their information, and make configuration changes on devices.
Malware & Threats
The malware steals credentials, installs a malicious browser extension, and can spread via USB drives.
Malware & Threats
Licensed malware with built-in persistence and automation enables attackers to continuously siphon credentials, session data, and cryptocurrency assets.
Malware & Threats
Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux.
Malware & Threats
The infection chain includes a fake CAPTCHA page, a Bash script, a Nuitka loader, and the Python-based infostealer.
Cybercrime
Hambardzum Minasyan of Armenia has been accused of being involved in the development and administration of the infostealer malware.
Application Security
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Malware & Threats
The FBI has published an alert describing the malware used by Iranian government hackers.
Malware & Threats
Insufficient sanitization of CSS content within HTML emails leads to inline script execution when the message is opened in a browser.
Malware & Threats
The medtech giant has been working on restoring systems affected by the cyberattack conducted by the Handala hackers.
Malware & Threats
The botnet has increased its activity, peaking at 15,000 exploitation attempts per day, and taking a more targeted approach.
Join this live webinar for a practical framework for evolving your AI security program from a single application to an enterprise AI ecosystem and autonomous agents.
RegisterIn this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk.
RegisterExpert Insights
The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job.
(Sravish Sridhar)
As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk.
(Joshua Goldfarb)
Organizations are rushing to implement AI without fully grasping where its legal protections begin and end.
(Steve Durbin)
Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use.
(Etay Maor)
The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change.
(Matt Honea)