GlassWorm's fake VS Code theme extensions show why Workspace Trust alone cannot prevent malicious IDE extensions from compromising developer environments.
A technical anatomy of the first self-propagating supply-chain worm to target AI agent memory infrastructure through malicious npm and PyPI packages, explaining how it spreads and what defensive controls matter.
GHAPPIER abused npm trusted publishing and GitHub Actions OIDC workflows to compromise 65 repositories and push a malicious loader through a poisoned package, exposing how CI/CD trust can be turned into an attack surface.
The WaterPlum campaign turned fake coding tests into a supply-chain attack vector, infecting roughly 30,000 developer machines with persistent RATs while siphoning $10.7 million in crypto, and it exposes how casually most teams execute untrusted code from job candidates.
A fake LastPass download campaign abused GitHub's trusted reputation and poisoned Google search results to deliver the Rapuncel password-stealing malware to developer machines, exposing how brittle repository-based trust signals really are.
Learn how attackers are abusing FortiGate firewalls as a foothold for custom Node.js malware and what logs and running processes security teams should inspect to spot the implant early.
This post examines how attackers are abusing the trusted Node.js runtime as a malware delivery mechanism on enterprise hosts, with practical indicators and defensive guidance for security teams.
A cybersecurity analysis of how an apparent malware infection exposed hackers’ RATs, phishing kits, and command-and-control infrastructure, with detection-focused takeaways for defenders.
Claude Code’s Auto Mode is examined through a malware incident that exposed a missing permission boundary and highlighted how AI coding tools can still execute unsafe actions despite built-in safeguards.
This post examines how malicious Rust crates amassed 245 million downloads in a crates.io supply-chain attack, what the incident reveals about North Korean attribution, and where Cargo’s current safety checks still leave gaps for developers.
A technical security analysis of how Android IVI head units can be abused as proxy nodes in a botnet, with a focus on infection paths, risk exposure, and defensive controls.
An analysis of how attackers use fake CAPTCHA prompts in the browser to deliver malware that disables endpoint security, along with practical detection and defense strategies across the browser and network layers.
A technical breakdown of how AmnesiaStealer targets macOS users through GitHub supply chain abuse, remote browser control, and session hijacking tactics.
An examination of how cyber spies reportedly used GitHub-hosted malware to compromise EncroChat, and what the intrusion reveals about supply-chain abuse in espionage.
An analysis of how attackers abused more than 20 hijacked government websites to deliver malware through trusted links, and what this reveals about modern link-based threat tactics.
This article examines how North Korean threat actors used OTTERCOOKIE malware hidden inside SVG files to infiltrate and backdoor developer environments, with practical indicators and defenses for security-minded engineering teams.
Miasma’s latest npm payload shifts from worm behavior to a RAT-first approach with automatic propagation disabled, signaling a stealthier supply-chain threat for developers and package maintainers.
This post examines how adaptive malware can regenerate attack capabilities to bypass signature-based defenses and why behavioral signals offer a stronger real-time detection path.
This post examines the SNOW malware ecosystem’s use of Microsoft Teams phishing, WebSocket-based command-and-control tunnels, and malicious browser extensions to create covert channels for stealthy intrusion and persistence.
A technical analysis of TrojPix, a malware technique that can exfiltrate data from air-gapped computers using electromagnetic emissions from up to 208 meters away.
Fake Google and Cloudflare verification pages are being used to deliver multiple malware families, making it important for developers to test for phishing-style trust abuse, malicious redirects, and user-interface spoofing.
A practical security analysis of how attackers used fake Cisco AnyConnect and Google Update installers with JavaScript-based delivery to drop SharkLoader and evade scrutiny.
This post traces Avalon’s LOLBin abuse chain to CrownX ransomware activity and shows how Sigma rules can help defenders detect the behavior early.
An analysis of the Ousaban malware campaign that uses phishing PDFs and a VBS downloader to steal banking tokens from Iberian users.