Play

The GlorySprout or a Failed Clone of Taurus Stealer

Metasploit Wrap Up: A Collection of What Can Only Be Called Eclectic Modules

Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It

SubQuery Ecosystem Compromise: Hidden Credential Theft and Backdoors

@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow

Runtime Security for AWS CodeBuild-Hosted GitHub Actions Runners

Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes

Return of Shai-Hulud: The “Second Coming” of the NPM Supply Chain Compromise

2025 In Review

16 Malicious Firefox Extensions Steal Cryptocurrency Wallet Credentials

SpectrePaste

Botnet Rising Star: The Evolution and In-Depth Technical Analysis of Dysphoria

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

PhishTank (500 entries)

Qbot: A Deep Dive into the Banking Trojan

PhishTank (500 entries)

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

Gamers Get Played: Fake GTA6 Leaks Deliver a Grab Bag of Malware

BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns

China and the Cyber Arms Race for AI Supremacy

The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat

CLOSEDQUORUM: Malware Puts AI in the C2 Loop

FamousSparrow Takes Flight with New SparroWocky Backdoor

Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer

Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations

Update Chrome and ChromeOS to fix critical security issues

PhishTank (500 entries)

Fake Installers, Fake Reviews, Fake Services – Real Proxies, Real Victims

Hold the Phone! International Revenue Share Fraud Driven by Fake CAPTCHAs