The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

The Miasma credential-stealing attack framework, which has recently targeted open-source ecosystems through supply-chain attacks, was briefly open-sourced on GitHub. Miasma appears to be an evolution ...

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in ...

Microsoft Threat Intelligence is warning Windows users about a cryptocurrency clipper strain of malware transmitted via USB drives. The malware, which has been affecting users since February, steals ...

North Korean hackers are targeting open source software developers with a backdoor and an information stealer as part of a ...

Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social ...

The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp.

The latest email threats: real Microsoft login phishing, device code scams with a kill switch, split-click attacks, and the ...

The author of Java property-testing tool jqwik did not want AI coding agents using his project. So he told them not to. Then he went one step further: he added a message to the tool's output telling ...

StegoAd Microsoft Edge extensions malware affected up to 2.6 million users after the company removed 119 add-ons that hid ...