In September and October, researchers at Arctic Wolf Labs uncovered a new wave of cyber-espionage targeting the diplomatic institutions of Hungary and Belgium. According to their findings, the campaign was orchestrated by the Chinese...
The Eclipse Foundation has revoked several compromised access tokens associated with publishing extensions to the open Open VSX repository. The investigation was prompted by a report from Wiz, a company specializing in cloud security....
A sharp surge in attacks targeting PHP servers, Internet of Things (IoT) devices, and cloud gateways has been recorded by researchers from the Qualys Threat Research Unit (TRU). According to their findings, the escalation...
The ongoing PhantomRaven campaign has targeted developers via the npm registry, disseminating dozens of malicious packages across the ecosystem in a short span. Embedded within these packages, malicious code harvests authentication tokens, CI/CD secrets,...
Midway through this year, specialists at Arctic Wolf uncovered a sprawling malicious campaign that spread across South America, Africa, and Eastern Europe. At its core lay a tool of Brazilian origin known as Caminho...
The Coveware report on ransomware activity for the third quarter of 2025 paints a paradoxical picture. On one hand, mass-scale Ransomware-as-a-Service (RaaS) campaigns continue to flood mid-tier companies; on the other, there is a...
After a brief period of dormancy, the operator of the LockBit ransomware has returned to full-scale activity, unveiling a new and more sophisticated version of its malware. In the spring of 2024, the group’s...
The malicious modification of Telegram X, discovered by specialists at Doctor Web, turned out to be far more than a simple espionage tool—it is a fully fledged platform for the covert takeover and remote...
Trend Research has detailed a new wave of attacks carried out by the Agenda ransomware group, which has developed the ability to execute a Linux variant of its encryptor within Windows-based environments. This tactic...
In recent weeks, the activity of the Vidar Stealer malware has surged dramatically — its new version 2.0 emerged amid the decline of Lumma Stealer’s dominance and has already captured the attention of cybercriminal...
A multi-stage phishing campaign known as Tykit has been targeting Microsoft 365 corporate users, actively employed to steal login credentials. Researchers at ANY.RUN have observed a surge in its activity since May 2025, reaching...
Hackers have unleashed a new self-propagating malware dubbed GlassWorm, which first infiltrated the Visual Studio Code extension ecosystem via the OpenVSX marketplace. Researchers at Koi Security found that the worm conceals malicious code using...
