Latest IntelligencePage 223
Search by keyword →China's TA4922 Expands Cybercrime Attacks Globally
One of the world's most diverse, least-focused cybercrime groups is enlarging its footprint beyond East Asia....
Hackers Impersonate Ghidra, dnSpy, and SpiderFoot to Spread Malware via Fake Download Sites
Hackers are creating convincing fake websites that impersonate popular security tools to trick users into downloading malware. Instead of obvious phishing pages...
.webp)
binding.gyp Supply Chain Attack Compromises Dozens of npm Packages Across Maintainer Accounts
A self-replicating worm has been quietly spreading across the npm registry using a method most security teams do not watch for. Instead of hiding inside package...
4 Critical Threats Where Attackers Have the Advantage
Gartner analysts issued a call to action to bolster defenses against several emerging critical threats, such as deepfakes and prompt injections....
Brave launches minimalist Origin browser with only core privacy features
Brave has officially launched Brave Origin, a new premium version of its browser designed for users who want Brave's privacy protections without the company's g...
Credit card theft campaign abuses Stripe to host stolen payment info
A new Magecart campaign is using Stripe's API infrastructure to host the credit card-stealing payload and the data exfiltrated from checkout pages. [...]...
Hackers Use Malicious Ads to Deliver FlutterShell Backdoor on macOS Systems
A new and rapidly spreading malware campaign is putting macOS users at serious risk. Threat actors are using Google Ads to push fake desktop applications that s...
Hackers Use Fake Claude Code Install Page to Deliver Fileless .NET Infostealer
Hackers are exploiting the excitement around AI coding tools by targeting users who search for Claude Code installation guides. An active campaign uses fake ins...
IronWorm Supply Chain Attack Uses Malicious npm Packages to Steal Developer Secrets
A newly discovered malware campaign called IronWorm has been silently targeting software developers through poisoned npm packages, stealing credentials, API key...
DentaQuest data breach exposed info of 2.6 million accounts
A data breach at the dental benefits administrator DentaQuest has reportedly exposed the sensitive data of 2.6 million accounts. [...]...
Stock Exchange Executive’s Outlook Account Targeted to Exfiltrate Credentials
A senior executive at a major global stock exchange had their Microsoft Outlook account silently compromised for five straight months, with attackers carefully ...
CISA Warns of critical Magento Cache Warmer RCE flaw Exploited in Attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about a critical remote code execution vulnerability affecting the...
Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
Cisco has patched a bug in Unified Communications Manager that lets an unauthenticated attacker on the network write files to the box and, from there, climb to ...
Proton Drive adopts OpenPGP encryption, delivers 300% faster uploads
Proton has announced a major cryptographic upgrade for Proton Drive that significantly improves the performance of its end-to-end encrypted cloud storage platfo...
Anthropic’s Claude Oceanus-v1-p Opens to Red Team Testing, but Distribution is Compromised
A next-generation Anthropic model has surfaced in restricted testing channels, but early distribution was already compromised before the evaluation formally beg...
UN food agency discloses breach affecting 600,000 Gaza households
The United Nations' World Food Programme (WFP), the world's largest humanitarian organization, revealed over the weekend that its self-registration application ...
Cybercriminals Shift From Fake Login Pages to Infostealer Malware in Phishing Attacks
Phishing attacks have always been one of the most common ways cybercriminals steal personal and business data. But something has quietly changed about how these...
Hola Browser supply chain breach delivered crypto-miner to users
A supply chain compromise resulted in a crypto-mining executable being distributed alongside certain installations of Hola Browser for Windows. The unexpected c...
New IronWorm malware hits 36 packages in npm supply-chain attack
A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm. [...]...
Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
A security researcher found a flaw in Anthropic's Claude Code GitHub Action that let an attacker take over vulnerable public repositories running it, with nothi...