Two popular npm packages from Joyfill—`@joyfill/components` and `@joyfill/pdf`—were compromised and weaponized with DEV#POPPER RAT malware. The malicious versions executed upon installation, establishing persistent backdoor access to developer machines. The attack targeted the JavaScript supply chai
Microsoft has unveiled Project Perception, a comprehensive security framework designed to address the unique challenges posed by artificial intelligence systems. This initiative recognizes that traditional security models are insufficient for protecting AI workloads, prompting a fundamental shift in
A sophisticated threat actor dubbed PhantomEnigma has compromised multiple Brazilian government websites to distribute malware to unsuspecting organizations. The attackers are leveraging the trusted reputation of official government domains to bypass security controls and infect victims with informa
Threat actors are leveraging publicly available security detection rules to craft attacks that deliberately evade defensive measures. By studying open-source signatures, YARA rules, and behavioral indicators published by security vendors and researchers, attackers design malware and attack technique
Threat actors are compromising hotel Wi-Fi gateway systems to intercept and steal Microsoft 365 credentials from business travelers. Attackers exploit vulnerabilities in captive portal systems to inject malicious login pages that mimic legitimate Microsoft authentication screens. Once credentials ar
Google’s search engine inadvertently indexed publicly shared Claude AI chat conversations, exposing potentially sensitive information to anyone conducting targeted searches. Although Anthropic has since implemented measures to prevent indexing, cached versions of these conversations remained accessi
A sophisticated Brazilian banking trojan has been detected actively spreading across Portugal, targeting financial institutions and their customers. The malware employs advanced evasion techniques, including process hollowing, keylogging, and screen capture capabilities to steal banking credentials.
A critical Bluetooth vulnerability in KARR Security’s connected car systems affects approximately 2.2 million vehicles worldwide, allowing attackers to remotely unlock doors and disable engine immobilizers. The flaw stems from weak authentication mechanisms in the mobile app’s communication protocol
Check Point has issued emergency patches for an actively exploited vulnerability in SmartConsole that allows attackers to gain full administrative access without authentication. The flaw, tracked as CVE-2024-24919, affects multiple versions of Check Point’s management software and has been observed
South Korea’s National Diplomatic Academy (NDA) suffered a significant data breach exposing sensitive information of thousands of foreign ministry officials and diplomats. The compromised data includes personal identification details, contact information, and potentially classified diplomatic commun
