GPUGate malware uses Google Ads and fake GitHub commits to steal data from IT firms since Dec 2024, bypassing sandboxes and GPU-lacking systems.

Thousands of secrets such as PyPI and AWS keys, GitHub tokens, and more, were stolen recently during a supply-chain attack ...

The integration between Salesforce and the Salesloft platform has been restored after an investigation by Mandiant linked an ...

Cybercriminals use fake troubleshooting websites to trick Mac users into running terminal commands that install Shamos malware through ClickFix tactics.

Most Android devices default to the Google Play Store for downloading and installing apps, but it's far from the only place ...

Qix is an open source maintainer account that was compromised by a phishing attack. This allowed attackers to infect 18 popular npm packages with malicious code. Together, these packages are ...

The software giant will pay to use Anthropic’s Claude models for some Office 365 Copilot features, according to The ...

This all works through the Home Assistant MQTT Discovery protocol, which is implemented in the extension. It reports to a ...

The "largest npm compromise in history" targeting crypto wallets through JavaScript packages has netted hackers just $1,043.

At least 18 popular JavaScript code packages that are collectively downloaded more than two billion times each week were briefly compromised with malicious software today, after a developer involved ...

Hackers are sharing malicious SVG files which spoof real-life websites in order to trick victims into downloading damaging items. Cybersecurity researchers VirusTotal spotted the malware after adding ...

On September 8, 2025, a single phishing email triggered one of npm’s most damaging supply chain attacks, compromising 18 ...