HalluSquatting exploits AI coding assistants that hallucinate fake repository names, letting attackers register those names ...

From late April 2026 to mid-June 2026, Microsoft Defender Experts observed increased ACR Stealer activity across customer ...

One of the Russian government’s most elite hacking groups has adopted an attack, known as Clickfix, to compromise devices ...

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

What a time to be alive.

JFrog finds 148 npm proxy packages turned student browsers into a DDoS botnet, while a mutable loader lets operators re-arm ...

Malicious jscrambler 8.14.0 runs hidden binaries during npm install on Windows, macOS, and Linux, with no fix available as of ...

Researchers at the AI Now Institute developed a proof-of-concept exploit showing common AI tools used for security could ...

Varonis Systems, Inc. (NASDAQ: VRNS), the data and AI security leader, today announced support for Cursor, the AI-native coding tool. Varonis Atlas provides runtime enforcement, threat detection, and ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import time — not install time — evading npm v12’s script-blocking defaults and ...

Researchers have found a never-before-seen piece of macOS malware that combines a series of clever tradecraft to infect Macs with stealthy, custom-developed credential-stealing code. The malware is ...

Researchers say the highly effective social engineering technique is no longer the exception for malware attacks — it's now the rule.