A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

A macOS ClickFix campaign uses more than 250 domains and server-side fingerprinting to hide AMOS lures from crawlers and ...

A Russian state-linked hacking group has been quietly raiding email accounts at NATO government agencies, defense contractors, and critical infrastructure operators since mid-2025 using a zero-click ...

Russian state-sponsored hackers are exploiting a Microsoft Exchange Outlook Web Access vulnerability to deploy OWAReaper, a webmail backdoor designed for long-term mailbox access. The group, known as ...

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

Cybercriminals have found an unsettlingly clever use for blockchain’s most celebrated feature: immutability. A malware campaign identified by Microsoft Threat Intelligence is using smart contracts on ...

A Zimbra phishing campaign attributed to Russian state-supported cyber actors has targeted Western government and commercial organizations, exploiting CVE-2025-66376 to access sensitive email data and ...

The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access ...

Filters don't stop prompt injection; architecture does. A field guide to the lethal trifecta, the rule of two, Dual-LLM and ...