Found 36 articles
The article reports on a new supply chain attack named 'Shai-Hulud' that has infected 640 NPM packages. This self-replicating worm poses a severe threat as it can erase home directory contents if it fails to propagate to additional repositories.
Infosecurity Magazine
The new Shai-Hulud worm has infected numerous npm packages, significantly disrupting continuous integration and continuous deployment (CI/CD) workflows globally. This incident poses a serious threat to developers and organizations relying on npm for their software development processes.
The Shai-Hulud worm has emerged as a significant cybersecurity threat, infecting nearly 500 open-source packages and compromising over 26,000 GitHub repositories within a 24-hour period. This incident highlights the increasing automation and strength of self-replicating malware, raising concerns about the security of open-source software ecosystems.
The article discusses a new variant of malware that executes malicious code during the preinstallation phase, posing a significant risk to build and runtime environments. This increase in potential exposure highlights the severity of the threat and the need for immediate attention from cybersecurity professionals.
Microsoft has raised concerns about the security risks associated with its new Agentic AI feature, highlighting the potential for AI agents to engage in malicious activities like data exfiltration and malware installation if not properly secured. This underscores the critical need for robust security controls to mitigate these risks.
The Hacker News
This week, significant cybersecurity threats emerged as hackers exploited new 0-day vulnerabilities in Fortinet and Chrome, infiltrating supply chains and SaaS tools. The rapid response from major companies like Microsoft, Salesforce, and Google highlights the severity of these attacks and the ongoing challenges in securing trusted applications and software updates.
Cybercriminals intensify their activities during Black Friday, utilizing tactics such as phishing, scams, and malware to exploit online shoppers and gamers. The severity of these threats underscores the importance of vigilance among consumers, as fake sales and malicious activities proliferate during this shopping season.
CISA has identified that various cyber threat actors are using commercial spyware to target users of mobile messaging applications, employing tactics such as phishing, zero-click exploits, and impersonation. The focus is primarily on high-value individuals including government and military officials, indicating a serious threat to sensitive communications.
The ShadowPad malware is exploiting a recently patched vulnerability in Microsoft Windows Server Update Services (WSUS), identified as CVE-2025-59287, allowing attackers to gain full system access. This exploitation highlights the critical need for organizations to promptly apply security updates to vulnerable systems to prevent unauthorized access.
Chinese cyberspies, identified as APT24, are using supply chain attacks to deploy a malware known as 'BadAudio'. This poses a significant threat as it allows for the installation of additional malicious payloads, highlighting the growing sophistication of cyber espionage tactics.
APT24, a China-nexus threat actor, has been deploying a new malware called BADAUDIO to maintain persistent access to compromised networks over a nearly three-year espionage campaign. This shift to more sophisticated attack vectors poses significant risks to targeted entities, particularly in Taiwan and over 1,000 domains.
The Tsundere botnet, targeting Windows users, is expanding and capable of executing arbitrary JavaScript code from a command-and-control server. This poses a significant threat to users, as the botnet's propagation methods remain unclear, indicating a potential for widespread exploitation.
The newly identified Sturnus Banking Trojan is currently under development and primarily targets messaging applications like WhatsApp, Telegram, and Signal, with a focus on users in Europe. This poses a significant risk to user privacy and security as it aims to exploit sensitive communications.
The 'Eternidade' Trojan is a sophisticated infostealer targeting Brazilian Portuguese speakers, designed to phish banking credentials and steal sensitive data. Its self-propagating nature and unique features tailored for Brazilian users pose significant cybersecurity threats across the region.
This week has highlighted a surge in cybersecurity incidents, including arrests of hackers and the increasing sophistication of espionage activities. The use of everyday technology, such as browser add-ons and IoT devices, for malicious purposes underscores the evolving nature of online threats.