Massive ChainDrop Supply-Chain Attack Spreads Malware to Hundreds of npm Packages In a devastating blow to cybersecurity, a self-propagating malware named ‘ChainDrop’ has compromised over 1,300 packages on the Node Package Manager (npm) registry, affecting hundreds of millions of users. The attack began when a threat actor compromised the GitHub account of a popular package … Read more
A wave of fake Adobe and Zoom software updates has been spreading online, installing a remote access tool called ScreenConnect on unsuspecting users’ devices. This alarming trend not only highlights the ongoing threat of malware but also underscores the potential for persistent remote access to sensitive systems. The malicious updates appear to be genuine at … Read more
A widespread attack has been unleashed on the npm package repository, compromising hundreds of packages and potentially leaving thousands of developers vulnerable. The malicious campaign, linked to a vulnerability in the Keyv library, has resulted in the poisoning of popular development tools like Claude Code and VS Code Hooks. At its core, the attack exploits … Read more
Cybersecurity Threat Unfolds as ChainDrop Malware Infects 1,300 npm Packages In a shocking display of supply-chain attacks, over 1,300 packages on the Node Package Manager (npm) registry have been compromised by self-propagating malware named ‘ChainDrop’. This attack has already spread to hundreds of popular applications, including caching utilities from the same maintainer. The scale and … Read more
Google has taken swift action to delete three AI workflows from its cloud platform after a malicious issue was discovered on GitHub that could have potentially triggered privileged access. The incident highlights the risks of identity exposure and the importance of securing sensitive workflows in cloud environments. The affected workflows were using Google’s Cloud Development … Read more
As we’ve seen time and time again, cyber threats are constantly evolving. The latest twist on this theme is a new tactic that combines social engineering with artificial intelligence (AI) to compromise even the most secure systems. Dubbed “vibe hacking,” this emerging threat leverages AI-driven reconnaissance to pinpoint vulnerabilities in an organization’s defenses, effectively turning … Read more
A new wave of malicious updates has been circulating, posing as legitimate software from Adobe and Zoom. These fake updates are not only installing unwanted software but also granting hackers persistent remote access to compromised computers. The affected parties are widespread, with reports indicating that individuals in various industries have fallen victim to this scheme. … Read more
**A Sneaky npm Worm Spreads Malware, Threatening Thousands of Packages** In a worrying trend, hundreds of software packages on the popular npm (Node Package Manager) repository have been compromised by a malicious worm, dubbed “Keyv-Linked”. This insidious attack injects malware into innocent codebases, exploiting vulnerabilities in widely-used development tools like Claude Code and Visual Studio … Read more
A Critical Flaw in TP-Link’s Omada Ecosystem Puts Networks at Risk of Complete Takeover Security researchers have uncovered a chain of vulnerabilities in the zero-touch provisioning (ZTP) systems used by TP-Link’s Omada networking ecosystem, which can be exploited to compromise entire fleets of managed devices. The affected ZTP protocols allow routers, switches, and access points … Read more
A New Wave of Cyber Threats Exploits Web Browser Vulnerabilities, Leaving Millions Exposed The past few weeks have seen a surge in reports of a sophisticated cyber threat campaign, dubbed DoubleCup, which leverages two clever tactics to deliver highly advanced malware. The attackers are exploiting vulnerabilities in popular web browsers to gain unauthorized access to … Read more