Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.

The post TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack appeared first on SecurityWeek.

Other noteworthy stories that might have slipped under the radar: US gov targets 72-hour patch cycles, malware uses Windows Phone Link to steal OTPs, spy operation targets Eurasian drone industry.

The post In Other News: Train Hacker Arrested, PamDOORa Linux Backdoor, New CISA Director Frontrunner appeared first on SecurityWeek.

The malware framework targets web applications and cloud environments, including AWS, Docker, Kubernetes, and more.

The post ‘PCPJack’ Worm Removes TeamPCP Infections, Steals Credentials appeared first on SecurityWeek.

The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.

The post Vendor Says Daemon Tools Supply Chain Attack Contained appeared first on SecurityWeek.

The persistent, evasive implant provides remote access, surveillance, and credential exfiltration capabilities.

The post Sophisticated Quasar Linux RAT Targets Software Developers appeared first on SecurityWeek.

While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.

The post Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack appeared first on SecurityWeek.

The stealthy Python-based backdoor framework deploys a persistent Windows implant likely designed for espionage.

The post Sophisticated Deep#Door Backdoor Enables Espionage, Disruption appeared first on SecurityWeek.

Threat actors are relying on social engineering to lure users into downloading files containing malicious instructions.

The post Hugging Face, ClawHub Abused for Malware Distribution appeared first on SecurityWeek.

The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.

The post SAP NPM Packages Targeted in Supply Chain Attack appeared first on SecurityWeek.

Over 70 cloned Open VSX extensions are likely sleeper extensions designed to distribute malware.

The post Dozens of Open VSX Extension Clones Linked to GlassWorm Malware appeared first on SecurityWeek.

The threat actor infected victims with the Snow malware family – Snowbelt, Snowglaze, and Snowbasin – for persistent access.

The post UNC6692 Uses Email Bombing, Social Engineering to Deploy ‘Snow’ Malware appeared first on SecurityWeek.

A race condition in PackageKit allows unprivileged users to escalate privileges when installing packages.

The post Easily Exploitable ‘Pack2TheRoot’ Linux Vulnerability Leads to Root Access appeared first on SecurityWeek.

Dubbed GopherWhisper, the group relies on multiple Go-based backdoors alongside custom loaders and injectors.

The post China-Linked APT GopherWhisper Abuses Legitimate Services in Government Attacks appeared first on SecurityWeek.

It targeted high-precision calculation software to tamper with results and packed a self-propagation mechanism.

The post Pre-Stuxnet Sabotage Malware ‘Fast16’ Linked to US-Iran Cyber Tensions appeared first on SecurityWeek.

The malware provides remote access and control of infected devices and maintains post-patching persistence.

The post US Federal Agency’s Cisco Firewall Infected With ‘Firestarter’ Backdoor appeared first on SecurityWeek.

Dubbed Lotus Wiper, the malware targets recovery mechanisms, overwrites drives, and systematically deletes files.

The post New Wiper Malware Targeted Venezuelan Energy Sector Prior to US Intervention  appeared first on SecurityWeek.

The exploitation of the command injection vulnerability started one year after public disclosure and PoC exploit code publication.

The post Mirai Botnet Targets Flaw in Discontinued D-Link Routers appeared first on SecurityWeek.

Researchers discovered a remote code execution vulnerability and cybercriminals are using its reputation to deliver malware.

The post Google Antigravity in Crosshairs of Security Researchers, Cybercriminals appeared first on SecurityWeek.

Masquerading as popular cryptocurrency wallets, the apps can hijack recovery phrases and private keys.

The post Dozens of Malicious Crypto Apps Land in Apple App Store appeared first on SecurityWeek.

The machine emulator has been abused in at least two different campaigns distributing ransomware and remote access tools.

The post Hackers Abuse QEMU for Defense Evasion appeared first on SecurityWeek.