Armorsteal uses Python, PyArmor, scheduled tasks, credential theft, keylogging, and crypto mining to compromise Windows systems ...

Attackers have taken over 10 npm packages and slipped hidden code into 12 releases. The code uses the Ethereum blockchain to find a server and download more malware.

Hackers are spreading a Python-based malware kit called ArmorSteal through fake software download pages. The kit steals ...

Fake GitHub security tools are spreading malware that disables defenses, steals sensitive data and infects over 2,000 PCs.

Threat actors are distributing malicious GitHub projects disguised as security utilities to infect developers with AsyncRAT, ...

How a fake Google Update Support extension installs its components and runs the editor's own Electron binary as a Node ...

A Python startup hook, a second runtime fetched at load, and the rule files of 14 AI coding agents rewritten. The campaign ...

Binance says a fake job interview and malicious code repository led to its $6.3B theft. Here is what the fake job interview ...

Cursor reported on October 29, 2026 that a maliciously modified build of the Claude Code extension, Anthropic.claude-code 2.1.313, was available in its extension marketplace and tries to install a ...

A crypto-mining campaign abusing Hugging Face models returned days after takedown, hijacking GPU servers and planting backdoors, with one model downloaded over 28,000 times. Separately, a fake Solana ...