The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code.

The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek.

Providing cyberespionage and remote code execution capabilities, the malware is executed via DLL sideloading.

The post APT-Grade PDFSider Malware Used by Ransomware Groups appeared first on SecurityWeek.

The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks.

The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek.

Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware.

The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek.

Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits.

The post VoidLink Linux Malware Framework Targets Cloud Environments appeared first on SecurityWeek.

The Predator spyware is more sophisticated and dangerous than previously realized.

The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek.

The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks.

The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek.

APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals.

The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek.

The North Korean state-sponsored espionage group Kimsuky has targeted government organizations, think tanks, and academic institutions.

The post FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes appeared first on SecurityWeek.

Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity.

The post Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats appeared first on SecurityWeek.

The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands.

The post Hackers Exploit Zero-Day in Discontinued D-Link Devices appeared first on SecurityWeek.

Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections.

The post Sophisticated ClickFix Campaign Targeting Hospitality Sector appeared first on SecurityWeek.

The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations.

The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek.

The 2-million-device-strong botnet allows monetization through DDoS attacks, app installs, and the selling of proxy bandwidth.

The post Kimwolf Android Botnet Grows Through Residential Proxy Networks appeared first on SecurityWeek.

In December, the botnet’s operators focused on weaponizing the flaw to compromise vulnerable Next.js servers.

The post RondoDox Botnet Exploiting React2Shell Vulnerability appeared first on SecurityWeek.

The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.

The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek.

The ‘download’ button on the official EmEditor website served a malicious installer.

The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek.

The package provides legitimate functionality to evade detection, while stealing users’ data and deploying a backdoor.

The post NPM Package With 56,000 Downloads Steals WhatsApp Credentials, Data appeared first on SecurityWeek.

A recent MacSync Stealer version no longer requires users to directly interact with the terminal for execution.

The post MacSync macOS Malware Distributed via Signed Swift Application appeared first on SecurityWeek.

The hacking group has been using Group Policy to deploy cyberespionage tools on governmental networks.

The post Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments appeared first on SecurityWeek.