Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Shai-Hulud Worm: Self-Propagating Malware Hits 180+ NPM Packages in Major Supply Chain Breach
In September 2025, a novel self-replicating worm, dubbed 'Shai-Hulud,' targeted the JavaScript NPM ecosystem by infecting over 180 code packages. The malware exploited developer authentication tokens found on Linux and macOS devices, replicating itself into the top 20 packages accessible to the compromised account and rapidly publishing malicious package versions. Stolen credentials were published in new, public GitHub repositories, compounding the supply chain risk. Though the initial infection included several packages managed by CrowdStrike, the company quickly removed the compromised code and rotated secrets, preventing wider impact to its flagship products. This incident highlights the increasing sophistication and automation of supply chain compromise, especially in open-source software development. The self-propagating nature of Shai-Hulud, combined with credential harvesting and public exposure, represents a growing risk trend for organizations relying on software registries.
Salty2FA: The Next Wave of Enterprise Phishing-as-a-Service in 2024
In early 2024, cybersecurity researchers uncovered the Salty2FA Phishing-as-a-Service (PhaaS) kit, designed to bypass multi-factor authentication (MFA) protections for enterprise environments. The kit enables attackers to launch highly convincing phishing campaigns by emulating trusted authentication flows and harvesting credentials—including two-factor tokens—using adversary-in-the-middle proxy techniques. Salty2FA's modular architecture, scalability, and integration with encrypted communication channels make it particularly appealing to cybercriminals targeting corporate user bases. Compromised accounts can facilitate credential stuffing, lateral movement, and data exfiltration in victim organizations. This incident highlights the growing professionalization of cybercriminal groups and a trend toward sophisticated PhaaS offerings that significantly lower barriers for conducting enterprise-level breaches. Organizations should note the surge in attacks able to circumvent standard MFA and adapt their defenses accordingly.
2024 Shai-hulud Worm: Major Supply Chain Attack Strikes NPM
In September 2024, a self-replicating malware dubbed "Shai-hulud" infiltrated the open source ecosystem by targeting hundreds of NPM (Node Package Manager) packages. The worm initiates its campaign by compromising a single software component, and automatically harvests secrets, tokens, and credentials present in affected developers' environments. By leveraging compromised NPM accounts, Shai-hulud spreads itself through subsequent package uploads, injecting malicious payloads into new releases and perpetuating a chain reaction across software supply chains. Impacted parties range from individual developers to prominent tech companies and security vendors. This incident highlights a concerning escalation in supply chain threats, demonstrating advanced automation in malware propagation and the weaponization of interconnected open source dependencies. The attack underscores the rising prevalence of highly automated, lateral-moving malware and the systemic risks posed by compromised development ecosystems.
Raven Stealer Uses Telegram to Pilfer Chromium Data in 2024
In early 2024, security researchers identified a new infostealer variant, Raven Stealer, being distributed via underground forums and cracked software packages. The malware targets Windows systems and focuses on stealthy extraction of browser data, particularly from Chromium-based browsers such as Google Chrome. Once installed, Raven Stealer harvests credentials, cookies, browser histories, and cryptocurrency wallets before exfiltrating the data through encrypted Telegram channels. The attack exploits unmonitored endpoints and capitalizes on users’ download of pirated or repackaged software, resulting in widespread compromise of sensitive authentication data across multiple organizations. This incident underscores the ongoing evolution of commodity malware and demonstrates the sophistication with which even low-cost infostealers are leveraging encrypted communications and social engineering. As attackers continue to innovate with new TTPs and delivery vectors, organizations must strengthen endpoint monitoring and policy enforcement to reduce exposure to similar threats.
Microsoft September 2025 Patch Tuesday: Critical Privilege Escalation Flaws Demand Immediate Action
In September 2025, Microsoft disclosed 81 security vulnerabilities across its portfolio, with a significant focus on escalation of privilege (EoP) flaws. Of the CVEs released, 38 enabled attackers to gain elevated access after initial compromise, affecting modules like SMB and NTLM. Notably, CVE-2025-55234 (SMB) and CVE-2025-54918 (NTLM)—both rated CVSS 8.8—were publicly known and considered high impact, allowing attackers to leverage relay and crafted packet attacks for system takeover. Additional critical vulnerabilities were identified in Windows UI XAML and HPC components. While no active exploitation was confirmed at release, the breadth of affected products and criticality prompted urgent patching recommendations. This wave of privilege escalation vulnerabilities underscores the ongoing risk posed by identity-based attacks and lateral movement, compelling organizations to accelerate patch deployment and strengthen segmentation controls. With the end-of-life of Windows 10 and expanded MFA mandates on the horizon, the incident reinforces the necessity for layered defenses and up-to-date asset management.
K2 Think AI Model Jailbroken Within Hours of 2024 Release
On September 9, 2024, the UAE-backed 'K2 Think' large language model (LLM) was released with the goal of industry-leading transparent reasoning. Within hours, however, cybersecurity researchers discovered a critical vulnerability known as Partial Prompt Leakage. This flaw allowed adversaries to observe the model's internal logic in plain text, making it easier to methodically bypass safeguards and jailbreak the AI system. The exploit was demonstrated by researcher Alex Polyakov, who publicly documented how attackers could uncover and iterate against the model’s defenses, enabling harmful behaviors such as malware generation. The breach did not result in immediate large-scale misuse, but it revealed a key tradeoff between transparency and security in modern LLM development. This incident is emblematic of new AI security risks emerging as open, auditable models grow in popularity. It underscores the urgency for vendors to balance transparency with robust protection, as attackers quickly adapt to and exploit unique model features. With increased regulatory scrutiny and rising enthusiasm for open-source AI, safeguarding model reasoning is now a critical surface organizations cannot ignore.
Lies-in-the-Loop: When AI Coding Agents Become Supply Chain Threats
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise. This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
Vidar Infostealer Returns in 2024 with Stealthier Malware Campaigns
In June 2024, cybersecurity researchers observed a significant resurgence of the Vidar infostealer malware, marked by notable advancements in evasion and data exfiltration techniques. Vidar, which originated as a variant of Arkei and has remained active since 2018, now leverages encrypted command-and-control (C2) channels, sophisticated PowerShell-based delivery, and covert exfiltration methods to siphon credentials, cookies, authentication tokens, and sensitive financial information. The latest campaigns employ phishing, malvertising, and compromised websites as entry vectors. Tactics such as obfuscated PowerShell scripts, living-off-the-land binaries (LOLBins), Windows Defender exclusion manipulation, persistence via scheduled tasks, and exfiltration over TLS have enabled Vidar to bypass traditional detection controls and ensure lasting presence within infected enterprise and individual user environments. The rapid iteration and adaptability of Vidar reflect broader trends in malware-as-a-service (MaaS) operations—demonstrating how popular infostealers continually implement new stealth and evasion tactics. This highlights the urgent need for organizations to adopt layered security defenses and proactive threat detection, as infostealers like Vidar push the boundaries of stealth and data theft in an era of increasing hybrid work, regulatory scrutiny, and sophisticated social engineering.
Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)
In early June 2024, multiple critical vulnerabilities known collectively as "Chaotic Deputy" were disclosed in Chaos Mesh, a widely used open-source chaos engineering platform for Kubernetes. These bugs, including authentication bypass and privilege escalation flaws, allowed unauthorized attackers to obtain elevated access within Kubernetes clusters. Exploitation could lead to total cluster takeover, lateral movement, and the compromise of sensitive resources and data across affected environments. The disclosure prompted rapid patches from maintainers and advisories from security organizations and cloud providers due to the severe risk and broad adoption of Chaos Mesh in enterprise deployments. This incident highlights the increasing focus of attackers and researchers on the Kubernetes and supply chain ecosystem. With Kubernetes now foundational to cloud-native infrastructure, vulnerabilities in operational tools like Chaos Mesh underline the need for robust segmentation, continuous security monitoring, and timely patch management to protect against emerging threats to hybrid and multi-cloud environments.
North Korean Kimsuky Leverages Deepfake Military IDs in Sophisticated Social Engineering Attack
In April 2024, threat group Kimsuky, attributed to North Korea, launched a cyberattack campaign targeting South Korean organizations using advanced social engineering tactics. The attackers exploited ChatGPT to generate sophisticated deepfake military ID documents, which were then used as bait to compromise targets via phishing emails and messaging apps. By mimicking authentic credentials, Kimsuky aimed to breach sensitive military and governmental networks, potentially facilitating credential harvesting and further lateral movement within critical infrastructures. This incident highlights the increasing convergence of generative AI and cyberattack techniques, making impersonation and credential-based attacks far more convincing and widespread. It underscores rising urgency for organizations to strengthen verification processes and stay vigilant against emerging deepfake-enabled attack vectors.
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics. This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.
Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)
In early 2024, multiple leading code assistant platforms powered by Large Language Models (LLMs) were found to be vulnerable to security threats such as indirect prompt injection, model misuse, and code suggestion manipulation. Attackers exploited weaknesses in prompt handling and insufficient contextual isolation, allowing harmful code or misleading content to be surfaced to end users and potentially exposing enterprise environments to supply chain risks. These risks highlight the growing attack surface in organizations leveraging AI-driven development tools, where impaired oversight can lead to deceptive or insecure code entering production systems. This incident underscores the urgency for enterprises to evaluate the deployment and integration practices for generative AI tools, particularly given the rapid rise in adoption and regulatory focus on AI safety. Attacker tactics are evolving quickly, and threat actors are increasingly targeting AI models and their usage contexts as a new cyber frontier.