CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.

Pro tip, don't install PowerShell commands without approval A team of data thieves has doubled down by developing its ...

ReversingLabs reveals hackers using Ethereum Smart contracts in NPM packages to conceal malware URLs, bypass scans, and ...

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals ...

Cybercriminals have invented an insidious way to seize control of vulnerable AIs, and the models you use on your phone or computer could be vulnerable. Here's how to stay safe.

An attack targeting the Node.js ecosystem was just identified — but not before it compromised 18 npm packages that account ...

Cybersecurity firm HiddenLayer uncovers a “CopyPasta License Attack” that exploits Coinbase’s favored AI coding tool, Cursor.

Claude AI has been used for fake remote jobs in North Korea to pass interviews and keep high-paying roles. How far will this ...

Learning is a complex process — and so is measuring it. Though research shows we have cause to be concerned about what ...

Qix is an open source maintainer account that was compromised by a phishing attack. This allowed attackers to infect 18 popular npm packages with malicious code. Together, these packages are ...

On September 5, 2025, GitGuardian discovered GhostAction, a massive supply chain attack affecting 327 GitHub users across 817 ...