Runtime-Triggered npm Malware Slips Past Install-Script Protections
A malicious npm campaign hides its payload in normal library functions, bypassing install-script controls and using runtime triggers, reconnaissance, and blockchain C2.
CyberWorldOps
Latest news
More news
Page 33 / 91 · 823 articles
Inside TeamPCP: How Google Disrupted a Supply-Chain Campaign From the Hackers’ Core Chat
Google infiltrated TeamPCP’s inner chat to disrupt a supply-chain campaign, revoke stolen credentials, warn victims and uncover an AI-assisted zero-day exploit.
Handala Hack Turns Telegram Into a Control Channel for Windows Espionage
HEAVYGRAM uses Telegram bots to control Windows systems, steal credentials, capture data, evade Defender, and deploy further malware.
PhantomRaven Used npm Packages and Remote Code to Hunt for Developer Secrets
PhantomRaven malware hid in 100+ npm packages to steal developer credentials and CI/CD secrets.
Plugin Pinning Failure Exposes AI Coding Agents to Silent Supply-Chain Swaps
Plugin4Shell bypasses plugin pinning in Claude Code, Codex, Copilot, Gemini CLI, letting owners swap in unreviewed code while displaying pinned version.
Fake GitHub Downloads Pair Rapuncel Credential Theft With a Signed EDR-Killing Driver
Fake GitHub repos impersonate LastPass and 39 apps to spread Rapuncel stealer and a signed driver that kills 145 security tools to steal credentials.
A Small Qwen Model Exposes a Large Gap in U.S. Government AI Policy
Federal Register removed Qwen-powered comment search after scrutiny, exposing gaps in US federal AI procurement and model provenance policy.
WeaselBiscuit Turns npm Imports Into a Chrome Extension Data-Theft Channel
13 malicious npm packages deploy WeaselBiscuit, a JS stealer that harvests Chrome extension LevelDB data, clipboard and keystrokes via in-memory loader.
BragJack Turns Browser Extensions Into Control Channels for AI Agents
BragJack shows how a malicious Chrome extension can hijack Gemini, Comet, Edge, Opera and Claude AI agents to steal files and take actions.