Check Point traced the Yoba campaign through SEO-poisoned sites and real GitHub repositories shipping DLL sideloading.
Sansec has counted 953 infected online stores, most on Magento, in a campaign running since July 2025 that swaps loader…
A Chinese-built platform called uCreater sells operators repackaged chat and wallet apps that intercept one-time codes and spoof camera feeds…
SafeDep traced imgdecode to the MALFEX publisher cluster, which has been seeding Windows-targeting packages since August 2023.
Misspelled AUR helper names turned a build step into full-system compromise.
Unit 42 traced a two-year intrusion that turned a single management box into keys for hundreds of networks.
A Rust-based remote access trojan delivered through document lures is using Discord as its control panel, Darktrace reports.
A new Android RAT uninstalls the real banking app and replaces it with a modified build that blinds the bank's…