Microsoft Threat Intelligence observed a human-operated intrusion campaign that abuses Microsoft Teams external collaboration to impersonate IT support, gain remote access, and deploy a Node.js-based ...

Kaspersky uncovers NodeRabbit and PollCat, new cross-platform RATs from Mirage Kitten, delivered via fake coding challenges ...

Nimbus Manticore uses trojanized coding challenges to deploy NodeRabbit and PollCat RATs across Windows, Linux, and macOS.

A new Shai-Hulud supply-chain campaign, tracked as Trinitite, has compromised the npm package ...

Learn how cybercriminals build advanced phishing pages using automated PaaS kits, AI tools, and cloud platforms to bypass ...

A large-scale phishing campaign used fake voicemail SVG attachments to bypass email defenses, targeting 5527 organizations ...

Uh-oh, e-commerce giant AliExpress has been caught running hidden, silent audio processes inside visitors' browsers to generate unique device tracking profiles without user consent.

For most of the web's history, scraping a defended site at scale was a craft. It meant reverse engineering obfuscated ...

The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic ...

A malware-as-a-service (MaaS) campaign has combined ClickFix social engineering with the ErrTraffic delivery service and Cruciferra loader, giving attackers a way to distribute malware while disabling ...

I've spent years building and auditing web applications, and one pattern keeps coming up: developers who are careful about backend security will ship a SaaS product and leave a surprising amount of ...