Malware

Supply Chain Attack

Researchers Document "FakeGit" Campaign Using 7,600 Malicious GitHub Repositories to Deliver SmartLoader Malware

A scale-significant GitHub impersonation campaign hits AI-tooling users — defender inventory work this week.

Editorial illustration of a calendar page dated far in the future holding a hidden note, marking HollowGraph malware abusing Microsoft 365 calendars for C2.

Threat Intelligence

Group-IB Documents “HollowGraph” Malware Abusing Microsoft 365 Calendars for C2

A novel Microsoft 365 calendar-abuse malware framework — defender detection-engineering review this week.

Editorial illustration of a gem-shaped package hiding a dormant timer over a developer's keyboard, marking the SleeperGem RubyGems supply-chain attack.

Supply Chain Attack

Researchers Document "SleeperGem" RubyGems Supply-Chain Attack Targeting Developer Machines

Ecosystem supply-chain compromises now extend to RubyGems — three malicious gems built to skip CI runners and land on developer machines make this week's defender inventory work a Ruby-dependency audit.

Editorial illustration of a game controller tipping coins from a crypto wallet beside handcuffs, marking the FBI arrest over a Steam-game malware campaign.

Policy & Government

FBI Arrests 21-Year-Old Zyaire Wilkins Over Steam-Game Malware Campaign Draining Crypto Wallets

A cryptocurrency-user targeting arrest via a novel Steam-games vector — law-enforcement coverage this weekend.

Editorial illustration of a mesh net trawling exposed AI service panels for key tags, marking the NadMesh Go botnet hunting cloud keys and Kubernetes tokens.

Threat Intelligence

Researchers Document “NadMesh” Go Botnet Hunting Exposed AI Services for Cloud Keys and Kubernetes Tokens

A botnet targeting self-hosted AI tooling for cloud keys — defender review for organizations exposing AI services this weekend.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a fake fix-it prompt piping browser tokens and documents into a stealer, marking Microsoft's ACR Stealer ClickFix analysis.

Threat Intelligence

Microsoft Defender Experts Documents ACR Stealer Delivered via ClickFix Lures Targeting Browsers and Microsoft 365

Another named stealer joins the ClickFix pattern — a defender posture review across Microsoft 365 environments after Microsoft's published analysis this week.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial illustration of a Windows driver box wearing a graphics-card mask, marking the Rust-based LabubaRAT posing as NVIDIA software.

Malware

Researchers Document “LabubaRAT” Rust-Based Windows RAT Posing as NVIDIA Software

A Rust-based Windows remote-access tool with an NVIDIA-impersonation posture — defender research this week from Blackpoint Cyber, published with indicators of compromise for detection teams.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

Editorial illustration of stacked app windows on a laptop collapsing toward a password box, marking the ClickLock macOS stealer that forces password entry.

Malware

Researchers Document “ClickLock” macOS Stealer That Reportedly Kills Apps Until Victim Enters Password

A novel macOS stealer technique with credential-and-crypto targeting — defender posture review for Mac-issuing organizations this week.

See all