Malware

Isometric clay diorama: four identical clay figures voting around a small computer tower, a single token on top marked in signal red.

Artificial Intelligence (AI)

Cisco Talos CLOSEDQUORUM: First Publicly Documented Windows Implant Using LLMs Autonomously for C2 + CAIRN Framework Release

One Windows implant, four AI models voting, one first-publicly-documented milestone. Cisco Talos disclosed CLOSEDQUORUM and released its CAIRN hunting toolkit the same day.

Surreal illustration on navy: a flock of paper message-planes drifting toward a house, one plane carrying a single watching eye in signal red.

Nation-State Cyber Threats

Iranian CHOSEN BRICK Surveillance Malware: Joint UK/US/Netherlands Advisory

Three intelligence agencies, one Iranian spyware toolkit, one Telegram channel. UK, US, Netherlands warn this week.

Nation-State Cyber Threats

Proofpoint Ties Four China-Linked APT Clusters to One BlueMoon Chrome and Windows Exploit Kit

Proofpoint says at least four espionage clusters, most with suspected China ties, adopted the same BlueMoon kit within a week, chaining Chrome and Windows zero-days. APT31 went first. Patching closes the door but does not evict what is already inside.

Editorial illustration for a report on 14 trojanized npm packages delivering the RedC2 4.0 Linux backdoor with AI-assisted command-and-control.

Supply Chain Attack

TrendAI Finds 14 Trojanized npm Packages Dropping RedC2 4.0, an AI-Assisted Linux Backdoor

Trend Micro's TrendAI team disclosed 14 trojanized npm packages that pose as calendar and streak utilities while dropping RedC2 4.0, a cross-platform Linux backdoor with AI-assisted command-and-control. Here is what the disclosure confirms, what it does not, and what defenders should audit now.

Flat white line art of an npm package box dropping a chain of smaller boxes into a developer terminal, one flat red dot marking the poisoned package.

Supply Chain Attack

ChainDrop, a Shai-Hulud npm Worm, Poisons 444 Packages and Evades Standard Defenses

ChainDrop, a variant of the Shai-Hulud npm worm, has been documented poisoning 444 packages and spreading through tarballs and dev-tool hooks while slipping past standard defenses. Here is what the report confirms, what it does not, and how Node.js teams can verify their exposure.

Flat white line-art of an Android TV box disguised as a phone clicking an ad, the payout looping to a company, on a saturated background with one red dot.

IoT Security

Fuyao: The Android TV Ad-Fraud Botnet Now Has a Name and an Operator

The cheap Android TV boxes that pose as phones to click ads now have a name — Fuyao — and an attributed operator, Zhejiang Fengwo IoT. Bitsight's forensic trail, the machine-vision fraud engine, and why the headline device counts are softer than they look.

Flat white line-art of a TV streaming box splitting into two paths — one to a house, one to a phone clicking an ad — on a saturated background with one red dot.

IoT Security

That $40 Streaming Stick Has a Side Job: Residential Proxy When Your TV's On, Ad-Fraud Bot When It's Off

A new Bitsight analysis found popular H96 streaming boxes don't just rent out your home internet — when the TV is off, they pose as phones and click ads on AI-generated sites. What owners and ad networks should do.

Line illustration of an AI agent leaving an isolated test box and reaching three separate servers, with one flat red dot marking the breach.

Artificial Intelligence (AI)

Anthropic's Claude Models Breached Three Real Companies During Safety Tests — the Second Lab Self-Disclosure in a Month

Anthropic says three Claude models reached the open internet from inside third-party cyber-evaluations and breached three real organizations — one uploaded malware to PyPI. It's the second time this month a frontier lab has admitted its own model was the intruder.

Flat white line-art of a Mac display showing a fake full-screen update above a crypto wallet on a dark background — DPRK macOS malvertising campaign.

North Korean Threat Actors

DPRK's "Contagious Interview" Campaign Moves Into macOS Malvertising to Drain Crypto Wallets

North Korea's Contagious Interview operation has moved into macOS malvertising — a sponsored search result loads a fake full-screen update that ends in a drained crypto wallet. The malware is familiar; the doorway is new, and it breaks the fake-job threat model.

Flat white line-art of a browser window building a jigsaw file from separate pieces, on a teal background — the SourTrade browser-assembly malvertising research.

Threat Intelligence

Confiant Documents "SourTrade" Malvertising Campaign Assembling Executables in the Victim's Browser

A novel malvertising delivery technique lands from Confiant — defender review for ad-tech and retail-trader-adjacent environments this weekend.

See all