Fake LinkedIn jobs trick Mac users into downloading Flexible Ferret malware

Researchers have discovered a new attack targeting Mac users. It lures them to a fake job website, then tricks them into downloading malware via a bogus software update. The attackers pose as recruiters and contact people via LinkedIn, encouraging them to apply for a role. As part of the...

When your AI Assistant Becomes the Attacker’s Command-and-Control

Earlier this month, Microsoft uncovered SesameOp, a new backdoor malware that abuses the OpenAI Assistants API as a covert command-and-control C2 channel. The discovery has drawn significant attention within the cybersecurity community. Security teams can no longer focus solely on endpoint malwar...

Fake Battlefield 6 Downloads Are Spreading Malware, Stealing Player Data

Bitdefender Labs found fake Battlefield 6 pirated copies and trainers spreading aggressive malware, C2 agents, and infostealers, designed to steal player data and crypto-wallets...

RomCom Uses SocGholish Fake Update Attacks to Deliver Mythic Agent Malware

The threat actors behind a malware family known as RomCom targeted a U.S.-based civil engineering company via a JavaScript loader dubbed SocGholish to deliver the Mythic Agent. "This is the first time that a RomCom payload has been observed being distributed by SocGholish," Arctic Wolf Labs...

EUVD-2025-199701

Malicious code in atlassian-praz PyPI...

MAL-2025-191473 Malicious code in chai-jsons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e738779b172365174b2a7765325ea0405726a7ce192ddd47025b964d5e134ec The package chai-jsons was found to contain malicious code. Source: ghsa-malware 84b31461976f0984f6a6828d87f0cda7b1e3323084608a91ca02bedcee04357b Any...

EUVD-2025-199689

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template npm...

New ClickFix wave infects users with hidden malware in images and fake Windows updates

Several researchers have flagged a new development in the ongoing ClickFix campaign: Attackers are now mimicking a Windows update screen to trick people into running malware. ClickFix campaigns use convincing lures, historically “Human Verification” screens, and now a fake “Windows Update” splash...

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Cybersecurity researchers are calling attention to a new campaign that's leveraging a combination of ClickFix lures and fake adult websites to deceive users into running malicious commands under the guise of a "critical" Windows security update. "Campaign leverages fake adult websites xHamster,...

3 SOC Challenges You Need to Solve Before 2026

2026 will mark a pivotal shift in cybersecurity. Threat actors are moving from experimenting with AI to making it their primary weapon, using it to scale attacks, automate reconnaissance, and craft hyper-realistic social engineering campaigns. The Storm on the Horizon Global world instability,...

MAL-2025-191464 Malicious code in mayhem-wma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d242ed0467287371909e2fef415c86d7688c77b9a33f6b43c52d37bfc2d7fa6e The package mayhem-wma was found to contain malicious code. Source: ghsa-malware 9f00d5cfad9006d0cb83e7249554304291a746a42a2191314e1b70990e854df5 Any...

MAL-2025-191463 Malicious code in initial-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bdfbaf17e5ea42f67e6327f5dfe8766f8a5f8d83fb4b390fc8d780da5555187 The package initial-path was found to contain malicious code. Source: ghsa-malware 014c829694ccb06463ad706603727d070cbf38be1e103200b54c1235ccc82611 A...

MAL-2025-191462 Malicious code in react-svgs-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081ba740ebfdae5dfc4f53bf53b7658227f6fc78a9c8866727d95d2467991f3e The package react-svgs-helper was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5894ea8ba7ea0e9636e873dae07eb97fdcf83510f4e7a28b23f1d0b2e0a0afe0 The package @voiceflow/anthropic was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191371 Malicious code in @voiceflow/secrets-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 527df6a20822831f2bc2435e1db61fcc192d163d6a81240078e8e93066dc1235 The package @voiceflow/secrets-provider was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191250 Malicious code in @oku-ui/aspect-ratio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6606772dc5b4ddd3840b89d7e45d6a6c8cdfa35a4ebaecf9f31ac855632b8ff2 The package @oku-ui/aspect-ratio was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191348 Malicious code in @voiceflow/fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae935a1a5c4c3792b0a6e51cfeca10ee5d11192e0928bf28ac3fd58ce89c24b7 The package @voiceflow/fetch was found to contain malicious code. Source: ghsa-malware 18354d00f52198c519ac2adf8360486ea1817d9cd1e577fe147eaff0d7633f...

MAL-2025-191298 Malicious code in @posthog/postgres-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10be24eebbc464a61788d5c151ce03171d4abe4b1cd7f27972fef642fc46deda The package @posthog/postgres-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191345 Malicious code in @voiceflow/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4db5527f8a6098b9553e656b50ee1e0fcae45b163917de83299e9e5200ff96f The package @voiceflow/eslint-config was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191318 Malicious code in @silgi/ratelimit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422196a67d61d4d71d26fc505d10b7d141fb54310ecab586ff0320d42f395509 The package @silgi/ratelimit was found to contain malicious code. Source: google-open-source-security...