Explore

Rapid Read Rapid Read
Fake Corepack Tool Site Exploits Developers with Malware

Fake Corepack Tool Site Exploits Developers with Malware

A fake website posing as a source for the Corepack toolset has been targeting Node.js developers with malware. Corepack, initially bundled with Node.js from version 16.9.0, was discontinued by the Node.js Technical Steering Committee in 2025. The fake site, Corepack.org, has been active since early 2026, offering a malicious executable download. This installer deploys an infostealer that accesses browser data and SSH keys, and enrolls the machine in a bandwidth-sharing scheme known as proxyjacking. The site also misleads users with a fake 'your file is ready' page, installing a disguised Opera GX setup file. Following reports from the developer community, the hosting provider has taken down the site, which now returns a 404 error.
Rapid Read Rapid Read
Fake Notepad++ Plugin Used in Cyber Espionage Campaign by UAC-0099

Fake Notepad++ Plugin Used in Cyber Espionage Campaign by UAC-0099

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a cyber espionage campaign using a fake Notepad++ plugin to compromise Windows systems. The campaign, attributed to the Russia-aligned group UAC-0099, involves phishing emails that lead to the download of a malicious VBScript disguised as a PDF. This script installs a fake Notepad++ plugin, which then executes a series of malicious actions, including downloading additional malware. The campaign is part of a broader effort by UAC-0099 to exploit security vulnerabilities and conduct espionage activities.
Trendline Trendline
Hugging Face CEO Demands Transparency Following OpenAI Security Breach

Hugging Face CEO Demands Transparency Following OpenAI Security Breach

Hugging Face CEO Demands Transparency Following OpenAI Security Breach
Trendline Trendline
SourTrade Malvertising Campaign Uses Browsers to Assemble Malware

SourTrade Malvertising Campaign Uses Browsers to Assemble Malware

SourTrade Malvertising Campaign Uses Browsers to Assemble Malware
Trendline Trendline
OpenAI Faces Scrutiny After AI Prototype Hacks Another Company

OpenAI Faces Scrutiny After AI Prototype Hacks Another Company

OpenAI Faces Scrutiny After AI Prototype Hacks Another Company
Rapid Read Rapid Read
CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360's recent research reveals a significant evolution in phishing tactics targeting insurance companies. Traditionally, phishing involved collecting credentials for later use, but attackers now engage in real-time account hijacking. This method synchronizes with victims' login processes, allowing attackers to authenticate against legitimate insurance portals as victims unknowingly complete their login. The research highlights the use of Google Ads as a primary attack vector, redirecting users to phishing sites that mimic genuine insurance providers. These campaigns target multiple regions, including the U.S., and leverage disposable infrastructure to evade detection.
Rapid Read Rapid Read
Fake Claude App Promoted by Bing Ads Distributes SectopRAT Malware

Fake Claude App Promoted by Bing Ads Distributes SectopRAT Malware

A malvertising campaign on Bing has been discovered promoting a fake Claude desktop app installer, which is used to distribute the SectopRAT malware. This campaign, known as FakeAgent, compromised at least 29 organizations by directing users to download a malicious installer from a legitimate Claude.ai domain. The malware, SectopRAT, is an information-stealer with remote access capabilities, targeting sensitive user data such as passwords and credit card information. The campaign utilized advanced anti-analysis techniques to evade detection.
Rapid Read Rapid Read
Certighost Exploit Allows Low-Privileged Users to Impersonate Domain Controllers

Certighost Exploit Allows Low-Privileged Users to Impersonate Domain Controllers

Researchers have disclosed a vulnerability, named Certighost, that allows low-privileged Active Directory users to impersonate a Domain Controller by obtaining a certificate. This flaw, identified as CVE-2026-54121, was patched by Microsoft on July 14, 2026. The vulnerability involves improper authorization in Active Directory Certificate Services, allowing attackers to exploit the system without administrator rights. The exploit requires network access and a domain account, and it can lead to significant security breaches by enabling attackers to retrieve sensitive information such as the krbtgt secret.
Trendline Trendline
OnTrac Data Breach Exposes Customer Information, Offers Credit Monitoring

OnTrac Data Breach Exposes Customer Information, Offers Credit Monitoring

OnTrac Data Breach Exposes Customer Information, Offers Credit Monitoring
Trendline Trendline
Chick-fil-A Security Breach Potentially Exposes Customer Data

Chick-fil-A Security Breach Potentially Exposes Customer Data

Chick-fil-A Security Breach Potentially Exposes Customer Data
Rapid Read Rapid Read
Australian Energy Giant Origin Confirms Data Breach Impacting Millions

Australian Energy Giant Origin Confirms Data Breach Impacting Millions

Origin Energy, a major Australian electricity and gas retailer, has confirmed a data breach affecting potentially millions of customers. The breach, which was announced on July 22, involves unauthorized access to customer data, including names, addresses, and partial financial information. The company is working with cybersecurity experts and has notified relevant authorities. An individual claiming responsibility for the breach has threatened to leak the data unless a ransom is paid. Origin Energy is currently assessing the full extent of the breach and is in the process of contacting affected customers.
Rapid Read Rapid Read
Russian Hackers Exploit Zimbra Zero-Day Flaw to Steal Emails and 2FA Codes

Russian Hackers Exploit Zimbra Zero-Day Flaw to Steal Emails and 2FA Codes

A Russian state-sponsored hacking group, known as Laundry Bear, has been exploiting a zero-day vulnerability in Zimbra Collaboration email servers to steal sensitive information. The flaw, identified as CVE-2025-66376, is a cross-site scripting vulnerability that allows attackers to execute JavaScript embedded in HTML emails automatically when viewed by the victim. This enables the theft of account data without user interaction. The group has targeted various sectors, including defense, government, education, and media, primarily focusing on organizations aligned with Russian strategic interests. The vulnerability was patched in November 2025, but unpatched servers remain at risk.