Explore

Meccha Chameleon Faces Malware Scare and Discord Hack

Meccha Chameleon Faces Malware Scare and Discord Hack

Meccha Chameleon Faces Malware Scare and Discord Hack

Meccha Chameleon Game Recovers from Malware Attack and Discord Hack

Meccha Chameleon Game Recovers from Malware Attack and Discord Hack

Meccha Chameleon Game Recovers from Malware Attack and Discord Hack

Meccha Chameleon Servers Compromised by Malware, Discord Hacked

Meccha Chameleon Servers Compromised by Malware, Discord Hacked

A vulnerability in the Meccha Chameleon game allowed malware to be distributed through Steam Workshop maps. The issue, which has been patched, was highlighted by a Medium post from user Feint, who noted that a command prompt window appeared during map downloads, indicating a malware dropper. The developer, Haganeiro, confirmed the vulnerability and stated it has been fixed. Additionally, the game's Discord server was hacked due to a system engineer's compromised PC, leading to altered server permissions and staff bans. The developer is working with Discord Support to resolve the issue.

Fake Corepack Tool Site Targets Developers with Malware, Raises Security Concerns

Fake Corepack Tool Site Targets Developers with Malware, Raises Security Concerns

A fake website posing as a source for the Corepack toolset has been targeting Node.js developers with malware. Corepack, initially bundled with Node.js from version 16.9.0, was discontinued by the Node.js Technical Steering Committee in 2025. Exploiting this, threat actors created a malicious site, Corepack.org, which appears as a top search result for the tool's name. The site offers an executable download that installs an infostealer capable of accessing browser data and SSH keys, and also enrolls the victim's machine in a proxyjacking scheme. This practice allows the machine's internet connection to be used as an exit node for other traffic, without the owner's knowledge. The malicious site has since been taken down following community reports and an abuse notification to the hosting provider.

Fake Corepack Tool Site Exploits Developers with Malware

Fake Corepack Tool Site Exploits Developers with Malware

A fake website posing as a source for the Corepack toolset has been targeting Node.js developers with malware. Corepack, initially bundled with Node.js from version 16.9.0, was discontinued by the Node.js Technical Steering Committee in 2025. The fake site, Corepack.org, has been active since early 2026, offering a malicious executable download. This installer deploys an infostealer that accesses browser data and SSH keys, and enrolls the machine in a bandwidth-sharing scheme known as proxyjacking. The site also misleads users with a fake 'your file is ready' page, installing a disguised Opera GX setup file. Following reports from the developer community, the hosting provider has taken down the site, which now returns a 404 error.

Fake Corepack Tool Site Targets Developers with Malware

Fake Corepack Tool Site Targets Developers with Malware

A fake website posing as a source for the Corepack toolset has been targeting Node.js developers with malware. The site, Corepack.org, appeared as a top search result and offered an executable download that installed an infostealer capable of accessing browser data and SSH keys. Additionally, the malware enrolled infected machines in a bandwidth-sharing scheme, a practice known as proxyjacking. This malicious activity follows the Node.js Technical Steering Committee's decision to stop distributing Corepack, creating an opportunity for threat actors to exploit developers seeking alternatives.

SourTrade Malvertising Campaign Uses Browsers to Assemble Malware

SourTrade Malvertising Campaign Uses Browsers to Assemble Malware

SourTrade Malvertising Campaign Uses Browsers to Assemble Malware

Fake Notepad++ Plugin Used in Cyber Espionage Campaign by UAC-0099

Fake Notepad++ Plugin Used in Cyber Espionage Campaign by UAC-0099

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified a cyber espionage campaign using a fake Notepad++ plugin to compromise Windows systems. The campaign, attributed to the Russia-aligned group UAC-0099, involves phishing emails that lead to the download of a malicious VBScript disguised as a PDF. This script installs a fake Notepad++ plugin, which then executes a series of malicious actions, including downloading additional malware. The campaign is part of a broader effort by UAC-0099 to exploit security vulnerabilities and conduct espionage activities.

CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360 Research Unveils Evolution of Insurance Phishing into Real-Time Account Hijacking

CTM360's recent research reveals a significant evolution in phishing tactics targeting insurance companies. Traditionally, phishing involved collecting credentials for later use, but attackers now engage in real-time account hijacking. This method synchronizes with victims' login processes, allowing attackers to authenticate against legitimate insurance portals as victims unknowingly complete their login. The research highlights the use of Google Ads as a primary attack vector, redirecting users to phishing sites that mimic genuine insurance providers. These campaigns target multiple regions, including the U.S., and leverage disposable infrastructure to evade detection.

US and Allies Accuse Russian Hackers of Email Breaches Without Social Engineering

US and Allies Accuse Russian Hackers of Email Breaches Without Social Engineering

The United States, along with over a dozen allied nations, has accused Russian hackers of stealing emails from users of the Zimbra email program without using traditional social engineering tactics. The hackers exploited a vulnerability in Zimbra software, allowing them to compromise accounts when users merely opened an email. This method, described as a 'half-click exploit' by cybersecurity firm Proofpoint, bypassed the need for users to click on malicious links or attachments. The hacking campaign, attributed to the Russian government-supported group Laundry Bear, initially targeted Ukraine before expanding to NATO member countries, including the U.S. The group is linked to a Russian cybersecurity company, Yutek-NN, whose deputy director faces hacking charges in the U.S.

Cyber Espionage Group APT28 Targets Hotel Wi-Fi Routers to Steal Corporate Credentials

Cyber Espionage Group APT28 Targets Hotel Wi-Fi Routers to Steal Corporate Credentials

A cyber espionage campaign attributed to APT28, also known as Fancy Bear, is targeting hotel Wi-Fi routers to steal corporate login credentials. The campaign involves DNS poisoning, redirecting web traffic through attacker-controlled infrastructure without the need for phishing links or malicious attachments. This attack has been identified in multiple U.S. cities and other countries. The attackers exploit exposed management interfaces and weak admin credentials to gain initial access to the routers. The campaign is ongoing, and cybersecurity firm ReliaQuest has issued recommendations to prevent such attacks.

Cl0p Ransomware Group Exploits PTC Windchill Vulnerability for Data Extortion

Cl0p Ransomware Group Exploits PTC Windchill Vulnerability for Data Extortion

The Cl0p ransomware group is targeting vulnerabilities in PTC Windchill and FlexPLM systems, exploiting a critical security flaw (CVE-2026-12569) to execute remote code and deploy web shells. This campaign affects sectors such as manufacturing, automotive, aerospace, and retail. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has listed this flaw in its Known Exploited Vulnerabilities catalog. The attackers use a combination of information disclosure and server-side flaws to gain unauthorized access, leading to data theft and extortion. The Cl0p group has a history of exploiting enterprise software vulnerabilities for similar attacks.