A team of data thieves has doubled down by developing its CastleRAT malware in both Python and C variants. Both versions spread by tricking users into pasting malicious commands through a technique ...

CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.

IntroductionAPT37 (also known as ScarCruft, Ruby Sleet, and Velvet Chollima) is a North Korean-aligned threat actor active since at least 2012. APT37 primarily targets South Korean individuals ...

Security researchers found malware packages using the Ethereum blockchain to conceal malicious commands on GitHub repos.

Cybersecurity firm HiddenLayer uncovers a “CopyPasta License Attack” that exploits Coinbase’s favored AI coding tool, Cursor.

ReversingLabs reveals hackers using Ethereum Smart contracts in NPM packages to conceal malware URLs, bypass scans, and ...

According to ReversingLabs' 2025 Software Supply Chain Security Report, 14 of the 23 crypto-related malicious campaigns in ...

The Infos3c Grabber Stealer specialises in stealing sensitive information such as passwords, cryptocurrency wallets, gaming accounts, and Discord/Telegram data. It also has capabilities to capture ...

Visual Studio Code extensions have been identified exploiting a loophole that allows reuse of names from removed packages ...

Scheduled for rollout starting in September 2026, the program aims to restrict malware distribution by requiring developer ...

Scientists at NYU developed a ransomware prototype that uses LLMs to autonomously to plan, adapt, and execute ransomware attacks. ESET researchers, not knowing about the NYU project, apparently ...