The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into ...

A very significant change is occurring in the world of AI Agents.Until now, when people heard the word "Skill," many likely ...

Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole to deploy new malware targeting South Korean organizations.

Latrodectus is a Windows loader that downloads other malware, seen in phishing and ClickFix attacks. See what it does, how to ...

BlackX bootkit bypasses Windows Secure Boot to deploy espionage malware against Central Asian diplomats, with suspected APT41 ...

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere ...

Hackers abuse VLC and VMware components to sideload malware onto Windows systems through phishing campaigns targeting Brazil ...

North Korean hackers linked to the Lazarus Group abused banking security software to deploy a layered malware toolkit against ...

For this project, you need rust nightly v0.100.0 with target triple x86_64-pc-windows-gnu. The project has only been compiled on Linux, so I would advise you use Linux. If you want to modify the LLVM ...

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.

Kaspersky's GReAT team has detailed Operation FlashHole, a Lazarus espionage campaign active since at least July 2025 that ...

Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments.