…The malware also features some evasion mechanisms, such as checking for Russian locales/environments, and security tools such as StepSecurity Harden-Runner. Persistence is established through systemd services on Linux and LaunchAgents…
…The topics he writes about include malware, vulnerabilities, exploits and security defenses, as well as research and innovation in information security. His work has been published by Bitdefender, Netgear, The Security Ledger…
GitHub disables Microsoft repos pushing password-stealing malware By Bill Toulas June 9, 2026 11:42 AM Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub…
…security breach in TanStack supply chain attack Bitwarden CLI npm package compromised to steal developer credentials Malware npm Packages Shai Hulud Typosquatted Bill Toulas Bill Toulas is a tech writer and infosec…
…The Shai-Hulud campaigns started last September and continue to affect multiple software ecosystems, such as npm, PyPI, and Composer to a lesser degree. The malware compromises maintainer accounts or publishing tokens…
…wp-content/plugins for hidden backdoor plugins Execute server-side malware scans Rotate administrator passwords, API keys, database credentials, and WordPress security salts. While the malicious content has been removed, the attacker…
…Security researchers say the malware also established persistence on developer systems by modifying Claude Code hooks and VS Code auto-run tasks, enabling it to survive package removal. The malware spread to…
…The open-source reverse-shell and host-management framework Platypus is also used in some cases. The malware registers with a central "Dispatch Service" and receives scanning assignments, which it executes, compresses…
…security breach in TanStack supply chain attack Breach DAEMON Tools Information Stealer Malware Supply Chain Attack Trojan Sergiu Gatlan Sergiu is a news reporter who has covered the latest cybersecurity and technology…
…However, those samples infected machines via different attack chains, including Microsoft Defender binaries, AdaptixC2 shellcode and a decoy PDF, and impersonating update sites from multiple security vendors (e.g., CrowdStrike, SentinelOne, and…
