A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader.

The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek.

Security leaders share how artificial intelligence is changing malware, ransomware, and identity-led intrusions, and how defenses must evolve.

The post Cyber Insights 2026: Malware and Cyberattacks in the Age of AI appeared first on SecurityWeek.

Of 3,100 unprotected MongoDB instances, half remain compromised, most of them by a single threat actor.

The post Over 1,400 MongoDB Databases Ransacked by Threat Actor appeared first on SecurityWeek.

Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers.

The post eScan Antivirus Delivers Malware in Supply Chain Attack appeared first on SecurityWeek.

Android users were lured to applications that served a malicious payload hosted in a Hugging Face repository.

The post Hugging Face Abused to Deploy Android RAT appeared first on SecurityWeek.

An LLMjacking operation has been targeting exposed LLMs and MCPs at scale, for commercial monetization.

The post LLMs Hijacked, Monetized in ‘Operation Bizarre Bazaar’ appeared first on SecurityWeek.

One of the largest residential proxy networks, IPIDEA enrolled devices through SDKs for mobile and desktop.

The post Google Disrupts IPIDEA Proxy Network  appeared first on SecurityWeek.

Russian and Chinese state-sponsored threat actors have been exploiting CVE-2025-8088 since July 2025.

The post APTs, Cybercriminals Widely Exploiting WinRAR Vulnerability appeared first on SecurityWeek.

Marketed as ChatGPT enhancement and productivity tools, the extensions allow the threat actor to access the victim's ChatGPT data.

The post Chrome, Edge Extensions Caught Stealing ChatGPT Sessions appeared first on SecurityWeek.

Priced $2,000 - $6,000 on a cybercrime forum, the MaaS toolkit promises publication on the Chrome Web Store.

The post ‘Stanley’ Malware Toolkit Enables Phishing via Website Spoofing appeared first on SecurityWeek.

10 years after disrupting the Ukrainian power grid, the APT targeted Poland with data-wiping malware.

The post Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid appeared first on SecurityWeek.

The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code.

The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek.

Providing cyberespionage and remote code execution capabilities, the malware is executed via DLL sideloading.

The post APT-Grade PDFSider Malware Used by Ransomware Groups appeared first on SecurityWeek.

The information stealer abuses legitimate APIs and libraries to exfiltrate data to Discord webhooks.

The post ‘SolyxImmortal’ Information Stealer Emerges appeared first on SecurityWeek.

Posing as an ad blocker, the malicious extension crashes the browser to lure victims into installing malware.

The post Malicious Chrome Extension Crashes Browser in ClickFix Variant ‘CrashFix’ appeared first on SecurityWeek.

Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits.

The post VoidLink Linux Malware Framework Targets Cloud Environments appeared first on SecurityWeek.

The Predator spyware is more sophisticated and dangerous than previously realized.

The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek.

The botnet’s propagation is fueled by the AI-generated server deployments that use weak credentials, and legacy web stacks.

The post GoBruteforcer Botnet Targeting Crypto, Blockchain Projects appeared first on SecurityWeek.

APT28 was seen impersonating popular webmail and VPN services, including Microsoft OWA, Google, and Sophos VPN portals.

The post Russia’s APT28 Targeting Energy Research, Defense Collaboration Entities appeared first on SecurityWeek.