Fake CAPTCHA pages can install the StealC infostealer. Don't paste or run commands; disconnect and change passwords.

With almost 175,000 npm projects listing the library as a dependency, the attack had a huge cascade effect and shows how quickly a compromised package can propagate through the ecosystem.

A North Korea-nexus threat actor compromised the widely used axios npm package, delivering a cross-platform remote access trojan to potentially millions of developer environments during a three-hour ...

The maintainer account for the axios package on npm was compromised to inject a remote access trojan for Windows, macOS, and Linux.

Malwarebytes warns that a fake Microsoft support site is distributing password-stealing malware through a spoofed Windows ...

The popular JavaScript HTTP client Axios has been compromised in a supply chain attack, exposing projects to malware through malicious npm releases. Security researchers from StepSecurity identified ...

Adobe has released a fix for an Acrobat and Reader zero-day that attackers had been exploiting for months. The patch, shipped on April 11, addresses CVE-2026-34621, a critical vulnerability in Acrobat ...

When 🤖 means "bot available," 🧰 signifies "toolkit," or 💰💰💰 translates to "big ransom," bad actors can evade filters and ...

Within days of each other, Anthropic first leaked the source code to Claude Code, and then a critical vulnerability was found ...

Phishing surge, LinkedIn tracking claims, spyware use, and rising stealers expose growing abuse of trusted systems.

Have you been playing Connections, the super fun word game from the New York Times that has people sharing those multi-colored squares on social media like they did with Wordle? It’s pretty fun and ...