Ethan Andrews

SynkLoader is a modular Windows malware family distributed via Microsoft Teams phishing that uses a bundled Python environment and in-memory components to facilitate credential theft, tunneling, and remote access.

Threat actors associated with the Beamglea campaign are abusing the npm registry and unpkg mirrors to host malicious HTML files that simulate Cloudflare CAPTCHA pages to distribute ClickFix phishing malware.

ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.

Sapphire Sleet, a North Korean state actor, is targeting the cryptocurrency and IT sectors through sophisticated npm supply chain compromises and social engineering lures on professional platforms.

Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.

Unauthenticated attackers are chaining signature algorithm confusion and OpenSSL error handling vulnerabilities to bypass authentication and gain administrator access on WordPress sites using the miniOrange SAML SSO plugin.

NVIDIA NemoClaw instances using Ollama are vulnerable to DNS rebinding attacks that allow unauthenticated model poisoning and data exfiltration through malicious webpages.

The ToxicPanda 2.0 Android banking trojan has evolved with 167 remote commands, targeting 349 financial applications globally through advanced privilege escalation and overlay techniques.

Wiz Red Agent discovered a script injection vulnerability in Snowflake's GitHub Actions workflow, potentially introduced by AI, enabling Jira credential exfiltration.

Unauthenticated attackers can achieve remote code execution on WordPress sites by exploiting a critical file upload vulnerability in the Elementor Pro Forms module.