Trojanized Terraform Provider Delivers Cross-Platform Backdoors to Developers
A malicious Terraform provider masquerading as an AWS plugin delivers FLATROOF and ROOFDECK malware across macOS, Linux, and Windows. The campaign targets developer and CI/CD environments where cloud...
GhostAction Hijacks 346 GitHub Repositories to Harvest CI/CD Secrets
The GhostAction campaign used compromised maintainer accounts to inject credential-stealing GitHub Actions workflows into 346 repositories. The malicious automation collected CI/CD secrets and searched full Git histories, creating...
Public AnyDesk Exploit Puts Unpatched Linux Hosts at Risk of Root Takeover
Public exploit code for the AnyPwn flaw can target AnyDesk 8.0.2 on Linux before authentication and execute commands with root privileges. Administrators should install version 8.0.3 or later,...
AT&T’s $177 Million Settlement Resolves Claims From Two Massive Data Breaches
A federal judge has approved AT&T’s $177 million settlement covering two 2024 breaches that exposed personal information and communications metadata. The agreement closes the litigation without an admission...
Compromised Tensorlake npm Release Spreads Shai-Hulud Worm Through Developer Systems
A malicious Tensorlake npm release executed during installation, harvested developer and cloud secrets, and used worm-like techniques to threaten downstream projects. Teams that installed version 0.5.144 should treat...
Critical NetScaler Memory Flaw Exposes SAML Appliances to Remote Code Execution
Citrix has released urgent updates for a critical NetScaler ADC and Gateway memory-overflow vulnerability with a CVSS 9.5 rating. Exposure depends on the appliance build and whether it...
Fake Rabby and OKX Wallet Clones Found Stealing Crypto Seed Phrases via Firefox Add-ons
Researchers at Socket.dev uncovered 16 malicious Firefox extensions posing as Rabby Wallet and OKX Wallet that quietly captured recovery phrases and private keys and sent them to attacker-controlled...
Nine-Day Scanning Surge Targets Unpatched Hikvision Cameras Across Ukraine
GreyNoise logged a sharp nine-day spike in scanning and exploitation attempts against internet-exposed Hikvision cameras in Ukraine, almost all aimed at the four-year-old, maximum-severity CVE-2021-36260 command injection flaw....