In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

Securonix uncovers the Veil#Drop malware framework, which abuses compromised websites and Google Blogspot to deploy the PureLog information stealer.

Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and ...

A vulnerability chain dubbed AutoJack in Microsoft’s AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system ...

The modular Golang backdoor combines remote administration, multiple disk-wiping logics, and a Crucio-derived ransomware ...

Security tooling is not written in a single language. Python powers most automation. C sits at the exploit layer. PowerShell ...

Securonix says PureLogs infection starts with a fake PDF JavaScript file and uses PowerShell, fileless .NET loading, and LOLBins.

PureLogs Stealer uses fake PDF JavaScript files and Google's Blogger pages in the VEIL#DROP campaign, enabling fileless ...

Separate but similar campaigns described by Microsoft and Trend Micro use malicious zip files to spread malware via social ...

Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers.

Federal agencies operating on-premises Microsoft SharePoint Server are under a hard patch deadline today — July 4, 2026 — after the U.S. Cybersecurity and Infrastructure Security Agency confirmed on ...