malware Archives

Illustration of a malicious npm package stealing developer credentials, connecting to repository configuration files, and spreading to additional npm packages.

A credential-stealing worm spread through hundreds of npm packages by using stolen publisher tokens to automatically compromise additional projects and...

Illustration of the GoSerpent cyber espionage campaign showing a black serpent wrapped around a laptop displaying malware, with attack paths targeting Southeast Asia on a world map in the background.

Researchers Uncover GoSerpent Malware Used to Spy on Southeast Asian Governments

by m00s3c

July 18, 2026

Researchers have identified GoSerpent, a new espionage malware framework designed to maintain long-term access and steal sensitive government data across...

Editorial illustration depicting ClickLock malware on macOS, showing a fake system password prompt while multiple applications appear to crash or disappear around it.

ClickLock Malware Kills macOS Apps Until Victims Reveal Their Passwords

by m00s3c

July 17, 2026

Researchers have uncovered ClickLock, a new macOS infostealer that repeatedly kills running applications until victims enter their login password.

AI coding assistant suggesting a Git repository to clone inside a development environment, illustrating the HalluSquatting attack where hallucinated repository names can lead to malicious code execution.

HalluSquatting Exploits AI Coding Assistants to Deliver Malware

by m00s3c

July 13, 2026

New research shows attackers can exploit predictable AI hallucinations to register fake repositories and trick coding assistants into executing malicious...

Computer monitor displaying a GitHub repository with Go source code containing a hidden malicious PowerShell loader used in the Operation Muck and Load malware campaign.

Researchers Uncover 222 Fake GitHub Repositories Used to Spread Windows Malware

by m00s3c

July 12, 2026

Socket uncovered Operation Muck and Load, a large GitHub-based malware campaign that used fake repositories, commit farming, and public dead...

Illustration of a counterfeit software installer alongside a terminal displaying encrypted network connections, representing Silver Fox’s MODBEACON malware framework.

Silver Fox Deploys New Rust-Based MODBEACON Malware Framework

by m00s3c

July 12, 2026

Researchers say Silver Fox has expanded its malware arsenal with MODBEACON, a modular Rust-based framework built for encrypted communications, in-memory...

A circular cyber operation emblem on a dark blue background depicting a strategic takedown of malicious infrastructure. A white chess king stands opposite a fragmented black knight surrounded by red malware network nodes, while a shield with a WordPress-style symbol sits between them. Broken chains, law enforcement insignia, interconnected website nodes, and participating country flags encircle the design, representing an international operation against cybercriminal command-and-control networks.

Operation Endgame Disrupts SocGholish Malware Network Linked to Evil Corp

by m00s3c

June 19, 2026

International law enforcement disrupted SocGholish infrastructure linked to Evil Corp, cleaned nearly 15,000 websites, and identified 154,000 impacted email addresses.

Browser window with a puzzle-piece extension under a magnifying glass on a magenta disc, BreachNews guide

How to Tell If a Browser Extension Is Malicious

by m00s3c

May 26, 2026

Audit every extension in Chrome, Edge, Firefox and Safari with verified menu paths, spot the warning signs of a malicious...

Dark-themed illustration showing overlapping GitHub, npm, and Visual Studio Code interfaces with source code windows and dependency-style connections representing modern software supply chain attacks targeting developer ecosystems.

The TeamPCP Worm May Have Created a Much Bigger Supply Chain Problem

by m00s3c

May 24, 2026

The TeamPCP-linked GitHub breach, originating from a malicious Visual Studio Code extension, reveals an evolving software supply chain threat leveraging...