The LeakNet ransomware gang is now using the ClickFix technique for initial access into corporate environments and deploys a malware loader based on the open-source Deno runtime for JavaScript and ...

With over a million users at its peak, as highlighted by XDA, Save Image as Type allowed users to force-save images in different formats as PNGs or JPGs. Several of us at Android Police were regular ...

How can an extension change hands with no oversight?

The Glassworm campaign has compromised over 151 GitHub repositories and npm packages using invisible Unicode payloads that evade standard code review.

Threat actors are publishing clean extensions that later update to depend on hidden payload packages, bypassing marketplace ...

New ClickFix variant maps WebDAV drive to run trojanized WorkFlowy app, enabling stealth C2 beacon and payload delivery.

IntroductionOn March 1, 2026, ThreatLabz observed new activity from a China-nexus threat actor targeting countries in the Persian Gulf region. The activity took place within the first 24 hours of the ...

BlackSanta is a malware module that kills EDR and AV at the kernel level prior to unleashing the malware’s final purpose.

Hackers are impersonating IT staff in Microsoft Teams to trick employees into installing malware, giving attackers stealthy access to corporate networks.

A campaign by Russian-speaking cyberattackers hijacks workflows to deliver security-busting malware, allowing attackers to steal data without detection.

Attackers are using fake Claude Code install pages and malicious search ads to spread infostealer malware targeting Windows ...

ThreatDown, the corporate business unit of Malwarebytes, today published research documenting what researchers believe to be ...