Researchers at JFrog traced a fresh npm supply chain attack to North Korea’s Lazarus group, six lookalike packages built to steal developer credentials and cloud keys.
Category:
News
-
-
A newly exploited SharePoint server vulnerability lets low-privilege accounts run code on your server. Here’s how to check exposure and patch it this week.
-
A second maximum-severity flaw in Kemp LoadMaster in two years shows why load balancers need the same patch discipline as public web servers.
-
Ransomware via search results is now a documented attack route. A Bing search for IT software led to full network encryption in 44 hours. Here is why your download policy …
-
StegoAd infected 2.6 million users through official browser stores using steganography to hide payloads in images. Here is what UK businesses should audit and lock down.
-
Russian intelligence is stealing Signal backup recovery keys to read encrypted message histories, without breaking the encryption. Here’s what that means for how UK businesses use secure messaging.
-
Adblock for YouTube has a dormant script injection capability that its owners could activate with one server change. Here is what it means for your organisation and what to do …
-
Operation Endgame disrupted Amadey and StealC infrastructure on a significant scale. But with no arrests, the operators survive intact. Here is what that means for UK businesses building their security …
-
Two members of Scattered Spider have pleaded guilty over the 2024 TfL breach. The techniques they used are low-tech and still active. Here is what organisations can do to make …
-
Three ShapedPlugin Pro plugins served malware via official updates for three weeks. Updating the plugin is not enough — here is what site owners need to do.