ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA ...

SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux

A SimpleHelp authentication flaw is being exploited to deploy Djinn Stealer, a cross-platform malware targeting cloud, ...

New BioShocking Attack Tricks AI Browsers Into Leaking Credentials

LayerX found that BioShocking could trick AI browsers into leaking credentials by disguising malicious prompts as game rules.
Bleeping Computer

ChocoPoc malware delivered via trojanized exploits on GitHub

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. However, ChocoPoC ...
The Next Web

North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets

Malicious npm packages mimicking Rollup polyfill tooling steal browser data, crypto wallets, and AI tool credentials in a Lazarus-linked campaign.
CNET

Chrome Has Been Secretly Downloading AI to Your Computer. Here's What You Can Do

Chrome has been automatically downloading Gemini Nano (a 4GB AI model) to users' computers without notification or an easy way to prevent it. Alex Valdes from Bellevue, Washington has been pumping ...