SHub macOS infostealer variant spoofs Apple security updates
SHub macOS infostealer variant spoofs Apple security updates By Bill Toulas May 18, 2026 05:42 PM A new variant of the ‘SHub’ macOS infostealer uses AppleScript to show a fake security…
Search
New Shai-Hulud malware wave compromises 600 npm packages
…It primarily targets developer workstations and CI/CD environments, including GitHub Actions, GitLab CI, Jenkins, Azure DevOps, CircleCI, Vercel, Netlify, and other build platforms. The stolen data is serialized, Gzip-compressed, AES…
Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero-days
Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero-days By Lawrence Abrams May 12, 2026 02:08 PM Today is Microsoft's May 2026 Patch Tuesday, with security updates for…
phpBB forum fixes auth bypass bug lurking for a decade
…phpBB is a PHP-based free and open-source web forum platform that enjoyed peak popularity in the 2000s and early 2010s. Today, it is still powering thousands of forums worldwide. Aikido…
GitHub disables Microsoft repos pushing password-stealing malware
…The OpenSourceMalware platform notes that the 'durabletask' - a repository in Microsoft's Azure organization on GitHub, was compromised in May, indicating that an incomplete cleanup allowed the threat actor to return with…
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges
…prompting the creation of a self-hosted code platform at projectnightcrawler.dev. BleepingComputer has contacted Microsoft about the new zero-day and will update the story if we receive a statement. Test…
KongTuke hackers now use Microsoft Teams for corporate breaches
…A more resilient C2 architecture with a five-server pool, automatic failover, randomized URL paths, and self-update capability. Multiple independent access paths, including a primary RAT, a reverse shell, and a…
Dutch govt disrupts malware botnet with 17 million infected devices
…The platform offers corporate, residential, and mobile proxies for monthly subscriptions between $5 and $15, with discounts for bulk purchases. Although such services often comprise IPs that voluntarily donate bandwidth by using…
SoFi confirms third-party data breach at Hong Kong subsidiary
…The company also advised customers to update passwords, enable two-factor authentication where possible, monitor financial accounts for suspicious activity, and avoid opening links or attachments in unsolicited emails or messages. SoFi…
Grafana breach caused by missed token rotation after TanStack attack
…missed token led to the attackers gaining access to our GitHub repositories,” reads Grafana’s update . “A subsequent review confirmed that a specific GitHub workflow we originally deemed not impacted had, in…