Researchers at JFrog found 148 npm packages that abused the registry not to attack developers but as free hosting for a booby-trapped web proxy aimed at students trying to bypass school filters. Anyone who opened one of the proxy sites had their browser quietly conscripted into a distributed denial-of-service botnet, flooding target servers with HTTP and WebSocket traffic, alongside injected ads and tracking. Crucially, the packages contained no install-time scripts and were never meant to be added to a project, so dependency scanners and install sandboxes, which watch what runs on install, would not catch them. The operators can re-arm the dormant attack code with a single commit.
Researchers at Blackpoint Cyber detailed LabubaRAT, a previously undocumented Rust-based remote access trojan that disguises itself as NVIDIA software to blend into target systems. It arrives as an executable impersonating NVIDIA's container runtime, then profiles the host, identifying installed browsers and security products such as Microsoft Defender, CrowdStrike, and SentinelOne. From there it can run commands and scripts, capture screenshots, move files, and proxy traffic, and it communicates over multiple channels, including HTTPS, WebView2, and DNS tunneling, so access survives if one path is blocked. Its command server details are supplied at runtime, letting attackers reuse the same binary across campaigns, and there are signs it is sold as a service.
LastPass is warning that attackers are impersonating it and Bitwarden with fake security alerts to lure password-manager users to phishing sites. The emails, sent from look-alike domains rather than the real services, mimic corporate notices about updated security policies and push recipients to a page impersonating DocuSign. LastPass stresses its systems were not breached and the messages did not come from its infrastructure. Password managers are attractive phishing targets because compromising one can unlock every stored credential, and users often trust vendor-branded alerts. Related campaigns have pushed fake more-secure desktop apps that actually install remote-access tools, and similar lures have impersonated other password managers.
Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.
Jamf detailed CrashStealer, a macOS infostealer delivered through a signed, Apple-notarized app called Werkbit that passes Gatekeeper, since it carried a valid developer ID before Apple revoked it. Distributed as a disk image and gated behind a meeting PIN so it is served only to targeted visitors, the malware validates the victim's login password locally, then harvests broadly from browsers, cryptocurrency wallets, password managers, and the keychain, encrypting the loot before sending it out. It persists by copying and re-signing itself. There is no zero-click stage: a victim still runs the app and enters their password, but the notarized delivery and careful targeting make it more convincing than typical Mac stealers.
Google and Microsoft removed ModHeader, a header-editing browser extension popular with developers, with about 1.6 million installs, after researchers at Stripe OLT found a hidden browsing-history collector inside the official, signed store version. The collector was dormant, gated off by an empty allow-list, and no evidence has emerged that it ever sent data, but its presence in a trusted, signed extension is the concern. Its design frustrated automated review: the data was encrypted, the upload was switched off so sandboxes saw nothing leave, and malicious code was blended into a legitimate codebase, so scanners rated it low risk. It is a reminder that a store signature proves origin, not safe behavior.
A phishing operator left a Python web server exposed with directory listing on, letting researchers at Lexfo lift the entire toolkit and pivot to two more operators running three Microsoft 365 phishing campaigns. Each used a custom fork of the open-source Evilginx proxy to steal live session cookies and tokens, defeating multi-factor authentication by relaying the real login. The largest campaign ran over a year, logging 218 captured accounts, mostly corporate mailboxes, and a token file left in a public repository held 97 live Microsoft tokens. The report stresses two different MFA-bypass methods appeared, one proxying the real login and one abusing the device-code flow, which require different defenses to stop.
Nihon Kotsu, Japan's largest taxi operator, shut down internal systems after a cyberattack, disrupting parts of its operations while it investigates and recovers. Precautionary shutdowns like this are a common response to intrusions such as ransomware, aimed at containing an attacker and limiting damage while forensic work proceeds, though they also interrupt normal business. The incident fits a broader pattern of attacks against transportation and logistics providers, whose real-time operations and large customer bases make downtime costly and pressure on victims high. Full details, including whether customer data was accessed, were not yet available, but the disruption underscores how operational technology and business systems in transport are increasingly targeted.
Researchers at the ASSET Research Group demonstrated Ghostcommit, an attack that hides malicious instructions inside a PNG image so AI code reviewers miss them entirely. A harmless-looking conventions file points the coding agent to the image, whose rendered text tells the agent to read the repository's .env file and encode its secrets as a list of numbers written into the code. Because tools like CodeRabbit and Bugbot skip image files by default, the pull request passes review clean; the trap springs later when a developer asks the agent for an unrelated task. The outcome depended on the tool wrapping the model: some agents leaked secrets, while Claude Code refused.
Attackers used a stolen publishing credential to push malicious versions of the jscrambler npm package that install a Rust infostealer as soon as the package is added to a project. Socket ties five bad versions to the same actor, published over about three hours; the malware ships as native binaries for Windows, macOS, and Linux and sweeps developer machines for cloud credentials, crypto wallets, and password-manager vaults. Because jscrambler is a build-time tool used in development and CI, the stealer runs where deploy tokens, cloud keys, and source code live. Partway through, the dropper moved into the package's main code, so installing with scripts disabled does not stop it.
TrustStrike Labs