News Archives

Axios Supply-Chain Compromise Deploys Cross-Platform RAT via Hijacked npm Account

A supply-chain compromise of the Axios npm package led to a malicious transitive dependency that installs a cross-platform RAT. Learn which versions were affected, how the malware operates, the attack timeline, indicators of compromise, and recommended remediation steps.

March 31, 2026

Russian CTRL Toolkit Delivered via Malicious LNK Files Hijacks RDP via FRP Tunnels

Researchers uncovered a Russian-built CTRL remote access toolkit distributed through deceptive .LNK shortcuts that enable RDP hijacking and reverse tunneling over FRP. This report breaks down the multi-stage infection, payloads, and the toolkit’s OPSEC-focused architecture.

March 30, 2026

Iran-Linked Hackers Breach FBI Director’s Personal Email and Carry Out Wiper Attack on Stryker

Iran-linked hacktivists claiming the Handala persona breached the personal email of FBI Director Kash Patel and mounted a destructive wiper attack against medical device maker Stryker, exposing tactics, infrastructure, and responses from U.S. agencies and private security firms.

March 28, 2026

Apple pushes lock‑screen warnings to outdated iPhones amid active web exploit activity

Apple has begun sending lock screen alerts to iPhones and iPads running older iOS/iPadOS builds, warning of active web-based exploit activity and urging users to install updates. The move follows research into exploit kits like Coruna and DarkSword and guidance from security firms.

March 27, 2026

Hackers Use Fake Resumes to Steal Enterprise Credentials and Deploy Crypto Miner

A phishing campaign targeting French-speaking corporate environments uses fake CVs to deploy a multi-stage toolkit that steals credentials, exfiltrates data and runs a Monero miner. Securonix researchers detail the FAUX#ELEVATE operation, which abuses Dropbox, Moroccan WordPress sites and mail[.]ru infrastructure.

March 26, 2026

Ghost campaign spreads via npm modules and GitHub to harvest crypto wallets and credentials

ReversingLabs and other researchers have uncovered a campaign distributing malicious npm packages and GitHub repositories that phish for sudo passwords, fetch payloads via Telegram, and install a stealer/RAT targeting crypto wallets and credentials.

March 25, 2026