The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into dllhost.exe.

Hackers use malicious WhatsApp attachments to deploy VulcanRAT, gaining SYSTEM-level access to steal data and control Windows PCs.

Latrodectus is a Windows loader that downloads other malware, seen in phishing and ClickFix attacks. See what it does, how to ...

BlackX bootkit bypasses Windows Secure Boot to deploy espionage malware against Central Asian diplomats, with suspected APT41 ...

Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole to deploy new malware targeting South Korean organizations.

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.

A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere ...

North Korean hackers linked to the Lazarus Group abused banking security software to deploy a layered malware toolkit against ...

Kaspersky's GReAT team has detailed Operation FlashHole, a Lazarus espionage campaign active since at least July 2025 that ...

Deception is moving at machine speed. Learn to keep pace. Huntress investigated multiple incidents stemming from an Amazon-themed ClickFix campaign tied to a sponsored Google search result for the ...

The ConsumerAffairs Research Team compared window companies on customer reviews, product quality and warranty coverage. We also considered window selection, materials and installation experience to ...