In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.

Securonix uncovers the Veil#Drop malware framework, which abuses compromised websites and Google Blogspot to deploy the PureLog information stealer.

The attack vector is available for rent at scale, and evades AV and EDR, leaving YARA analysis as the best detection option.

A vulnerability chain dubbed AutoJack in Microsoft’s AutoGen Studio interface for prototyping AI agents could let attackers manipulate an agent into executing arbitrary commands on its host system ...

Sophos says Claude Code, Cursor, and Codex triggered Windows endpoint rules for credential access, LOLBin downloads, and ...

Microsoft Patch Tuesday July 2026 delivers 622 CVEs, the largest release in company history, with two exploited zero-days in ...

Securonix says PureLogs infection starts with a fake PDF JavaScript file and uses PowerShell, fileless .NET loading, and LOLBins.

PureLogs Stealer uses fake PDF JavaScript files and Google's Blogger pages in the VEIL#DROP campaign, enabling fileless malware attacks that evade detection.

Binding, and Silo-Binding techniques abuse Windows filesystem virtualization features to present trusted files to security ...

Microsoft says it has detected new self-propagating malware that spreads through USB drives in search of cryptocurrency credentials, which it then sends to attacker-controlled servers.

The modular Golang backdoor combines remote administration, multiple disk-wiping logics, and a Crucio-derived ransomware ...