Trivy vulnerability scanner breach pushed infostealer via GitHub Actions

The Trivy vulnerability scanner was compromised in a supply-chain attack by threat actors known as TeamPCP, which distributed ...
The Hacker News

Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages

CanisterWorm infects 28 npm packages via ICP-based C2, enabling self-propagation and persistent backdoor access across developer systems.

Widely used Trivy scanner compromised in ongoing supply-chain attack

Hackers have compromised virtually all versions of Aqua Security’s widely used Trivy vulnerability scanner in an ongoing ...
Hackaday

This Week In Security: Linux Flaws, Python Ownage, And A Botnet Shutdown

Qualys reports the discovery by their threat research unit of vulnerabilities in the Linux AppArmor system used by SUSE, Debian, Ubuntu, and ...

GhostClaw turns GitHub habits into a macOS malware pipeline

GhostClaw, a macOS infostealer, is spreading through GitHub repositories and developer tools, and it works because routine install habits make running malware feel completely normal.
GitHub

SAP Skills for Claude Code

Production-ready Claude Code plugins for SAP development. Each plugin provides context-aware skills that activate automatically when you work with SAP BTP, CAP, Fiori, ABAP, Analytics, and more. Note: ...

Fake Claude Code & OpenClaw AI Tools Delivering Data-Stealing Malware to Developers

Hackers are using fake Claude Code and OpenClaw downloads to spread data-stealing malware like Amatera and AMOS among developers.

Glassworm Malware Campaign Uses Invisible Code To Infect Hundreds Of GitHub Repos

The GlassWorm malware made news when it pivoted from exclusively targeting Windows users to also targeting Mac OS users in January, and in the time since, the malware campaign has spread across at ...
World Bank

Early Childhood Development (ECD)

Investing in the early years is one of the smartest things a country can do. Early childhood experiences have a profound impact on brain development – affecting learning, health, behavior, and ...
PC Magazine

Phony Claude Code Install Guides Trick Vibe Coders Into Installing Malware

Phony Claude Code Install Guides Trick Vibe Coders Into Installing Malware Dubbed InstallFix by Push Security, the scheme inserts instructions to download malware during the Claude Code install ...
Microsoft

AI as tradecraft: How threat actors operationalize AI

Threat actors are operationalizing AI along the cyberattack lifecycle to accelerate tradecraft, abusing both intended model capabilities and jailbreaking techniques to bypass safeguards and perform ...
IEEE

Designing a Static Malware Analysis Framework for Detecting Malicious Malware Code with Ghidra

Abstract: Malware analysis is an integral part of cybersecurity, however traditional signature-based detection techniques are inadequate for advanced obfuscation techniques. This paper proposes a ...