The Hacker News

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The campaign spans npm, Packagist, Go, and Chrome, using obfuscated JavaScript loaders and VS Code tasks to deliver malware.

ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA ...

I tried the Lovable no-code app development platform, and saw how it uses AI to create, extend, and debug fully responsive, feature-rich web apps

Lovable makes extensive use of AI to help anyone create, and publish web apps with ease.

Opera is releasing a new feature that detects and blocks malicious clipboard content

If you tend to copy/paste content from websites, you might be surprised to find yourself under the thrall of a ClickFix ...
The Hacker News

VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer

Securonix says PureLogs infection starts with a fake PDF JavaScript file and uses PowerShell, fileless .NET loading, and LOLBins.
Bleeping Computer

ChocoPoc malware delivered via trojanized exploits on GitHub

Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data. However, ChocoPoC ...