MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply chain attack campaign dubbed MALFEX.

The package, named “imgdecode,” was uploaded to the package registry on September 30, 2026, by a… Continue reading MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon→

Posted in Uncategorized

Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.
The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.
Continue reading Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel→

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access… Continue reading Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants→

Posted in Uncategorized