Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active si...
Microsoft
20 articles
Smashing Security podcast #487: Clippy’s crypto comeback
Microsoft's Twitter account, with its 13 million followers, was hijacked by a paperclip. There was no ransomware or data theft, just Clippy, a dodgy crypto c...
3 lessons from frontier AI vulnerability research
Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel. The post 3 lessons from frontier AI vulnerabi...
Microsoft Outlook to block MSIX attachments starting November
Microsoft announced that it will add .msix and .
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
A campaign that uses more than 100 compromised websites to distribute LUNEXSTEALER, a Windows infostealer that installs a browser extension giving attackers ...
Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception
Elastic published 14 security advisories addressing various vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint. Among these, a high-severit...
Your Windows PC can now reach other PCs through Windows App
Microsoft has made remote PC connections generally available in Windows App on Windows. Users can access physical or virtual Windows PCs alongside Windows 36...
Best Just-in-Time (JIT) Access Tools Compared (2026): Features & Pricing
Microsoft Entra PIM is the JIT baseline most enterprises already license, Britive leads born-cloud JIT, and ConductorOne/Opal fuse JIT with access governance...
12 Best Certificate Lifecycle Management (PKI) Tools Compared (2026): Features & Pricing
Keyfactor is the best all-in pick for owning PKI and lifecycle together, CyberArk (Venafi) the neutral control plane for multi-CA estates, and Let’s Encrypt ...
CISO perspectives on managing vulnerability risks in the age of AI
Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The post CISO perspectives on man...
CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which Exploitation Is More Likely
Microsoft released emergency updates for Exchange Server to fix CVE-2026-96940, a high-severity flaw that can let attackers gain higher privileges. Microsoft...
Hackers Pose as Dubai Airports Recruiters to Infect Software Engineers With ShelbyLoader V2
An Iranian state-aligned threat actor impersonated Dubai Airports recruiters to deliver weaponized coding assessments to software engineers. The operation de...
Meta and Microsoft Reduce Internal Use of Claude AI
Meta and Microsoft are reducing employee reliance on Anthropic’s Claude AI while promoting their own coding assistants, according to an October 5 report by T...
Former Employee Sentenced for Damaging Employer’s Windows Network Infrastructure
A former infrastructure engineer has been sentenced to 32 months in federal prison for damaging his employer’s computer network and demanding a ransom in Bit...
Nikkei discloses breaches of employees’ Microsoft, Google email accounts
Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousa...
11 Best Adaptive / Risk-Based Authentication Tools Compared (2026): Features & Pricing
Microsoft Conditional Access is the best adaptive engine for most workforces the deepest policy grammar at bundled cost while Duo wins pragmatic rollout, and...
11 Best Cloud Directory Services Compared (2026): Features & Pricing
Microsoft Entra ID is the best cloud directory for most organizations bundle gravity plus the clearest AD-exit road while JumpCloud wins the domainless packa...
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
A new type of ClickFix attack is using compromised websites to trick users into executing a malicious payload cached in a web browser's cache. "Instead of do...
Cybersecurity jobs available right now: October 6, 2026
Associate IAM Engineer New York City Office of Technology & Innovation | USA | On-site – View job details As an Associate IAM Engineer, you will support dail...
Microsoft's X account briefly hijacked for cryptocurrency scam
Microsoft's official X account was briefly compromised and used to promote a cryptocurrency scam involving a token named $CLIPPY.