Storylines

Recent public storylines

Crawlable detail links for recent public storyline pages.

• Microsoft warns of large-scale phishing campaign targeting thousands globally

  Microsoft has disclosed a sophisticated phishing campaign that targeted over 35,000 users across more than 13,000 organizations in 26 countries, primarily in the US.

• British cyber agency warns of patch wave amid Windows vulnerability exploitation

  The UK National Cyber Security Centre and British cyber agency have issued warnings about an impending wave of software patches driven by accelerated vulnerability discovery through AI.

• AI-assisted npm malware targets crypto wallets and macOS developers

  Recent discoveries reveal that threat actors, including DPRK-linked groups, are increasingly using AI-assisted commits to insert malicious code into npm packages. These packages serve as infection vectors for sophisticated malware such as the Minirat macOS RAT, which targets developer machines and crypto wallets. The combination of AI-driven supply chain attacks and stealthy remote access trojans underscores the urgent need for enhanced security practices in software development environments.

• Vulnerability management tools often miss critical risks despite high scan scores

  Security teams frequently face a disconnect between vulnerability scan results and actual risk exposure.

• Critical flaw causes Vect ransomware to act as a destructive wiper

  Researchers have identified a critical flaw in Vect 2.0 ransomware that causes it to wipe large files instead of encrypting them. This flaw effectively turns the ransomware into a data-destroying wiper, making file recovery impossible even by the attackers themselves.

• GlassWorm malware campaign escalates with new fake extensions in Open VSX marketplace

  The GlassWorm threat actor has significantly increased its activity by uploading 73 additional fraudulent extensions to the Open VSX code marketplace.

• FBI and Indonesian authorities dismantle global phishing network linked to $20 million fraud attempts

  Coverage discusses speculative scenarios around ~$20M; treat as market chatter and see linked sources.

• March 2025 supply chain attacks compromise open source tools and IoT devices

  In March 2025, multiple supply chain attacks targeted prominent open source application security organizations and IoT devices. Three organizations—Xygeni, Aqua/Trivy, and Checkmarkx—were compromised via GitHub Actions.

• New ClickFix malware variant uses macOS Script Editor to deliver Atomic Stealer

  A new variant of the ClickFix malware campaign bypasses Apple’s Terminal security warnings by exploiting the macOS Script Editor via the applescript:// URL scheme.

• Credential monitoring gaps and recurring incidents raise hidden security costs

  Recent analysis reveals that relying solely on breach monitoring is insufficient to combat credential-based attacks due to a critical gap between detection by security operations centers (SOC) and identity and access management (IAM) response processes such as session...

• Hackers use fake claude code leak to spread malware

  Researchers at Zscaler's ThreatLabz uncovered a deceptive GitHub repository that masquerades as a leak of Anthropic's Claude Code CLI source code. Hackers are leveraging this fake leak as bait to spread malware, tricking users into downloading malicious software under the guise of accessing legitimate code. This tactic highlights the ongoing use of popular software leaks as vectors for malware distribution.

• Recent developments in ransomware tactics and operations

  Recent reports highlight evolving ransomware tactics including the Yurei double extortion toolkit, the rise of multi-extortion attacks leveraging stolen data leaks, and accelerated intrusion methods by the Akira ransomware group.