A Steam Workshop map for MECCHA CHAMELEON dropped a RAT on players' PCs and led to a hijacked official Discord: what happened and what to check now.
Read more: MECCHA CHAMELEON Malware: Workshop Map to Discord Takeover
APT29's CaptiveCrunch campaign hijacks hotel Wi-Fi captive portals to deliver the CornFlake RAT and steal MFA-protected credentials. Here's how it works and the one fix that actually stops it.
Read more: The Hotel Wi-Fi Trap: How Russian Spies are Weaponizing Captive Portals (And Why You Should Stick to 5G)
A malicious Google Ad leads to a real chatgpt.com link, where a fake "Codex" install command hides a base64 payload that drops the MacSync infostealer. Here's the full chain.
Read more: How a Real ChatGPT Link Delivers Phishing via a Fake Codex Install
A self-propagating npm supply chain attack compromised keyv and 444+ packages with 2B+ monthly installs. Here's how Shai-Hulud works, why provenance checks aren't enough, and what security teams should do now.
Read more: Shai-Hulud Returns: The npm Supply Chain Worm Turning Stolen Credentials Into New Infections
Get the latest supply chain attack news. Analyze the 2026 surgical strikes on Notepad++ and EmEditor, and learn how to defend your brand's external perimeter with Phishfort.
Read more: Supply Chain Attack News: When Trust is the Trojan Horse
Navigating the job market in the Web3 and blockchain space has become a digital minefield. Learn how threat actors use fake recruitment agencies to deliver malware.
Read more: Why You Need a List of Fake Recruitment Agencies: Lessons from a Web3 Malware Attack
In the high-stakes ecosystem of Web3 and venture capital, understanding social engineering is crucial as meeting requests become routine.
Read more: Social Engineering: The 'Can You Hear Me?' Trap Explained
A phishing campaign spoofed Bitcoin Core v30.0 with fake domains and malicious downloads. Learn how PhishFort detected and neutralized the threat
Read more: Bitcoin Core Phishing Campaign: PhishFort Blocks 3 Critical Threats