ThreatVectr

Threat Intelligence — Page 24

Illustration: a darkened developer workstation with a terminal window glowing on the monitor
Threat Intelligence

Booby-trapped jscrambler npm release runs infostealer the moment you install it

Version 8.14.0 of a popular JavaScript protection package shipped with a hidden payload that fires during install, no code changes required from the developer.

3 min read
Illustration: A vast dark server room with long rows of glowing rack servers receding into the distance
Threat Intelligence

Dormant GitHub Accounts Quietly Mapped Thousands of Organisations for Months

Criminals used more than 50 sleeping accounts to probe GitHub's public data systems in what security researchers call a sustained reconnaissance campaign.

3 min read
Illustration: a dimly lit developer workstation at night
Threat Intelligence

Attackers Hijacked Injective Labs' GitHub to Slip Wallet-Stealing Code Into npm

A tampered @injectivelabs/sdk-ts release quietly siphoned crypto wallet keys and seed phrases from developers who installed it.

4 min read
A large illuminated server room at night, rows of blinking blue and amber lights on rack-mounted hardware, a single open rack door casting a faint glow on a pol
Threat Intelligence

DHS Database Breached, Adobe Speeds Up Patches, and Canada Shuts Down Ransomware Groups

A US government database hit, a faster fix schedule from a major software maker, and a Canadian crackdown on ransomware criminals. Here's what happened.

3 min read
Illustration: a laptop screen showing a generic software installer window mid-download
Threat Intelligence

Silver Fox's New MODBEACON Trojan Hides Inside Fake Software Installers

The China-linked group is using booby-trapped downloads to plant a Rust-built remote-control tool that talks to its handlers over encrypted channels.

3 min read
Illustration: a dimly lit server rack in a data centre, one server unit glowing with an unusually bright open port indicator
Threat Intelligence

Cybercrime Crew Leaves Its Own Server Wide Open, Exposing 1.4 Million Website Target List

A misconfigured server ran unprotected for three weeks, handing researchers a rare look inside a mass WordPress hacking operation now tracked as WP-SHELLSTORM.

3 min read
Illustration: Close-up, editorial news photograph
Threat Intelligence

Microsoft Exposes GigaWiper, a New Malware That Spies on Victims Before Destroying Them

A newly discovered backdoor called GigaWiper quietly watches infected computers for months, then wipes or encrypts everything on command, with no way to recover the data.

3 min read
Illustration: hundreds of identical pale green folders arranged in a vast dark grid
Threat Intelligence

Over 200 Fake GitHub Repositories Caught Secretly Installing Windows Malware

A criminal operation called Muck and Load built a web of 222 phoney code repositories to trick software developers into downloading password-stealing programs, spyware, and cryptominers.

3 min read
Illustration: The mood is quiet and slightly uneasy
Threat Intelligence

Ghanaian Influencer Extradited to US Over $8 Million Romance Scam Targeting Elderly Americans

Frederick Kumi, known online as Abu Trica, allegedly used AI-generated fake identities to defraud older Americans out of more than $8 million. His extradition is now the subject of a constitutional dispute in Ghana.

3 min read
Illustration: a dimly lit server room with rows of blinking network switches and cable trays
Threat Intelligence

Your Business Is Not Too Small to Be an Iranian Hacker's Next Target

Groups linked to Iran's intelligence services are not hand-picking victims. They're scanning the internet for any door left unlocked, and a GPS company and a medical-device maker have already paid the price.

3 min read
Illustration: a developer's dark wooden desk at night, a laptop screen glowing with abstract green code
Threat Intelligence

Poisoned Injective SDK on npm quietly stole crypto wallet keys for hours

A hijacked contributor account on GitHub pushed a booby-trapped version of a popular blockchain toolkit, siphoning seed phrases from any developer who ran the wrong function.

4 min read
Illustration: a dark server room with a single rack unit pulled forward, its indicator lights glowing red instead of green
Threat Intelligence

Microsoft Pulls Apart 'GigaWiper', a Windows Backdoor That's Really Three Old Wreckers in a Trench Coat

The malware lets its operator pick how to trash a machine: wipe the disk, kill the Windows drive, or fake a ransomware attack with a key that's thrown away.

3 min read
Illustration: a dim server room aisle at night, rows of dark server racks with faint green and amber status lights
Threat Intelligence

Old, Silent GitHub Accounts Are Being Used to Quietly Map Companies

Datadog Security Labs says several overlapping scraping campaigns are cataloguing corporate GitHub organisations using dormant 'ghost' accounts and stolen tokens.

3 min read
Illustration: a dimly lit open-plan office at night, a desk phone glowing under a single lamp
Threat Intelligence

Helix: the new extortion crew phoning staff to raid SharePoint files

Researchers at ReliaQuest say the group impersonates managers on the phone, tricks staff into a login trap, then pulls company documents from Microsoft SharePoint.

3 min read
Illustration: a dimly lit server room aisle, one rack door left slightly ajar with a single amber warning light glowing
Threat Intelligence

The Boring Breaches: How Small Config Mistakes Keep Owning Big Companies

This week's roundup of incidents has a common thread: not clever attacks, just loose settings, reused names, and untouched defaults doing enormous damage.

3 min read
© 2026 Threat Vectr