Ethan Andrews

ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.

Sapphire Sleet, a North Korean state actor, is targeting the cryptocurrency and IT sectors through sophisticated npm supply chain compromises and social engineering lures on professional platforms.

ToxNetV2 is an AArch64 Linux P2P botnet that integrates NVIDIA NIM LLM services into its controller's decision-making loop to propose operational actions.

An attacker can exfiltrate sensitive local data from Amazon Kiro IDE by using malicious repository content to influence the AI agent into modifying configuration settings and triggering outbound network requests.

Sapphire Sleet (DPRK) compromised popular Rust crates including arrayref and append-only-vec by injecting a malicious typosquatted dependency, proc-macro1, to execute a second-stage backdoor at build time.

Unauthenticated attackers are chaining signature algorithm confusion and OpenSSL error handling vulnerabilities to bypass authentication and gain administrator access on WordPress sites using the miniOrange SAML SSO plugin.

NVIDIA NemoClaw instances using Ollama are vulnerable to DNS rebinding attacks that allow unauthenticated model poisoning and data exfiltration through malicious webpages.

The ToxicPanda 2.0 Android banking trojan has evolved with 167 remote commands, targeting 349 financial applications globally through advanced privilege escalation and overlay techniques.

Wiz Red Agent discovered a script injection vulnerability in Snowflake's GitHub Actions workflow, potentially introduced by AI, enabling Jira credential exfiltration.

Unauthenticated attackers can achieve remote code execution on WordPress sites by exploiting a critical file upload vulnerability in the Elementor Pro Forms module.