4+ day, 2+ hour ago   (649+ words) Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode. The shift puts developer credentials, Model Context Protocol configurations, prompt histories, project metadata, and potentially proprietary…...

1+ week, 1+ day ago   (461+ words) The activity, documented by PolySwarm, targeted entities in Romania, Spain, and Turkey between late September 2025 and early April 2026. New variants identified during June and July 2026 show that the group continues refining its phishing lures, malware execution chain, and command-and-control (C2) methods....

2+ week, 5+ day ago   (524+ words) The archives carried weaponized LNK files disguised as topical Japanese- and Korean-language documents, including material related to regional events and policy issues. When a recipient launches the shortcut, it executes a concealed command that opens a decoy PDF while downloading…...

3+ week, 4+ day ago   (630+ words) A critical one-click vulnerability in Microsoft Copilot Personal, tracked as CVE-2026-24301 and dubbed CoSnitch. This flaw could enable an attacker to trigger malicious Copilot prompts, access data from connected OAuth applications, and silently transmit that information to an attacker-controlled server....

3+ week, 4+ day ago   (497+ words) North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. Victims who open the bundled LNK file trigger a concealed…...