Chrome Extension Hijacked to Deliver Malware, Steal Crypto Wallets

A compromised Chrome extension with 7,000 users was updated to deploy malware, strip security headers, and steal cryptocurrency wallet seed phrases.
The Hacker News

North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT

North Korean-linked campaign publishes 26 malicious npm packages hiding C2 in Pastebin, deploying credential stealers & RAT ...

Third-Party Patching and the Business Footprint We All Share

Everyday tools like PDF readers, email clients, and archive utilities quietly define the real attack surface. Action1 explains how third-party software drift increases exploit risk and why consistent ...
CSOonline

Attackers exploit decade‑old Windows driver flaw to shut down modern EDR defenses

Attackers abused a signed but long-revoked EnCase Windows kernel driver in a BYOVD attack to terminate all security tools. In a recent incident, attackers abused a legitimate but vulnerable Windows ...
Kotaku

Steam Game Devs Call Exploit Allegations ‘Clickbait Exaggeration’ And ‘Malicious Defamation’

The developers behind a popular “open source MMO RTS sandbox game for programming enthusiasts” on Steam, named Screeps: World, have been forced to update their game “in order to protect both players” ...
CoinTelegraph

Saga pauses chainlet after $7M exploit that depegged its stablecoin

Saga’s US dollar-pegged stablecoin has dropped to $0.75, while the protocol's total value locked has fallen by around 55% over the past 24 hours. Layer-1 blockchain protocol Saga has paused its ...
9to5google

Many Google Fast Pair devices need an update to patch exploits that allowed attackers to track you

Google’s Fast Pair protocol delivers one of the best Bluetooth experiences you’ll find today, automatically pairing wireless earbuds, speakers, and other accessories and sharing those details across ...
Ars Technica

A single click mounted a covert, multistage attack against Copilot

Microsoft has fixed a vulnerability in its Copilot AI assistant that allowed hackers to pluck a host of sensitive user data with a single click on a legitimate URL. The hackers in this case were white ...
PC Gamer

Action RPG players will exploit anything in the name of efficiency, which is why Path of Exile 2 players are locking themselves in the campaign for profit

Third Person Shooter Arc Raiders design director says players 'never worked together' in testing, but the emergence of care bear lobbies 'encourages us to lean toward giving opportunities to have ...
Forbes

Cisco Secure Email Attacks: 0-Day Exploit Confirmed, No Fix Available

“There are no workarounds identified that directly mitigate the risk concerning this attack campaign,” is not what you want to read, having just been informed of a zero-day exploit concerning a Common ...
ZDNet

Use AI browsers? Be careful. This exploit turns trusted sites into weapons - here's how

Researchers disclosed a HashJack attack that manipulates AI browsers. Cato CTRL examined Comet, Copilot for Edge, and Gemini for Chrome. Could lead to data theft, phishing, and malware downloads.
GamesRadar+

Arc Raiders door exploit makes keycards useless, and players demand the banhammer for those using it: "The sooner Embark bans people doing this, the sooner it will stop"

Third Person Shooters Arc Raiders lead says a "prominent professor in neurology" encouraged him to submit the extraction shooter to science Third Person Shooters Arc Raiders suffers an infinite ammo ...