The hackers trick victims into accessing GitHub or GitLab repositories that are opened using Visual Studio Code. The post North Korean Hackers Target macOS Developers via Malicious VS Code Projects appeared first on SecurityWeek .
North Korean threat actors have evolved their techniques in the Contagious Interview campaign, now abusing Microsoft Visual Studio Code task configuration files. The infection chain begins when a victim opens a malicious Git repository, often disguised as part of a recruitment process. If trust is granted, arbitrary commands are executed on the system. The malware uses JavaScript payloads hosted on vercel.app to implement backdoor logic, including remote code execution, system fingerprinting, and persistent command-and-control communication. The backdoor collects host information and beacons to a C2 server every five seconds. Recent observations show further execution of similar payloads, indicating ongoing development of these tactics.
API cybersecurity will be a ping pong ball, battered between the rackets of AI-assisted attackers and AI-assisted defenders. The post Cyber Insights 2026: API Security – Harder to Secure, Impossible to Ignore appeared first on SecurityWeek .
Visual Studio Code is a popular open-source code editor[1]. But it's much more than a simple editor, it's a complete development platform that supports many languages and it is available on multiple platforms. Used by developers worldwide, it's a juicy target for threat actors because it can be extended with extensions.
Under the new rules, measures for 5G cybersecurity would become mandatory. The post EU Plans Phase Out of High Risk Telecom Suppliers, in Proposals Seen as Targeting China appeared first on SecurityWeek .
VoidLink is an advanced AI-generated malware framework exhibiting high maturity, modularity, and sophisticated techniques such as eBPF and LKM rootkits. It targets cloud and container environments with dedicated modules for enumeration and post-exploitation, indicating a focus on modern infrastructure. Although no known exploits in the wild have been reported yet, its architecture suggests a significant threat potential. European organizations relying on cloud-native and containerized deployments are at heightened risk due to the malware's capabilities. Mitigation requires advanced detection mechanisms tailored to eBPF and kernel-level rootkits, alongside strict cloud environment monitoring and segmentation. Countries with strong cloud adoption and critical infrastructure sectors, such as Germany, the UK, France, and the Netherlands, are likely to be most affected. Given its high impact on confidentiality, integrity, and availability, combined with ease of exploitation via AI-generated code, the suggested severity is high. Defenders should prioritize proactive threat hunting and behavioral analytics to detect this evolving threat.
The Evelyn Stealer campaign targets software developers through weaponized Visual Studio Code extensions, employing a multistage delivery of information-stealing malware. The attack chain involves a downloader disguised as a legitimate Lightshot DLL, an injector that uses process hollowing to inject the final payload, and the Evelyn Stealer itself. The malware implements sophisticated anti-analysis techniques, collects sensitive information including browser credentials and cryptocurrency data, and exfiltrates the stolen data via FTP. This campaign highlights the increasing threat to developer communities and the need for enhanced security measures in development environments.
The Sysdig Threat Research Team analyzed VoidLink, a sophisticated Linux malware framework targeting cloud environments. Key findings include the first documented Serverside Rootkit Compilation, Chinese development with AI assistance, adaptive detection evasion, and use of the Zig programming language. VoidLink employs a multi-stage loader architecture, fileless execution techniques, and kernel-level stealth mechanisms. It features three control channels, including a covert ICMP channel, and specialized functionality for cloud and container environments. Despite its sophistication, VoidLink can be detected using runtime monitoring tools. The malware shows indicators of Chinese-speaking developers with significant kernel expertise, likely using AI-assisted development methods.
PDFSIDER is a newly identified malware variant that utilizes DLL side-loading to deploy a covert backdoor with encrypted command-and-control capabilities. It exploits vulnerabilities in legitimate software like PDF24 Creator to bypass endpoint detection mechanisms. The malware operates primarily in memory, minimizing disk artifacts, and employs advanced anti-VM technology to evade sandboxes and analysis labs. PDFSIDER features a robust cryptographic implementation using the Botan library for secure communications. It gathers system information and provides attackers with an interactive, hidden command shell for remote execution. The malware's characteristics align with APT tradecraft, suggesting its use in cyber-espionage operations. Distribution occurs through spear-phishing emails containing ZIP archives with legitimate-looking executables.
Vibe coding generates a curate’s egg program: good in parts, but the bad parts affect the whole program. The post Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls appeared first on SecurityWeek .
A sophisticated cryptocurrency theft operation, orchestrated by the threat actor 'RedLineCyber', has been uncovered. The actor distributes a malicious executable named 'Pro.exe', a Python-based clipboard hijacking trojan designed for silent cryptocurrency theft. This malware continuously monitors the Windows clipboard for cryptocurrency wallet addresses and substitutes them with attacker-controlled addresses. The threat actor exploits trust within Discord communities focused on gaming, gambling, and cryptocurrency streaming. The malware demonstrates moderate technical complexity, using obfuscated Python bytecode and base64-encoded regular expressions for wallet detection. It targets cryptocurrency streamers, casino gaming communities, and users who frequently handle digital asset transactions during live broadcasts. The operation has successfully compromised multiple victims across six major cryptocurrencies.
isVerified provides Android and iOS mobile applications designed to protect enterprise communications. The post isVerified Emerges From Stealth With Voice Deepfake Detection Apps appeared first on SecurityWeek .
Designed for long-term access, the framework targets cloud and container environments with loaders, implants, and rootkits. The post VoidLink Linux Malware Framework Targets Cloud Environments appeared first on SecurityWeek .
The Predator spyware is more sophisticated and dangerous than previously realized. The post Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits appeared first on SecurityWeek .
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
