sctocs

Picklescan Bugs Let Malicious PyTorch Models Bypass Scans and Run Unauthorized Code

A set of three serious vulnerabilities has been uncovered in Picklescan, an open source security tool created by Matthieu Maitre, designed to inspect Python pickle files and detect dangerous behavior before any code is executed. These flaws make it possible for attackers to hide harmful commands inside PyTorch models and completely bypass the scanner, posing […]

Picklescan Bugs Let Malicious PyTorch Models Bypass Scans and Run Unauthorized Code Read More »

Brazil Faces Banking Trojan Spread Through WhatsApp Worm and RelayNFC Relay Fraud

Brazil is facing a growing wave of cyberattacks as the threat actor known as Water Saci rolls out a more advanced infection chain that spreads banking malware through WhatsApp Web and relies on layered delivery techniques using PDF and HTA files. WhatsApp Worm Used to Deliver Banking Trojan Threat analysts from Trend Micro reported that

Brazil Faces Banking Trojan Spread Through WhatsApp Worm and RelayNFC Relay Fraud Read More »

Active Attacks on WordPress King Addons Flaw Allow Hackers to Create Admin Accounts

A severe security vulnerability affecting the King Addons for Elementor WordPress plugin is currently under active exploitation. The flaw, tracked as CVE-2025-8489 with a CVSS score of 9.8, allows unauthenticated attackers to escalate their privileges by registering directly as administrators. The issue impacts all plugin versions from 24.12.92 up to 51.1.14. The maintainers issued a

Active Attacks on WordPress King Addons Flaw Allow Hackers to Create Admin Accounts Read More »

Lazarus APT’s Remote-Worker Operations Caught Live on Camera

A collaborative investigation led by Mauro Eldritch, founder of BCA LTD, alongside NorthScan and ANY.RUN, has unveiled one of North Korea’s most persistent infiltration tactics: a network of remote IT workers linked to the Lazarus Group’s Famous Chollima division. For the first time, researchers observed the operators live, capturing their activity on what they believed

Lazarus APT’s Remote-Worker Operations Caught Live on Camera Read More »

GlassWorm Resurfaces With 24 Malicious Extensions Masquerading as Popular Developer Tools

The notorious supply chain threat, GlassWorm, has resurfaced, targeting developers by infiltrating both the Microsoft Visual Studio Marketplace and Open VSX with 24 malicious extensions. These extensions impersonate widely-used developer frameworks and tools, including Flutter, React, Tailwind, Vim, and Vue. Originally documented in October 2025, GlassWorm uses the Solana blockchain to manage command-and-control operations, harvest

GlassWorm Resurfaces With 24 Malicious Extensions Masquerading as Popular Developer Tools Read More »

Malicious npm Package Uses Hidden Prompt and Script to Bypass AI Security Tools

Cybersecurity researchers have uncovered a malicious npm package designed to manipulate AI-driven security scanners and steal sensitive data. The package, eslint-plugin-unicorn-ts-2, pretends to be a TypeScript extension of the popular ESLint plugin. It was published in February 2024 by a user named “hamburgerisland” and has been downloaded nearly 19,000 times. The package is still available.

Malicious npm Package Uses Hidden Prompt and Script to Bypass AI Security Tools Read More »

Iran Linked Hackers Hit Israeli Sectors With New MuddyViper Backdoor

Israeli organizations across academia, engineering, local government, manufacturing, technology, transportation, and utilities have become targets of a sophisticated campaign by Iranian-linked hackers deploying a new backdoor called MuddyViper. ESET attributed the attacks to the MuddyWater group, also known as Mango Sandstorm or TA450, linked to Iran’s Ministry of Intelligence and Security (MOIS). One Egyptian technology

Iran Linked Hackers Hit Israeli Sectors With New MuddyViper Backdoor Read More »

Google Fixes 107 Android Flaws Including Two Actively Exploited Framework Bugs

Google has released its latest monthly security updates for the Android operating system, delivering fixes for 107 vulnerabilities found across key system components. The update covers issues in Framework, System, Kernel, and modules from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison. Two High Severity Bugs Exploited in Real World Attacks The company confirmed that two

Google Fixes 107 Android Flaws Including Two Actively Exploited Framework Bugs Read More »

ShadyPanda Converts Popular Browser Extensions With 4.3 M of Installs Into Spyware

A long running operation linked to the threat actor ShadyPanda has been exposed for converting widely installed browser extensions into surveillance tools. The campaign has reportedly been active for about seven years and has accumulated more than 4.3 million installs. According to Koi Security, five extensions that originally functioned as legitimate utilities were altered in

ShadyPanda Converts Popular Browser Extensions With 4.3 M of Installs Into Spyware Read More »

New Albiriox MaaS Malware Hits Over 400 Apps With Fraud and Screen Control

A newly advertised Android malware called Albiriox has surfaced as a powerful malware as a service [MaaS] platform, offering attackers a broad toolkit designed for on device fraud, remote interaction, and advanced screen manipulation. Security analysts report that Albiriox is rapidly gaining traction within cybercrime forums because of its extensive capabilities and its ability to

New Albiriox MaaS Malware Hits Over 400 Apps With Fraud and Screen Control Read More »