Malicious Tensorlake npm Package Steals AWS Keys, SSH Credentials and Crypto Wallet Data
A threat actor published a compromised version of the Tensorlake npm package on October 8, 2026, embedding malware designed to steal developer secrets and...
16 Firefox Extensions Caught Stealing Crypto Wallet Recovery Phrases and Private Keys
Threat Research has uncovered a coordinated campaign involving 16 malicious Firefox extensions designed to steal cryptocurrency wallet recovery phrases and private keys.
The extensions...
Hotel Phishing Campaign Uses Ethereum and TON Blockchains to Rotate Malware C2 Servers
The emails deliver EtherRAT or TONResolver, two malware families that use public blockchains to locate their command and control servers.
Instead of keeping a fixed...
Supply Chain Malware Uses Blockchain Transactions to Dynamically Rotate Command-and-Control Servers
Threat actors are using blockchain transactions to change command-and-control (C2) servers without updating malware already installed on compromised systems.
Unit 42 research published October...
PoeLLM Malware Targets Exposed AI Servers and Uses GitHub Poem to Hide C2
Black Lotus Labs has uncovered PoeLLM, a malware campaign targeting exposed artificial intelligence services and other internet-facing applications.
Active since at least April 2026,...