JadePuffer ransomware used AI agent to automate entire attack

Researchers identified what they believe is the first documented case of a ransomware operation, JadePuffer, conducted ...
The Next Web

North Korea-linked npm packages impersonate Rollup polyfill tools to steal developer secrets

Malicious npm packages mimicking Rollup polyfill tooling steal browser data, crypto wallets, and AI tool credentials in a Lazarus-linked campaign.
Tech Times

GitHub Secret Scanning Now Watches All Public Repos for Leaked Enterprise Keys

GitHub secret scanning now extends beyond org-owned repositories: Public Monitoring scans all of GitHub.com in real time, ...

ExpressVPN's password manager just got a big upgrade with secure sharing, passkey support, and more

Available today, ExpressKeys now delivers more secure sharing, passkey support, and improved cross-device management.

Why a Windows Hello PIN Beats a Password for Enterprise Security

With phishing and AI-driven identity attacks rising, Windows Hello PIN security depends on TPM-backed keys, enterprise ...

ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

ConsentFix and ClickFix attacks steal Microsoft 365 tokens in seconds using fake prompts and OAuth flows. Learn how these MFA ...
The Hacker News

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

Sysdig says JADEPUFFER used CVE-2025-3248 in Langflow to automate intrusion, credential theft, encryption, and data wipe.
SecurityWeek

Massive Password Spray Campaign Targeting Azure CLI

Threat actors have made over 81 million login attempts in a massive password spray campaign targeting Azure CLI.
GovInfoSecurity

Azure Password-Spraying Attack Bypasses MFA Defenses

Attackers behind a password-spraying campaign targeting Microsoft Office 365 accounts have amassed dozens of victims by abusing a deprecated feature in OAuth 2.0 to ...