Dependency installation security measure already defeated on npm
New btree malware bypasses the install script, negating the popular repo's measure barely two months after adoption.
Threat Research
Dependency installation security measure already defeated on npm
Restrospective: How Malicious Updates Poison Your Environment
This post-mortem on recent supply chain attacks and threat actors including S1ngularity, Shai-Hulud and TeamPCP can help you prepare for what comes next.
Malicious npm campaign targets developers integrating Twilio
The package poses as a security tool targeting developers looking to implement Internet-based apps with telecom networks.
Infostealers highlight malware-as-a-service trend
Aurastealer, ACRStealer, and RemusStealer, a new potential LumaStealer variant, show MaaS in action. Here's what you need to know.
Hidden in plain sight: How SVGs carry malicious scripts
SVGs are difficult to detect, can be snuck into content — and can do malicious and legitimate actions. Here's how malicious SVGs work.
ClickFix doesn't attack your knowledge. It attacks your trust.
One of the most effective attack methods I've analyzed this year runs on legitimate tools and willing users — and AV and EDR is blind to it.
The tale of ClickFix: 5 takeaways from RL’s new threat report
New RL research explains why ClickFix attacks are multiplying — and why reliable detection requires going beyond AV and EDR.
31 Red Hat npm packages backdoored by Miasma in 72 seconds
RL has discovered the Miasma supply chain attack affecting 9.8M total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.
Device code phishing bypasses password stealing
The Microsoft 365 phishing campaign persuades victims to complete a real authentication process that authorizes an attacker-controlled device.
How to defend ARM64 cloud infrastructure from ITScape
RL has documented CVE-2026-46316, and developed two YARA rules to help detect exploits of the multi-tenant cloud vulnerability.
Phishing attacks leverage TikTok, Instagram Reels
RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.
How 56 npm packages used binding.gyp to steal secrets
The attack is notable for its breadth, flooding npm with malicious package versions.
Researcher's Notebook: Hunting Megalodon Fossils
Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.
Hackers abuse parental controls to hijack Google accounts
Learn how attackers are re-casting adults as minors to bypass recovery and lock users out.
How Dirty Frag rose from the Copy Fail exploit
RL documented 163 samples of the Linux exploit's new variants, active malware — and developed YARA rules.