NewsroomLatest briefings
Every security and AI story SECBORN has published, newest first.
Injective Labs npm SDK Backdoored to Steal Crypto Wallet Keys
Attackers compromised a contributor's GitHub account to publish a malicious version of the @injectivelabs/sdk-ts package, silently harvesting private keys and seed phrases…
GigaWiper Backdoor Combines Disk Wiping, Fake Ransomware, and Spyware
Microsoft has analyzed a modular Windows backdoor called GigaWiper that fuses three distinct destructive capabilities into a single operator-controlled toolkit.
Dormant GitHub Accounts Used to Map Corporate Orgs via API Scraping
Datadog Security Labs has identified multiple overlapping campaigns systematically enumerating GitHub organizations, repositories, and user accounts, with attackers hiding behind aged ghost…
Chrome 150 Patches 27 Vulnerabilities, Including Two Critical Flaws
Google's Chrome 150 update addresses 27 security vulnerabilities, with two critical use-after-free bugs in the Ozone and Views components leading the list.…
GhostApproval: Symlink Attack Tricks AI Coding Assistants Into Hacking Dev Machines
Wiz researchers demonstrated that a decades-old symbolic link technique can fool popular AI coding assistants into writing to sensitive system files, with…
AI Coding Agents Triggering Endpoint Security Rules Built for Attackers
Sophos analysis of endpoint telemetry found that AI coding tools like Claude Code, Cursor, and OpenAI Codex are firing behavioral detection rules…
Fake Paysafe and Skrill SDKs on npm and PyPI harvest developer credentials
Seventeen malicious packages mimicking legitimate payment SDK APIs silently exfiltrate API keys, cloud tokens, and system metadata to an attacker-controlled AWS server.
Eight Greeks Sue Intellexa for $8.7M Over Predator Spyware Surveillance
Eight Greek nationals targeted by Predator spyware have filed a civil lawsuit against Intellexa and 13 associated individuals, seeking roughly 7.6 million…
Block to Pay $45M Settlement Over Cash App Security Failures
Forty-six state attorneys general have reached a bipartisan settlement with Block, Inc. over allegations that Cash App misled users about fraud protections…
Mount Royal University Hit by Data Theft and Wiping Attack
Calgary's Mount Royal University confirmed hackers stole files from its H drive and wiped a separate departmental drive in a June 17…
Prompt Injection Flaw in GitHub Agentic Workflows Can Expose Private Repos
A vulnerability dubbed GitLost allows unauthenticated attackers to leak private repository contents by hiding malicious instructions inside a public GitHub Issue, requiring…
Google Dialogflow CX Flaw Let Attackers Hijack AI Chatbot Conversations
A vulnerability dubbed Rogue Agent allowed an attacker with edit access to one Dialogflow CX agent to silently compromise all Code Block-enabled…