Security news aggregator

Latest cybersecurity reporting from selected sources.

Yasna brings together recent headlines from selected sources and makes them easier to sort with tags, filters, and search.

40 headlines in this view

Refine the feed

Search across headline titles and summaries.

Volume over time

Weekly headline count for the current query.

Showing 20 most recent headlines of 40 Filtered view

Social engineering: 'low-cost, hard to patch, and scales well' North Korean criminals set on stealing Apple users' credentials and cryptocurrency are using a combination of social engineering and a fake Zoom software update to trick people into manually running malware on their own computers, according to Microsoft.…

The Register 17 Apr 2026, 6:20 a.m. Apple Credentials Cryptocurrency macOS Malware Microsoft North Korea Patch Social Engineering Theft

Google Sites lure leads to bogus root certificate Imagine getting asked to do something by a person in authority. An unknown malware slinger targeting open source software developers via Slack impersonated a real Linux Foundation official and used pages hosted on Google.com to steal developers' credentials and take over their systems.…

The Register 14 Apr 2026, 6:48 a.m. Certificates Credentials Google Impersonation Linux Malware Open Source Root Access Slack Theft

Also, EU probes Snapchat, RedLine suspect extradited, AstraZeneca leak claim surfaces, and more infosec in brief The cybercrime crew linked to the Trivy supply-chain attack has struck again, this time pushing malicious Telnyx package versions to PyPI in an effort to plant credential-stealing malware on developers’ systems.…

The Register 31 Mar 2026, 6:42 a.m. Breach Credentials Cybercrime Extradition Leak Malware Supply Chain Theft
The Register 3 months, 3 weeks ago

LiteLLM loses game of Trivy pursuit, gets compromised

Python interface for LLMs infected with malware via polluted CI/CD pipeline Two versions of LiteLLM, an open source interface for accessing multiple large language models, have been removed from the Python Package Index (PyPI) following a supply chain attack that injected them with malicious credential-stealing code.…

The Register 25 Mar 2026, 8:11 a.m. Compromise Credentials Infection Malware Open Source Python Supply Chain Theft

Crooks tweak familiar copy-paste ruse so that victims run malicious commands themselves A new twist on the long-running ClickFix scam is now tricking Windows users into launching Windows Terminal and pasting malware into it themselves – handing the credential-stealing Lumma infostealer the keys to their browser vault.…

The Register 7 Mar 2026, 2:37 a.m. Credentials Malware Microsoft Scam Theft Victims

Your own personal Jarvis. A bot to hear your prayers. A bot that cares. Just not about keeping you safe OpenClaw, the AI-powered personal assistant users interact with via messaging apps and sometimes entrust with their credentials to various online services, has prompted a wave of malware and is delivering some shocking bills.…

The Register 3 Feb 2026, 11:14 p.m. Artificial Intelligence Credentials Malware

Cloud-native, 37 plugins … an attacker's dream A brand-new Linux malware named VoidLink targets victims' cloud infrastructure with more than 30 plugins that allow attackers to perform a range of illicit activities, from silent reconnaissance and credential theft to lateral movement and container abuse. …

The Register 15 Jan 2026, 9:39 a.m. Abuse Cloud Credentials Lateral Movement Linux Malware Theft Victims

Amazon spilled the TEA Yet another supply chain attack has hit the npm registry in what Amazon describes as "one of the largest package flooding incidents in open source registry history" - but with a twist. Instead of injecting credential-stealing code or ransomware into the packages, this one is a token farming campaign.…

The Register 15 Nov 2025, 7:22 a.m. Amazon (company) Credentials Malware Node.js Open Source Ransomware Supply Chain Theft

PhantomRaven slipped over a hundred credential-stealing packages into npm A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, tokens, and secrets during installation. The packages appear safe when first downloaded, making them particularly difficult for security apps to identify.…

The Register 31 Oct 2025, 3:19 a.m. Credentials Malware Node.js Supply Chain Theft

New malware, even better social engineering chops The FBI and a host of international cyber and law enforcement agencies on Tuesday warned that Scattered Spider extortionists have changed their tactics and are now breaking into victims' networks using savvier social engineering techniques, searching for organizations' Snowflake database credentials, and deploying a handful of new ransomware variants, most recently DragonForce.  …

The Register 30 Jul 2025, 8:20 a.m. Credentials Database FBI Malware Ransomware Scattered Spider Social Engineering Victims

Fancy Bear can't keep its claws out of Outlook inboxes The UK government is warning that Russia's APT28 (also known as Fancy Bear or Forest Blizzard) has been deploying previously unknown malware to harvest Microsoft email credentials and steal access to compromised accounts.…

The Register 20 Jul 2025, 11:01 p.m. APT28 Compromise Credentials Email Government Malware Microsoft Russia Sanctions Theft United Kingdom Warning