Device code phishing bypasses password stealing
The Microsoft 365 phishing campaign persuades victims to complete a real authentication process that authorizes an attacker-controlled device.
Threat Research
Device code phishing bypasses password stealing
How to defend ARM64 cloud infrastructure from ITScape
RL has documented CVE-2026-46316, and developed two YARA rules to help detect exploits of the multi-tenant cloud vulnerability.
Phishing attacks leverage TikTok, Instagram Reels
RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.
How 56 npm packages used binding.gyp to steal secrets
The attack is notable for its breadth, flooding npm with malicious package versions.
31 Red Hat npm packages backdoored in 72 seconds
RL has discovered a new supply chain attack affecting 9.8M total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.
Researcher's Notebook: Hunting Megalodon Fossils
Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.
Hackers Abuse Parental Controls to Hijack Google Accounts
Learn how attackers are re-casting adults as minors to bypass recovery and lock users out.
How Dirty Frag rose from the Copy Fail exploit
RL documented 163 samples of the Linux exploit's new variants, active malware — and developed YARA rules.
Copy Fail Flaw: 5 YARA Rules for Detection
Here’s what you need to know about the Linux kernel privilege escalation — and how to use YARA rules to get on top of it.
Claude adds malware to crypto agent
PromptMink has evolved into a malicious dependency in a package that allows access to crypto wallets and funds.
Graphalgo fake recruiter campaign returns
An attack targeting crypto developers has been respawned — with an LLC and new techniques.
The TeamPCP supply chain attack evolves
The malicious campaign started with Trivy and Checkmarx and has shifted to LiteLLM — and now telnix. Here's how.
Fake install logs in npm packages load RAT
The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.
Inside the NuGet hackers' toolset
RL discovered two packages containing scripts that complete a typosquatting toolchain. Here's how it worked.
Malicious NuGet package targets Stripe
Threat actors targeted developers with a bogus package — a shift away from the recent crypto development hack focus.