When running PowerShell from automation tools or agents, operations requiring administrator privileges will fail silently. Sometimes no error is produced. You might think it succeeded, but in reality, ...

ConclusionEven if the syntax is correct, it is safer not to execute PowerShell scripts created by AI directly on production ...

ClickFix lures deliver the ChainScript RAT, which uses a Polygon smart contract to locate active WebSocket ...

TASK#STOMP deploys a PowerShell backdoor that steals documents and Wi-Fi passwords, monitors files, and executes remote commands.

The TASK#STOMP backdoor steals office documents on Windows PCs, grabs new files as they're saved, and can rebuild itself if partly removed.

IntroductionIn August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the ...

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

A new Android malware called RatHat has been discovered, targeting users with an AI-powered subsystem that helps operators remotely navigate compromised devices.

PowerShell malware hides XMRig payloads in the Registry, PNGs, and WAV files, enabling stealthy cryptomining and memory-only ...

A new ClickFix malware-as-a-service (MaaS) framework called Exvicy has been built on code lifted from a rival service, ErrTraffic.

Claude Code's best feature might not be writing code at all.