Anthropic’s AI coding agent silently encoded proxy hostnames and Chinese timezone data into invisible Unicode characters ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import ...

Mozilla’s 0din team showed how a Claude Code malware GitHub repo attack could use a clean-looking repository to open a ...

A threat actor is targeting banks and other high-value organizations in a phishing campaign to deliver Phantom Stealer, a credential and session-stealing malware designed to evade conventional ...

Security tooling is not written in a single language. Python powers most automation. C sits at the exploit layer. PowerShell ...

ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese ...

Three levels of indirection, all with seemingly innocuous steps, will catch a bot off-guard.

A year ago, ESET Research was part of two major operations that disrupted some of the leading cybercriminal operations at the time, Lumma Stealer and Danabot. More recently, our researchers are once ...

Existing url-loader always does Base64 encoding for data-uri. As SVG content is a human-readable xml string, using base64 encoding is not mandatory. Instead, one may only escape unsafe characters and ...

Semi-automate multi-protocol API calls, construct jq queries at the speed of light, or transform strings to and from any format.

ECMA International has approved ECMAScript 2026, the 17th edition of the specification for the JavaScript programming language. The standards organization approved the specification on June 30.