Malware

Operators of the Shai Hulud malware that compromised thousands of developer environments have been testing yet another variant of the worm dubbed "The Golden Path," which has been integrated into the npm package "@vietmoney/react-big-calendar," reports The Cyber Express.

Cybernews reports that Massachusetts-based accounting firm CSA Tax & Advisory had corporate and client data allegedly compromised by the Lynx ransomware-as-a-service operation.

Romania's Complexul Energetic Oltenia, which is the country's largest coal-based energy producer, had its IT infrastructure disrupted in a Dec. 26 ransomware attack claimed by the Gentlemen ransomware operation, reports BleepingComputer.

New Cosmali Loader deployed via bogus MAS Windows activation domain Windows systems have been infected with the new Cosmali Loader through illicit PowerShell scripts deployed through a typosquatted Microsoft Activation Scripts tool domain, BleepingComputer reports.

Tools such as Nezha evade signature detection, blend with normal activity, and reduce development effort.

Over 25,000 repositories and hundreds of npm packages have already been impacted by the new Shai Hulud malware campaign that automates developer environment compromise, SiliconANGLE reports.

More advanced malware tapped by Arcane Werewolf in Russia-targeted attacks Multiple manufacturing organizations across Russia have been targeted by cyberespionage operation Arcane Werewolf, also known as Mythic Likho, with the more sophisticated Loki 2.1 malware toolkit, according to GBHackers News.

BleepingComputer reports that over a dozen GitHub repositories purporting to have proof-of-concept exploits for several newly disclosed flaws including the Windows Remote Access Connection Manager privilege escalation bug, tracked as CVE-2025-59230 have been leveraged to distribute the WebRAT malware since September.