A mundane, ubiquitous example URL embedded within countless developer documentation files has horrifyingly metamorphosed into a live attack vector. The specific domain, third-party[.]com, historically utilized by developers for years as a benign, illustrative placeholder for external services, has been actively serving malicious content since at least June 2026. Explicitly targeting Windows environments, the compromised domain presents users with a fraudulent Cloudflare verification challenge, utilizing advanced social engineering to coerce them into manually executing a destructive command via the Windows "Run" dialog.

Analysis of the Carbonato botnet, which exploits exposed Docker daemons to deploy the Hermes AI framework for autonomous credential theft and host control.

Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named "Plus 5.6".

¿Instalaste Beyond The Dark en Steam? Aprende cómo detectar este malware en tu PC, auditar tus archivos y proteger tus billeteras tras el hackeo

At a Glance Attribute Details Malware Family SectopRAT (also known as ArechClient2) Threat Actor Unknown (Unconfirmed attribution) Target Victims Corporate workstations and creative audio professionals Delivery Vector Locally tampered application binaries staged in ProgramData Key Capabilities Browser credential theft, crypto wallet theft, remote shell, process manipulation Source FortiGuard Incident Response (FGIR) Executive Summary Fortinet researchers uncovered an attack chain deploying the…

An identical, highly sophisticated malicious program has successfully breached both sides of a major programming language divide simultaneously. On September 23, deeply infected releases of the MemTensor packages inexplicably materialized within both the npm (Node.js) and PyPI (Python) registries. Concealed deep within these compromised distributions lurked sckit, a remarkably versatile, cross-platform worm written in Go. The cybersecurity firm Aikido, which spearheaded the discovery, officially christened the campaign…

The nebulaai-sdk npm package version 1.0.0 includes a preinstall script that decodes a base64 and zlib compressed 257 KB Windows PE executable. Upon npm install on Windows, this executable is written to %LOCALAPPDATA%\Microsoft\Conhost\conh

Best-in-class managed intelligence suite. We help you identify emerging threats, verify your security posture, and respond effectively to reduce their impact.

Security firm CYFIRMA has identified a new double-extortion ransomware strain called Altair that targets Windows systems and uses WMI for stealthy...

Infostealer malware is giving criminals a quieter route into corporate cloud environments. Instead of forcing their way through a hardened cloud perimeter, they infect a developer or employee device …

What we're seeing across the ecosystems, from our own scan data.

PkgRadar's live view of malicious-package activity across nine ecosystems.

PkgRadar flagged this 2 days before MAL-2026-17215 was published. See the dated receipt and static evidence.