A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…
Anthropic's Cowork productivity AI is vulnerable to file exfiltration attacks due to unresolved prompt injection issues. The vulnerability allows attackers to exploit isolation flaws in Claude's code execution…
Trust Wallet has confirmed a security vulnerability in version 2.68 of its browser extension, leading to the theft of funds from hundreds of users, totaling at least $6 million. Users are advised to disable the…
A hacker stole nearly $17 million in cryptocurrency from Matcha Meta users due to a security breach involving SwapNet, a decentralized exchange aggregator. The attack exploited a compromised router contract that had…
A vulnerability identified as CVE-2026-0628 in Chrome's Gemini panel allowed attackers to hijack extensions, leading to local file access and privacy violations. Google has issued a patch to address this high-severity…
A malicious Chrome extension has been identified that steals wallet credentials and enables automated trading abuse. Users of Ethereum wallets are particularly affected, as the extension allows for full wallet…
The QuickLens Chrome extension, which allowed users to perform Google Lens searches, was compromised on February 17, 2026, with the release of version 5.8 that introduced malware capable of stealing cryptocurrency…
A deceptive Chrome extension named Crypto Copilot has been identified, which poses as a legitimate Solana trading tool while secretly siphoning SOL from users' swap transactions. The extension, published on June 18,…
A malicious Chrome extension has leaked chat data from ChatGPT and DeepSeek, affecting approximately 900,000 users. The extension exploited a vulnerability to access private conversations, raising significant privacy…
A campaign involving 287 malicious Chrome extensions has been discovered, affecting over 37.4 million users. These extensions, masquerading as AI assistants, are designed to steal credentials, email content, and…