September 2025's self-replicating Shai-Hulud npm worm rewrote the supply-chain threat model. Six months later the playbook has been adopted by other actors (TeamPCP, April 2026). Here's the concrete tradecraft, the IOCs that actually fire, and the controls defenders need.
Read More
TeamPCP exploited a permissive npm OIDC trust policy to poison SAP's mbt and @cap-js packages, exfiltrating cloud and developer secrets to victim-owned GitHub repos. Here's the full attack chain and how to detect it.
Read More
The story about ‘AI Agent Traps’ — malicious web content that hijacks autonomous AI agents. Here’s how it works and how to defend against it.
Read More
A custom .NET RAT dubbed CTRL uses weaponized Windows shortcuts to hijack RDP sessions via FRP tunnels—here’s the full attack chain and how to defend against it.
Read More
Red Menshen’s upgraded BPFdoor backdoor embeds kernel-level sleeper cells in telecom networks worldwide. Here’s how it works and how to detect it.
Read More