Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1059.001

T1059.001PowerShell

T1059.001 — PowerShell is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 125 detection use cases covering it and 274 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
125Use cases
274Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1059 · Command and Scripting Interpreter

Use cases covering this technique (125)

Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal exploit · alerting DSΣP Office app spawning script/LOLBin child process Internal exploit · alerting DSΣP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP PowerShell encoded / obfuscated command Internal exploit · alerting DSΣP [WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) Internal exploit · alerting DSPDDCS [WEEKLY] Developer package install spawning script-host with non-registry C2 within 5 minutes Internal install · alerting DSPDD [WEEKLY] Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution Internal exploit · alerting DSΣPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access Internal install · alerting DSPDD [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s Internal install · alerting DSPDD [WEEKLY] Package manager lifecycle hook spawns network-fetching shell or runtime Internal install · alerting DSΣPDD [WEEKLY] Package manager lifecycle hook spawns runtime with outbound egress to non-registry host within 5 minutes Internal install · alerting DSPDD [WEEKLY] Script Interpreter or Package-Install Hook Egress to Free-Tier Edge SaaS Within 5 Minutes of Process Start Internal c2 · alerting DSΣPDD [WEEKLY] Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write Internal exploit · alerting DSPDD [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain Internal exploit · alerting DSΣPDD [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens Internal exploit · alerting DSΣPDD [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Internal exploit · alerting DSPDD PowerShell - Connect To Internet With Hidden Window ESCU actions · hunting P Detect Certify With PowerShell Script Block Logging ESCU actions · alerting P Detect Empire with PowerShell Script Block Logging ESCU actions · alerting P Detect Mimikatz With PowerShell Script Block Logging ESCU actions · alerting P Exchange PowerShell Module Usage ESCU actions · alerting P Get-ForestTrust with PowerShell Script Block ESCU actions · alerting P GetLocalUser with PowerShell Script Block ESCU actions · hunting P GetWmiObject User Account with PowerShell Script Block ESCU actions · hunting P Malicious PowerShell Process - Execution Policy Bypass ESCU actions · hunting P Malicious PowerShell Process With Obfuscation Techniques ESCU actions · alerting P Nishang PowershellTCPOneLine ESCU actions · alerting P Possible Lateral Movement PowerShell Spawn ESCU actions · hunting P PowerShell 4104 Hunting ESCU actions · hunting P Powershell COM Hijacking InprocServer32 Modification ESCU actions · alerting P Powershell Creating Thread Mutex ESCU actions · alerting P Powershell Defender Threat Actions Set to Allow ESCU actions · alerting P PowerShell Domain Enumeration ESCU actions · hunting P PowerShell Enable PowerShell Remoting ESCU actions · hunting P PowerShell Environment Variable Execution ESCU actions · hunting P Powershell Execute COM Object ESCU actions · alerting P Powershell Fileless Process Injection via GetProcAddress ESCU actions · alerting P Powershell Fileless Script Contains Base64 Encoded Content ESCU actions · alerting P Powershell Load Module in Meterpreter ESCU actions · alerting P PowerShell Loading DotNET into Memory via Reflection ESCU actions · hunting P PowerShell PInvoke Process Injection API Chain ESCU actions · alerting P Powershell Processing Stream Of Data ESCU actions · hunting P PowerShell Script Block With URL Chain ESCU actions · alerting P PowerShell Start or Stop Service ESCU actions · hunting P Powershell Using memory As Backing Store ESCU actions · alerting P PowerShell WebRequest Using Memory Stream ESCU actions · alerting P Recon Using WMI Class ESCU actions · hunting P Set Default PowerShell Execution Policy To Unrestricted or Bypass ESCU actions · alerting P Unloading AMSI via Reflection ESCU actions · alerting P Windows Account Access Removal via Logoff Exec ESCU actions · hunting P Windows Cobalt Strike PowerShell Loader ESCU actions · alerting P Windows Crowdstrike RTR Script Execution ESCU actions · hunting P Windows Default Cobalt Strike PowerShell Beacon ESCU actions · alerting P Windows Enable PowerShell Web Access ESCU actions · alerting P Windows Explorer.exe Spawning PowerShell or Cmd ESCU actions · hunting P Windows Explorer LNK Exploit Process Launch With Padding ESCU actions · alerting P Windows File Download Via PowerShell ESCU actions · hunting P Windows MSExchange Management Mailbox Cmdlet Usage ESCU actions · hunting P Windows Powershell Cryptography Namespace ESCU actions · hunting P Windows PowerShell FakeCAPTCHA Clipboard Execution ESCU actions · alerting P Windows PowerShell Get CIMInstance Remote Computer ESCU actions · hunting P Windows Powershell Import Applocker Policy ESCU actions · hunting P Windows PowerShell Invoke-RestMethod IP Information Collection ESCU actions · hunting P Windows PowerShell Invoke-Sqlcmd Execution ESCU actions · hunting P Windows Powershell Logoff User via Quser ESCU actions · hunting P Windows PowerShell Module File Created ESCU actions · hunting P Windows PowerShell MSIX Package Installation ESCU actions · alerting P Windows PowerShell Process Implementing Manual Base64 Decoder ESCU actions · hunting P Windows PowerShell Process With Malicious String ESCU actions · alerting P Windows Powershell RemoteSigned File ESCU actions · hunting P Windows PowerShell ScheduleTask ESCU actions · hunting P Windows PowerShell Script Block With Malicious String ESCU actions · alerting P Windows PowerShell Script From WindowsApps Directory ESCU actions · alerting P Windows PowerShell Script TabExpansion Direct Call ESCU actions · hunting P Windows PowerShell WMI Win32 ScheduledJob ESCU actions · alerting P Windows PowGoop Beacon Decoding ESCU actions · alerting P Windows Shell Process from CrushFTP ESCU actions · alerting P Windows Software Discovery Via PowerShell ESCU actions · hunting P Windows SSH Proxy Command ESCU actions · hunting P Windows Suspicious React or Next.js Child Process ESCU actions · alerting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity ESCU actions · alerting P CrushFTP Authentication Bypass Exploitation ESCU actions · alerting P Any Powershell DownloadFile ESCU actions · alerting P Any Powershell DownloadString ESCU actions · alerting P First time seen command line argument ESCU actions · hunting P Suspicious Powershell Command-Line Arguments ESCU actions · alerting P [LLM] Node.js spawning shell/recon binaries or detached node -e loader Bespoke exploit · hunting DSΣPDDCS [LLM] TeamCity server (java) process spawning an OS command interpreter — CVE-2026-63077 RCE Bespoke exploit · alerting DSΣPDDCS [LLM] Payload or JSP web shell written by the TeamCity server process — CVE-2026-63077 Bespoke install · hunting DSΣPDDCS [LLM] n8n/Node.js process spawning shell or recon utility (sandbox-escape RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] supportdev.exe Inno Setup loader spawning hidden-window PowerShell Bespoke install · alerting DSΣPDDCS [LLM] OpenAM/Tomcat Java process spawning a shell — post-deserialization RCE (CVE-2026-62263) Bespoke exploit · alerting DSΣPDDCS [LLM] ClickFix PowerShell loader spawning wscript to run downloaded VBScript Bespoke exploit · alerting DSΣPDDCS [LLM] Hidden PowerShell pulls installer.exe from pixeldrain.com to %Temp% (self-deleting dropper) Bespoke install · alerting DSΣPDDCS [LLM] Ruby interpreter spawning PowerShell -ExecutionPolicy bypass or /bin/sh (SleeperGem dropper) Bespoke exploit · hunting DSΣPDDCS [LLM] MSHTA remote HTA launched by explorer→powershell chain (ACR Stealer fileless campaign) Bespoke delivery · alerting DSΣPDDCS [LLM] Masqueraded 'Autoupdate' scheduled task run by PowerShell loader (ACR Stealer persistence) Bespoke install · alerting DSΣPDDCS [LLM] PowerShell AMSI/ETW bypass reflection (UAT-11795 WLDR evasion) Bespoke exploit · hunting DSΣPDDCS [LLM] In-memory WLDR PowerShell C2 implant (fileless, no -File, unusual parent) Bespoke c2 · hunting DSPDDCS [LLM] SiYuan Electron renderer (nodeIntegration) spawning shell/LOLBin child — XSS-to-RCE Bespoke exploit · alerting DSΣPDDCS [LLM] ZDI-CAN-25373 (CVE-2025-9491) LNK spawning PowerShell to fetch BusySnake loader Bespoke delivery · alerting DSΣPDDCS Article-specific behavioural hunt — Missed incidents, persistent threats, and response gaps: Insights from compromis Bespoke exploit · hunting DSP [LLM] npm/node postinstall script spawning a download or shell process (Mastra dropper pattern) Bespoke install · hunting DSΣPDDCS [LLM] Gamaredon stealer exfiltration to S3-compatible cloud storage (Wasabi/Tebi/Intercolo) Bespoke actions · alerting DSΣPDDCS [LLM] axios RAT Windows payload drop (6202033.vbs/.ps1, ProgramData\wt) during npm install Bespoke install · alerting DSΣPDDCS [LLM] Downloader or shell child of npm/pip install (postinstall RAT loader) Bespoke install · alerting DSΣPDDCS [LLM] axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke install · alerting DSΣPDDCS [LLM] Java/Tomcat process spawns OS command interpreter (post-Thymeleaf SSTI RCE) Bespoke actions · alerting DSΣPDDCS Article-specific behavioural hunt — axios Compromised on npm - Malicious Versions Drop Remote Access Trojan Bespoke exploit · hunting DSP [LLM] PowerShell masquerading as Windows Terminal at %PROGRAMDATA%\wt.exe (Axios RAT Windows stage) Bespoke install · alerting DSΣPDDCS [LLM] PowerShell copy masqueraded as Windows Terminal in %PROGRAMDATA% running 6202033.ps1 Bespoke install · alerting DSΣPDD Article-specific behavioural hunt — Glassworm Strikes Popular React Native Phone Number Packages Bespoke exploit · hunting DSP [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP [LLM] Pastebin-piping stager retrieved from rentry.co/openclaw-core (macOS/Linux ClawHub skill) Bespoke delivery · alerting DSPDDCS [LLM] AI coding agent spawns remote fetch-and-execute (curl | bash / curl | source) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Ja Bespoke exploit · hunting DSP [LLM] Node.js process spawning interactive shell — suspected post-exploit RCE on Next.js / RSC server Bespoke exploit · alerting DSΣPDDCS [LLM] Cursor IDE or VS Code spawning PowerShell/WScript from extensions folder (Solidity Language malware chain) Bespoke exploit · alerting DSΣPDDCS [LLM] Tomcat/Java process spawns OS shell or LOLBin (post-webshell RCE) Bespoke actions · alerting DSΣPDDCS [LLM] Log4Shell RCE execution: java/javaw spawning a shell or LOLBin Bespoke exploit · alerting DSΣPDDCS

Articles citing this technique (274)

crit Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet art-00
crit Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data art-01
high Four incident-response decisions from the Hugging Face breach art-04
crit Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads art-06
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-07
crit Ruflo MCP Flaw Lets Unauthenticated Attackers Run Commands and Poison AI Memory art-12
crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape art-13
crit Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline art-18
high Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments art-19
crit Researchers Show a Single Malicious Webpage Visit Can Compromise Tor Browser art-22
crit Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass art-26
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands art-28
crit Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates art-29
crit Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js art-30
high CubePilot drone software dev hit by DNS hijacking to intercept traffic art-37
high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43
crit 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login art-44
crit JFrog Confirms OpenAI Models Exploited Artifactory Zero-Day Before Hugging Face Breach art-47
crit Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root art-48
crit Nimbus Manticore Deploys NightLedger and Turns Victim Systems Into Covert Relays art-49
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
crit Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In art-51
crit Researcher Says AI Helped Develop Linux Traffic-Control Race Into Root Exploit art-52
crit Mirage Kitten targets Middle East and Africa region with new malware art-53
crit Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw art-55
high NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework art-57
crit Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption art-58
crit Public Exploit Released for Patched vBulletin Pre-Auth Code Execution Flaw art-61
crit n8n Sandbox Escape Lets Workflow Editors Run OS Commands as the n8n Process art-63
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65
crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66
high GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption art-67
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-72
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit [GHSA / CRITICAL] CVE-2026-62263: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass art-87
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
crit Email threat landscape: Q2 2026 trends and insights art-108
crit Russian Global Webmail Espionage art-111
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-115
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-116
high A new extortion cocktail: office printers, small ransoms, and BitLocker art-130
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-131
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-141
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-142
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-145
high ACR Stealer: Two observed intrusion chains amid increased threat activity art-146
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-147
crit Begun, the Patch Wars have art-150
high GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration art-153
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-163
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-165
high Turning threat intelligence into decisive action with Defender Experts art-167
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-168
crit OkoBot: new sophisticated malware framework targets cryptocurrency users art-169
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-174
high The serpent’s tongue: Luring the Python out of its den art-180
high AsyncAPI npm packages backdoored via GitHub Actions art-181
high How Aikido Intel detects malware and vulnerabilities first art-189
crit jscrambler npm package publishes malicious preinstall binary art-195
crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198
crit [GHSA / CRITICAL] CVE-2026-54067: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() art-207
crit Winning 54% of the time art-214
crit ESET Threat Report H1 2026 art-221
crit Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation art-223
high Threat landscape for industrial automation systems. Q1 2026 art-228
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
high Cyber readiness for SMBs: Getting the basics right art-249
crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250
high How We Added WebAuthn to a Browser-Based RDP Client art-251
high Catan and Mouse art-261
crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265
crit Secure Registry now tells you which machine pulled a compromised package art-271
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-272
high Maven Support Comes to GitHub Checks and OSS Package Search art-273
high codfish/semantic-release-action GitHub Action has been compromised art-276
crit Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector art-280
high Inside the inbox: Why cybercriminals want to break into your email account art-285
high Threat Brief: Mitigating Large-Scale Credential Attacks art-289
high Top Koi alternatives in 2026 art-290
crit CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure art-293
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-294
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-299
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301
crit OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat art-302
high The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration art-312
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-314
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-317
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
crit Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE art-327
crit Inside the Modern SOC: The 72-Minute Race art-330
high EvilTokens: A phishing attack that doesn’t steal your password art-331
high 5 Socket security alternatives and why they are better art-337
high npm v12 delivers one of the biggest security improvements in years art-339
crit OceanLotus: From external espionage to domestic targeting art-342
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-351
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-352
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-361
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-362
med Type Level Security: The future of secure AI code generation? art-363
high Why EDR and proxy won’t save you from supply chain malware art-369
high Multiple redhat-cloud-services npm Packages compromised art-370
high Nx Console VS Code Extension Compromised art-373
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-380
high What MDM can't protect on developer machines (and what to do about it) art-386
crit ESET APT Activity Report Q4 2025–Q1 2026 art-387
crit CISA KEV: CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability art-393
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-397
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-402
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-411
crit Webworm: New burrowing techniques art-413
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-422
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-428
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-431
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-435
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-437
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-440
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-442
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-446
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-459
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-468
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) art-472
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high It's time to treat browser extensions like supply chain attack vectors art-477
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-483
crit New NGate variant hides in a trojanized NFC payment app art-491
crit What the ransom note won’t say art-492
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-530
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-534
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-535
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-542
high axios compromised on npm: maintainer account hijacked, RAT deployed art-543
crit litellm: Credential Stealer Hidden in PyPI Wheel art-545
crit Popular telnyx package compromised on PyPI by TeamPCP art-547
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-548
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-551
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-553
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-554
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-555
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-556
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-557
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-565
crit EDR killers explained: Beyond the drivers art-577
crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580
crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-585
high Glassworm Strikes Popular React Native Phone Number Packages art-587
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-590
crit Cyber fallout from the Iran war: What to have on your radar art-593
crit Sednit reloaded: Back in the trenches art-596
crit Protecting education: How MDR can tip the balance in favor of schools art-607
crit PlugX Meeting Invitation via MSBuild and GDATA art-615
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-640
crit Naming and shaming: How ransomware groups tighten the screws on victims art-645
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-654
high Why Your “Skill Scanner” Is Just False Security (and Maybe Malware) art-661
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-664
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-672
crit DynoWiper update: Technical analysis and attribution art-684
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-687
high The Holiday Whisper: Shai-Hulud 3.0 art-721
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
crit ESET Threat Report H2 2025 art-732
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-753
high SHA1-Hulud, npm supply chain incident art-766
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-772
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773
crit ESET APT Activity Report Q2 2025–Q3 2025 art-793
crit Phishing Campaign Leveraging the NPM Ecosystem art-823
crit CISA KEV: CVE-2011-3402 — Microsoft Windows Remote Code Execution Vulnerability art-830
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
high npm Supply Chain Attack via Open Source maintainer compromise art-855
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-865
high Snyk Joins CISA's Secure by Design Pledge art-883
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-894
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-900
low AI Trust in Action: How Snyk Agent Redefines Secure Development art-943
med Securing GenAI Development with Snyk art-1105
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1121
crit CISA KEV: CVE-2024-38226 — Microsoft Publisher Protection Mechanism Failure Vulnerability art-1230
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1241
crit CISA KEV: CVE-2024-4879 — ServiceNow Improper Input Validation Vulnerability art-1278
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1289
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1296
med Preventing broken access control in express Node.js applications art-1328
high Snyk AppRisk Pro: A holistic approach to application risk management art-1345
high Building an npm package compatible with ESM and CJS in 2024 art-1357
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1366
high GitHub “besieged” by malware repositories and repo confusion: Why you'll be ok art-1379
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1382
high Defense in Depth art-1391
crit New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends art-1421
crit Krampus delivers an end-of-year Struts vulnerability art-1441
high Cybersecurity Venture’s 2023 Software Supply Chain Attack Report art-1538
high Modern VS Code extension development tutorial: Building a secure extension art-1556
high XS leaks: What they are and how to avoid them art-1640
med Building a security-conscious CI/CD pipeline art-1653
high Ethical hacking techniques art-1698
high Ethical Hacking: Top Tools art-1702
high Three considerations for building an effective security program art-1740
crit API Security Guide art-1751
high Securing the web (forward) art-1803
crit The rising trend of malicious packages in open source ecosystems art-1804
high Cybersecurity Hygiene 101 art-1824
high OSPO security evolution: The Kübler-Ross Model of open source art-1866
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1924
crit Key points from Google and Accenture's ransomware white paper art-1935
crit Secure Python URL validation art-1937
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1949
high Avoiding SMTP Injection: A Whitebox primer art-2006
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2072
high Securing PHP containers art-2082
crit CISA KEV: CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability art-2143
crit CISA KEV: CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability art-2158
crit Targeted npm dependency confusion attack caught red-handed art-2273
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2297
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2311
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2334
crit Alert: LaughTilYouCry ransomware sabotages npm package (with puns) art-2342
crit CISA KEV: CVE-2015-1770 — Microsoft Office Uninitialized Memory Use Vulnerability art-2375
crit CISA KEV: CVE-2014-6287 — Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability art-2438
high How Snyk helps satisfy White House cybersecurity recommendations art-2454
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2458
high Build a software bill of materials (SBOM) for open source supply chain security art-2477
crit CISA KEV: CVE-2015-2424 — Microsoft PowerPoint Memory Corruption Vulnerability art-2563
med Getting started at a new organization art-2663
crit The Secure Developer: 2021 in review art-2691
high Log4j 2.15 vulnerability CVE-2021-45046 upgraded to a critical severity arbitrary code execution art-2726
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3066
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3068
high Use Snyk security policies to prioritize fixes more efficiently art-3107
high 5 potential risks of open source software art-3133
high Docker Hub authentication: Is 2021 the year you enable 2FA on Docker Hub? art-3196
crit What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm art-3226
high Cheatsheet: top 10 application security acronyms art-3247
med Python Poetry package manager and security integration with software composition analysis tool art-3260
high SourMint malicious SDK research write up art-3280
high SourMint: iOS remote code execution, Android findings, and community response art-3282
high SourMint malicious SDK research writeup art-3313
crit Demystifying HTTP request smuggling art-3335
med Security digital transformation with James Kaplan art-3454
high PCI standards open source security requirements — how to comply? art-3502
high ReDoS vulnerabilities in npm spikes by 143% and XSS continues to grow art-3557
high How even quick Node.js async functions can block the Event-Loop art-3570
high Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months art-3585
med Python 2 vs 3: Security Differences art-3632
crit XSS Attacks: The Next Wave art-3641
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3644
high A CEO's guide to Emacs art-3693