Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Execution/ T1059.001

T1059.001PowerShell

T1059.001 — PowerShell is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 118 detection use cases covering it and 281 threat-intel articles citing it.

Execution
View on the matrix → Filter Detection Library MITRE official spec ↗
118Use cases
281Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1059 · Command and Scripting Interpreter

Use cases covering this technique (118)

Fake CAPTCHA / clipboard-injected PowerShell (ClickFix / FakeCaptcha) Internal exploit · alerting DSΣP Office app spawning script/LOLBin child process Internal exploit · alerting DSΣP Phishing-link click correlated to endpoint execution Internal delivery · alerting DSP PowerShell encoded / obfuscated command Internal exploit · alerting DSΣP [WEEKLY] Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes Internal delivery · alerting DSPDD [WEEKLY] Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) Internal delivery · alerting DSΣP [WEEKLY] Developer/AI tooling runtime spawns shell or egress LOLBin (unauth RCE post-expl) Internal exploit · alerting DSPDDCS [WEEKLY] Developer package install spawning script-host with non-registry C2 within 5 minutes Internal install · alerting DSPDD [WEEKLY] Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution Internal exploit · alerting DSΣPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules Internal install · alerting DSΣPDD [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access Internal install · alerting DSPDD [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s Internal install · alerting DSPDD [WEEKLY] Package manager lifecycle hook spawns network-fetching shell or runtime Internal install · alerting DSΣPDD [WEEKLY] Package manager lifecycle hook spawns runtime with outbound egress to non-registry host within 5 minutes Internal install · alerting DSPDD [WEEKLY] Public-facing app auth/authz bypass into server-side code execution (patch-bypass wave) Internal exploit · alerting DSΣPDDCS [WEEKLY] Script Interpreter or Package-Install Hook Egress to Free-Tier Edge SaaS Within 5 Minutes of Process Start Internal c2 · alerting DSΣPDD [WEEKLY] Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write Internal exploit · alerting DSPDD [WEEKLY] Server / AI-agent process spawns shell or LOLBIN with public egress — post-RCE behavioural chain Internal exploit · alerting DSΣPDD [WEEKLY] Service-process parent spawns subprocess containing CLI-argument-injection tokens Internal exploit · alerting DSΣPDD [WEEKLY] Web App Interpreter (Node/Python/Java/PHP) Spawns Shell or Net-Download LOLBin on Internet-Facing Host Internal exploit · alerting DSPDD Detect Certify With PowerShell Script Block Logging ESCU actions · alerting P Detect Empire with PowerShell Script Block Logging ESCU actions · alerting P Detect Mimikatz With PowerShell Script Block Logging ESCU actions · alerting P Exchange PowerShell Module Usage ESCU actions · alerting P Get-ForestTrust with PowerShell Script Block ESCU actions · alerting P GetLocalUser with PowerShell Script Block ESCU actions · hunting P GetWmiObject User Account with PowerShell Script Block ESCU actions · hunting P Malicious PowerShell Process - Execution Policy Bypass ESCU actions · hunting P Malicious PowerShell Process With Obfuscation Techniques ESCU actions · alerting P Nishang PowershellTCPOneLine ESCU actions · alerting P Possible Lateral Movement PowerShell Spawn ESCU actions · hunting P PowerShell 4104 Hunting ESCU actions · hunting P Powershell COM Hijacking InprocServer32 Modification ESCU actions · alerting P Powershell Creating Thread Mutex ESCU actions · alerting P Powershell Defender Threat Actions Set to Allow ESCU actions · alerting P PowerShell Domain Enumeration ESCU actions · hunting P PowerShell Enable PowerShell Remoting ESCU actions · hunting P PowerShell Environment Variable Execution ESCU actions · hunting P Powershell Execute COM Object ESCU actions · alerting P Powershell Fileless Process Injection via GetProcAddress ESCU actions · alerting P Powershell Fileless Script Contains Base64 Encoded Content ESCU actions · alerting P Powershell Load Module in Meterpreter ESCU actions · alerting P PowerShell Loading DotNET into Memory via Reflection ESCU actions · hunting P PowerShell PInvoke Process Injection API Chain ESCU actions · alerting P Powershell Processing Stream Of Data ESCU actions · hunting P PowerShell Script Block With URL Chain ESCU actions · alerting P PowerShell Start or Stop Service ESCU actions · hunting P Powershell Using memory As Backing Store ESCU actions · alerting P PowerShell WebRequest Using Memory Stream ESCU actions · alerting P Recon Using WMI Class ESCU actions · hunting P Set Default PowerShell Execution Policy To Unrestricted or Bypass ESCU actions · alerting P Unloading AMSI via Reflection ESCU actions · alerting P Windows Account Access Removal via Logoff Exec ESCU actions · hunting P Windows Cobalt Strike PowerShell Loader ESCU actions · alerting P Windows Crowdstrike RTR Script Execution ESCU actions · hunting P Windows Default Cobalt Strike PowerShell Beacon ESCU actions · alerting P Windows Enable PowerShell Web Access ESCU actions · alerting P Windows Explorer.exe Spawning PowerShell or Cmd ESCU actions · hunting P Windows Explorer LNK Exploit Process Launch With Padding ESCU actions · alerting P Windows File Download Via PowerShell ESCU actions · hunting P Windows MSExchange Management Mailbox Cmdlet Usage ESCU actions · hunting P Windows Powershell Commands from DNS TXT ESCU actions · hunting P Windows Powershell Cryptography Namespace ESCU actions · hunting P Windows PowerShell FakeCAPTCHA Clipboard Execution ESCU actions · alerting P Windows PowerShell Get CIMInstance Remote Computer ESCU actions · hunting P Windows Powershell Import Applocker Policy ESCU actions · hunting P Windows PowerShell Invoke-RestMethod IP Information Collection ESCU actions · hunting P Windows PowerShell Invoke-Sqlcmd Execution ESCU actions · hunting P Windows Powershell Logoff User via Quser ESCU actions · hunting P Windows PowerShell Module File Created ESCU actions · hunting P Windows PowerShell MSIX Package Installation ESCU actions · alerting P Windows PowerShell Process Implementing Manual Base64 Decoder ESCU actions · hunting P Windows PowerShell Process With Malicious String ESCU actions · alerting P Windows Powershell RemoteSigned File ESCU actions · hunting P Windows PowerShell ScheduleTask ESCU actions · hunting P Windows PowerShell Script Block With Malicious String ESCU actions · alerting P Windows PowerShell Script From WindowsApps Directory ESCU actions · alerting P Windows PowerShell Script TabExpansion Direct Call ESCU actions · hunting P Windows PowerShell WMI Win32 ScheduledJob ESCU actions · alerting P Windows PowGoop Beacon Decoding ESCU actions · alerting P Windows Shell Process from CrushFTP ESCU actions · alerting P Windows Software Discovery Via PowerShell ESCU actions · hunting P Windows SSH Proxy Command ESCU actions · hunting P Windows Suspicious React or Next.js Child Process ESCU actions · alerting P Cisco Secure Firewall - Communication Over Suspicious Ports ESCU actions · hunting P Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity ESCU actions · alerting P CrushFTP Authentication Bypass Exploitation ESCU actions · alerting P Any Powershell DownloadFile ESCU actions · alerting P Any Powershell DownloadString ESCU actions · alerting P First time seen command line argument ESCU actions · hunting P PowerShell - Connect To Internet With Hidden Window ESCU actions · hunting P Suspicious Powershell Command-Line Arguments ESCU actions · alerting P [LLM] Nuxt/Vite dev server (node.exe) spawns shell or LOLBin child — DevTools RPC RCE Bespoke exploit · alerting DSΣPDDCS [LLM] Flowise node runtime spawns shell interpreter (post-exploit command execution) Bespoke exploit · alerting DSΣPCS [LLM] ClickFix execution reaching CaptiveCrunch infrastructure or dropping svchost32 Bespoke delivery · alerting DSΣPDDCS Article-specific behavioural hunt — OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage cam Bespoke exploit · hunting DSP [LLM] OpenAM/Tomcat Java process spawning a shell — post-deserialization RCE (CVE-2026-62263) Bespoke exploit · alerting DSΣPDDCS [LLM] Ruby interpreter spawning PowerShell -ExecutionPolicy bypass or /bin/sh (SleeperGem dropper) Bespoke exploit · hunting DSΣPDDCS [LLM] PowerShell AMSI/ETW bypass reflection (UAT-11795 WLDR evasion) Bespoke exploit · hunting DSΣPDDCS [LLM] In-memory WLDR PowerShell C2 implant (fileless, no -File, unusual parent) Bespoke c2 · hunting DSPDDCS [LLM] SiYuan Electron renderer (nodeIntegration) spawning shell/LOLBin child — XSS-to-RCE Bespoke exploit · alerting DSΣPDDCS [LLM] npm/node postinstall script spawning a download or shell process (Mastra dropper pattern) Bespoke install · hunting DSΣPDDCS [LLM] Gamaredon stealer exfiltration to S3-compatible cloud storage (Wasabi/Tebi/Intercolo) Bespoke actions · alerting DSΣPDDCS [LLM] axios RAT Windows payload drop (6202033.vbs/.ps1, ProgramData\wt) during npm install Bespoke install · alerting DSΣPDDCS [LLM] Downloader or shell child of npm/pip install (postinstall RAT loader) Bespoke install · alerting DSΣPDDCS [LLM] axios RAT Windows persistence: %PROGRAMDATA%\wt.exe drop + %TEMP%\6202033.vbs/.ps1 staging Bespoke install · alerting DSΣPDDCS [LLM] Java/Tomcat process spawns OS command interpreter (post-Thymeleaf SSTI RCE) Bespoke actions · alerting DSΣPDDCS Article-specific behavioural hunt — axios Compromised on npm - Malicious Versions Drop Remote Access Trojan Bespoke exploit · hunting DSP [LLM] PowerShell masquerading as Windows Terminal at %PROGRAMDATA%\wt.exe (Axios RAT Windows stage) Bespoke install · alerting DSΣPDDCS [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP [LLM] Pastebin-piping stager retrieved from rentry.co/openclaw-core (macOS/Linux ClawHub skill) Bespoke delivery · alerting DSPDDCS [LLM] AI coding agent spawns remote fetch-and-execute (curl | bash / curl | source) Bespoke install · alerting DSΣPDDCS Article-specific behavioural hunt — LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Ja Bespoke exploit · hunting DSP [LLM] Node.js process spawning interactive shell — suspected post-exploit RCE on Next.js / RSC server Bespoke exploit · alerting DSΣPDDCS [LLM] Cursor IDE or VS Code spawning PowerShell/WScript from extensions folder (Solidity Language malware chain) Bespoke exploit · alerting DSΣPDDCS [LLM] Tomcat/Java process spawns OS shell or LOLBin (post-webshell RCE) Bespoke actions · alerting DSΣPDDCS [LLM] Log4Shell RCE execution: java/javaw spawning a shell or LOLBin Bespoke exploit · alerting DSΣPDDCS

Articles citing this technique (281)

crit CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE art-03
crit Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects art-05
high Hacker claims 3.6 million Azure account records stolen from major companies art-06
high Snowflake GitHub Actions Flaw Lets Crafted Issues Trigger Command Injection art-08
crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access art-23
crit Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies art-25
crit How QR-code phishing can slip past corporate security measures art-27
crit Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware art-28
high SafePal data breach impacts 39,798 customers, stolen info for sale art-30
crit New AmnesiaStealer macOS malware hijacks browser sessions via remote control art-33
high ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 art-34
crit SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch art-37
crit Apple macOS Screen Sharing Flaw Exploited on Internet-Exposed Macs to Install Monero Miner art-38
high Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware art-40
high Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth art-43
high Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers art-44
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware art-46
crit APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit art-48
crit China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud art-49
high GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE art-50
crit ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories art-51
high Curiouser and Curiouser art-52
crit New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure art-53
crit AmnesiaStealer Hijacks Chromium Sessions to Give Attackers Live Browser Control on macOS art-55
crit WindRelay Android Malware Turns Victims' Phones Into NFC Relays for Payment Fraud art-58
crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59
crit Dissecting the JWR phishing framework art-60
high Armored Likho expands its cyber-espionage toolkit art-62
crit Attackers Exploit SharePoint Authentication Bypass After Public PoC Release art-63
crit Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor art-64
high 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One art-66
high OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning art-69
crit Enterprise Defenses Recovered at the Edge and Collapsed Inside art-70
crit Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws art-71
crit Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access art-72
crit Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations art-73
crit SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code art-74
crit ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access art-75
crit Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS art-76
high Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing art-79
crit Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client art-80
crit Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands art-81
high DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt art-82
crit OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development art-84
crit A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices art-85
crit Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo art-86
crit Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference part art-87
crit Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers art-88
high Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 art-89
high Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets art-90
high Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection art-91
crit Kimwolf v7: An Evolution of the Kimwolf Botnet art-92
crit The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications art-96
high Microsoft named a Leader in the 2026 IDC MarketScape for MDR/MXDR for the Enterprise art-97
crit DeadLock ransomware: Breaking down a Rust-based encryptor with decentralized recovery infrastructure art-98
high Are AI tutors safe for your kids? art-100
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS art-101
crit Inside the Modern SOC: The Identity Front Door art-102
crit ChainDrop: Inside a Self-Propagating npm Worm art-108
high Why metaphor may dictate your security strategy art-110
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit [GHSA / CRITICAL] CVE-2026-71319: Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host art-113
crit From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide art-116
crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
crit [GHSA / CRITICAL] CVE-2026-69259: Flowise RCE via SQLite Record Manager Node art-127
high The Frontier AI Vulnerability Burst: Industrializing Autonomous Zero-Day Discovery in Open-Source Software art-131
high Almost Half of Malware Samples Communicate Direct to IP art-132
crit How legitimate cloud platforms enable phishers to bypass MFA art-133
high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
crit Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks art-139
crit An analysis of incidents at Brazilian educational institutions art-146
crit Pass the Passkey: A Novel Attack Surface in Passwordless Authentication art-147
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit The Xcode Assassin Returns: A Deep Dive Into the Latest XCSSET Version art-160
crit Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan art-163
crit You were onto something with “It’s the Climb,” Miley art-165
high ​​​​What’s new in Microsoft Security: July 2026 art-166
crit OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia art-169
crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170
high Four incident-response decisions from the Hugging Face breach art-175
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit [GHSA / CRITICAL] CVE-2026-62263: OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass art-203
crit Russian Global Webmail Espionage art-217
high Finding eight high-severity vulnerabilities in NodeBB in six hours art-222
high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-223
high Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters art-237
crit SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts art-246
crit Unauthenticated RCE in WordPress core (wp2shell), via SQL injection art-247
crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-249
crit AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report art-250
crit Begun, the Patch Wars have art-253
crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-256
crit Coordinated AsyncAPI Supply Chain Attack: Miasma RAT Delivered via Compromised CI/CD Pipelines in Two Repositories art-259
crit The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) art-263
crit [GHSA / CRITICAL] CVE-2026-52881: MantisBT: Reflected XSS in admin/install.php via unescaped printf art-265
crit TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development art-267
crit [GHSA / CRITICAL] GHSA-9hc2-hjx8-q6pv: TidGi Desktop Remote Code Execution via Malicious TiddlyWiki Repository Import — Tiddler Startup Modu art-271
high AsyncAPI npm packages backdoored via GitHub Actions art-276
high How Aikido Intel detects malware and vulnerabilities first art-284
crit jscrambler npm package publishes malicious preinstall binary art-290
crit [GHSA / CRITICAL] CVE-2026-54067: SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() art-302
crit ESET Threat Report H1 2026 art-312
high Cyber readiness for SMBs: Getting the basics right art-322
crit Secure Registry now tells you which machine pulled a compromised package art-326
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-327
high Maven Support Comes to GitHub Checks and OSS Package Search art-328
high codfish/semantic-release-action GitHub Action has been compromised art-331
high Inside the inbox: Why cybercriminals want to break into your email account art-337
high Top Koi alternatives in 2026 art-341
high Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances art-344
high Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets art-349
crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-351
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-362
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-365
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high EvilTokens: A phishing attack that doesn’t steal your password art-377
high 5 Socket security alternatives and why they are better art-383
high npm v12 delivers one of the biggest security improvements in years art-385
crit OceanLotus: From external espionage to domestic targeting art-388
high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-396
high Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled After Supply Chain Attack Targeting AI Coding Ag art-397
crit Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System art-398
crit Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp art-407
high Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp art-408
med Type Level Security: The future of secure AI code generation? art-409
high Why EDR and proxy won’t save you from supply chain malware art-415
high Multiple redhat-cloud-services npm Packages compromised art-416
high Nx Console VS Code Extension Compromised art-419
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-426
high What MDM can't protect on developer machines (and what to do about it) art-432
crit ESET APT Activity Report Q4 2025–Q1 2026 art-433
crit CISA KEV: CVE-2026-48027 — Nx Console Embedded Malicious Code Vulnerability art-439
crit BTMOB: A stealthy RAT burrowing deep into Android devices art-443
med Foul play: Fake FIFA websites target soccer fans looking for World Cup tickets, merchandise art-448
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-457
crit Webworm: New burrowing techniques art-459
high The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-468
crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-471
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account art-474
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-477
crit FrostyNeighbor: Fresh mischief and digital shenanigans art-481
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-483
crit Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack art-486
crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488
crit PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale art-492
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit CanisterSprawl: pgserve Compromised on npm: Malicious Versions Harvest Credentials and Exfiltrate to a Decentralized ICP Canister art-504
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
crit Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer art-513
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) art-517
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high It's time to treat browser extensions like supply chain attack vectors art-522
high Is Shai-Hulud Back? Compromised Bitwarden CLI Contains a Self-Propagating npm Worm art-528
crit New NGate variant hides in a trojanized NFC payment app art-536
crit What the ransom note won’t say art-537
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
high As breakout time accelerates, prevention-first cybersecurity takes center stage art-574
high Malicious IoliteLabs VSCode Extensions Target Solidity Developers on Windows, macOS, and Linux with Backdoor art-577
crit TeamPCP Plants WAV Steganography Credential Stealer in telnyx PyPI Package art-578
high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-585
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
high A cunning predator: How Silver Fox preys on Japanese firms this tax season art-589
high CanisterWorm: How a Self-Propagating npm Worm Is Spreading Backdoors Across the Ecosystem art-592
crit bittensor-wallet 4.0.2 Compromised on PyPI - Backdoor Exfiltrates Private Keys art-594
high Malicious npm Releases Found in Popular React Native Packages - 130K+ Monthly Downloads Compromised art-595
crit Malicious Polymarket Bot Hides in Hijacked dev-protocol GitHub Org and Steals Wallet Keys art-596
crit ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push art-597
high xygeni-action Compromised: C2 Reverse Shell Backdoor Injected via Tag Poisoning art-598
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
crit EDR killers explained: Beyond the drivers art-613
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-620
high DRILLAPP: new backdoor targeting Ukrainian entities with possible links to Laundry Bear art-623
crit Cyber fallout from the Iran war: What to have on your radar art-626
crit Sednit reloaded: Back in the trenches art-629
crit Protecting education: How MDR can tip the balance in favor of schools art-640
crit PlugX Meeting Invitation via MSBuild and GDATA art-648
high 20+ Popular NPM Packages Compromised (Chalk, Debug, Strip-ANSI, Color-Convert, Wrap-ANSI...) art-673
crit Naming and shaming: How ransomware groups tighten the screws on victims art-678
crit Another npm Supply Chain Attack: The 'is' Package Compromise art-687
high Why Your “Skill Scanner” Is Just False Security (and Maybe Malware) art-694
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-697
crit Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise art-705
crit DynoWiper update: Technical analysis and attribution art-717
med Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan art-719
high The Holiday Whisper: Shai-Hulud 3.0 art-751
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
crit ESET Threat Report H2 2025 art-762
high Security Advisory: Critical RCE Vulnerabilities in React Server Components (CVE-2025-55182) art-782
high SHA1-Hulud, npm supply chain incident art-796
med Why Threat Modeling Is Now Even More Critical for AI-Native Applications art-802
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803
crit Phishing Campaign Leveraging the NPM Ecosystem art-846
crit CISA KEV: CVE-2011-3402 — Microsoft Windows Remote Code Execution Vulnerability art-853
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
high npm Supply Chain Attack via Open Source maintainer compromise art-878
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-888
high Snyk Joins CISA's Secure by Design Pledge art-906
crit Maintainers of ESLint Prettier Plugin Attacked via npm Supply Chain Malware art-917
high Cursor IDE Malware Extension Compromise in $500k Crypto Heist art-924
low AI Trust in Action: How Snyk Agent Redefines Secure Development art-966
med Securing GenAI Development with Snyk art-1128
crit CISA KEV: CVE-2024-55956 — Cleo Multiple Products Unauthenticated File Upload Vulnerability art-1144
crit CISA KEV: CVE-2024-38226 — Microsoft Publisher Protection Mechanism Failure Vulnerability art-1253
high The persistent threat: Why major vulnerabilities like Log4Shell and Spring4Shell remain significant art-1264
crit CISA KEV: CVE-2024-4879 — ServiceNow Improper Input Validation Vulnerability art-1301
high A stepping stone towards holistic application risk and compliance management of the Digital Operational Resiliency Act (DORA) art-1312
crit Polyfill supply chain attack embeds malware in JavaScript CDN assets art-1319
med Preventing broken access control in express Node.js applications art-1351
high Snyk AppRisk Pro: A holistic approach to application risk management art-1368
high Building an npm package compatible with ESM and CJS in 2024 art-1380
high Exploiting HTTP/2 CONTINUATION frames for DoS attacks art-1389
high GitHub “besieged” by malware repositories and repo confusion: Why you'll be ok art-1402
crit Snyk Learn and the NIST Cybersecurity Framework (CSF) art-1405
high Defense in Depth art-1415
crit New Year's security resolutions for 2024 from Snyk DevRel, SecRel, and friends art-1444
crit Krampus delivers an end-of-year Struts vulnerability art-1464
high Cybersecurity Venture’s 2023 Software Supply Chain Attack Report art-1561
high Modern VS Code extension development tutorial: Building a secure extension art-1579
high XS leaks: What they are and how to avoid them art-1663
med Building a security-conscious CI/CD pipeline art-1676
high Ethical hacking techniques art-1721
high Ethical Hacking: Top Tools art-1725
high Three considerations for building an effective security program art-1764
crit API Security Guide art-1774
high Securing the web (forward) art-1826
crit The rising trend of malicious packages in open source ecosystems art-1827
high Cybersecurity Hygiene 101 art-1847
high OSPO security evolution: The Kübler-Ross Model of open source art-1889
high Fetch the Flag CTF 2022 writeup: Treasure Trove art-1947
crit Key points from Google and Accenture's ransomware white paper art-1958
crit Secure Python URL validation art-1960
crit Understanding DNS attacks: Identifying and patching vulnerabilities art-1972
high Avoiding SMTP Injection: A Whitebox primer art-2029
high Snyk finds PyPi malware that steals Discord and Roblox credential and payment info art-2095
high Securing PHP containers art-2105
crit CISA KEV: CVE-2013-1331 — Microsoft Office Buffer Overflow Vulnerability art-2166
crit CISA KEV: CVE-2009-0563 — Microsoft Office Buffer Overflow Vulnerability art-2181
crit Targeted npm dependency confusion attack caught red-handed art-2296
high An unintimidating introduction to the dark arts of C/C++ vulnerabilities art-2320
crit CISA KEV: CVE-2018-20753 — Kaseya VSA Remote Code Execution Vulnerability art-2334
med Snyk Open Source adds C/C++ security scanning for unmanaged dependencies art-2357
crit Alert: LaughTilYouCry ransomware sabotages npm package (with puns) art-2365
crit CISA KEV: CVE-2015-1770 — Microsoft Office Uninitialized Memory Use Vulnerability art-2398
crit CISA KEV: CVE-2014-6287 — Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability art-2461
high How Snyk helps satisfy White House cybersecurity recommendations art-2477
high dompdf security alert: RCE vulnerability found in popular PHP PDF library art-2481
high Build a software bill of materials (SBOM) for open source supply chain security art-2500
crit CISA KEV: CVE-2015-2424 — Microsoft PowerPoint Memory Corruption Vulnerability art-2586
med Getting started at a new organization art-2686
crit The Secure Developer: 2021 in review art-2714
high Log4j 2.15 vulnerability CVE-2021-45046 upgraded to a critical severity arbitrary code execution art-2749
high Snyk joins OpenSSF: Tackling open source supply chain security with a developer-first approach art-3089
high How Dun & Bradstreet and Shutterstock built successful security champions programs art-3091
high Use Snyk security policies to prioritize fixes more efficiently art-3130
high 5 potential risks of open source software art-3156
high Docker Hub authentication: Is 2021 the year you enable 2FA on Docker Hub? art-3219
crit What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm art-3249
high Cheatsheet: top 10 application security acronyms art-3270
med Python Poetry package manager and security integration with software composition analysis tool art-3283
high SourMint malicious SDK research write up art-3303
high SourMint: iOS remote code execution, Android findings, and community response art-3305
high SourMint malicious SDK research writeup art-3336
crit Demystifying HTTP request smuggling art-3358
med Security digital transformation with James Kaplan art-3477
high PCI standards open source security requirements — how to comply? art-3525
high ReDoS vulnerabilities in npm spikes by 143% and XSS continues to grow art-3577
high How even quick Node.js async functions can block the Event-Loop art-3593
high Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months art-3608
med Python 2 vs 3: Security Differences art-3655
crit XSS Attacks: The Next Wave art-3664
high Which of the OWASP Top 10 Caused the World’s Biggest Data Breaches? art-3667
high A CEO's guide to Emacs art-3716