The APT-C-60 threat actor has continued targeting Japanese organizations with a spear-phishing campaign that abuses Proton Drive, Windows shortcut files, trusted developer platforms, and native Windows utilities to deliver the SpyGlace malware. While the group retains several established tradecraft elements, including the abuse of legitimate services and the use of git.exe to execute malicious scripts, […]

The post Spear-Phishing Campaign Uses Proton Drive Links and LNK Files to Deliver SpyGlace appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

A malicious actor compromised the Jscrambler npm package and published several trojanized versions that included a hidden, cross-platform credential-stealing payload. The attack targeted developers, build pipelines, and CI/CD systems, where npm installations could access source code, cloud credentials, deployment tokens, and sensitive environment variables. Jscrambler npm Supply Chain Attack Socket’s Research Team detected the initial […]

The post Jscrambler npm Supply Chain Attack Steals Cloud Credentials and Crypto Wallet Secrets appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Operation Capsule Vault began with spear-phishing emails sent on June 22, 2026, posing as notices distributing materials from a legitimate academic event. The lures referenced the “Why Wonsan-Kalma Tourism Now?” conference, held at Seoul COEX on June 12, and incorporated publicly available event details, including its subject matter and host organizations. By reusing real-world conference […]

The post Operation Capsule Vault Uses Malicious ISO Files and Process Injection to Deliver RokRAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.