Computer Security Articles

A malware campaign that was discovered early this year targeting JavaScript and Python developers with cryptocurrency-related fake recruiter tasks has spread to Terraform providers and Go modules, according to research published recently by Aikido.It is the first time the company’s research team has observed malware distributed through Terraform providers. Aikido security researcherOliver Smith wrote in a September postthat the malware overlaps with the Graphalgo npm campaign thatReversingLabs r

Key takeawaysSource scanners, SBOMs, certificate managers, network monitors, and vendor questionnaires each answer a different question, and none of them inspects the cryptography inside the software you actually run.The gap is the final software artifact: compiled binaries, packages, and COTS products where no source, manifest, or vendor disclosure exists.Binary analysis fills that gap and can produce a CBOM that ties each cryptographic asset to the component containing it.You don’t need PQC su

Managed file transfer (MFT) systems, vendor portals, EDI pipelines, and e-signature platforms have something in common that has nothing to do with how they’re built: they concentrate valuable files, privileged access, and trusted connections to dozens or hundreds of external parties in one place.That concentration, not a shared flaw in how these systems are designed, is what makes them recurring targets. Cl0p’s 2023 MOVEit campaign showed the consequences of a compromise at this layer. Emsisoft’

ReversingLabs (RL) researchers recently identified and classified the malware that Anthropic disclosed in its September 2026 report on how the Russian-based threat group Midnight Blizzard was leveraging Anthropic’s Claude AI to rebuild- and redeploy flagged software implants, making them harder for victims to detect.Asnoted in that report, RL had detected and tracked the malware samples for weeks before the Anthropic report was published — showing why behavioral intelligence and historical telem

Every post-quantum cryptography (PQC) roadmap opens with the same instruction: build an inventory of your cryptography. That is where most programs stall. The algorithms slated for replacement, including RSA and elliptic-curve cryptography (ECC) for key exchange and signatures and legacy primitives such as SHA-1, MD5, and DES, are rarely documented in one place. The hardest ones to find sit inside third-party and closed-source software, where nobody on the security team owns the data.Here’s what