3 posts
A malicious NuGet package named Sicoob.Sdk impersonated the official C# SDK for the Brazilian financial cooperative Sicoob. The package was designed to silently exfiltrate sensitive banking authentication material, including PFX certificates and passwords, as well as raw transaction data, to a third-party Sentry telemetry endpoint, posing a severe risk of API impersonation and financial data exposure.
A high-severity social engineering campaign is actively targeting open source developers on Slack by impersonating Linux Foundation leaders. The multi-stage attack uses a fake AI tool lure to harvest credentials and trick victims into installing a malicious root certificate, leading to traffic interception and malware execution on macOS and Windows systems.
Since August 2025, a sophisticated phishing campaign has targeted senior professionals by impersonating Palo Alto Networks recruiters. Attackers use scraped LinkedIn data to build rapport, then falsely claim the victim's resume failed an Applicant Tracking System (ATS), ultimately soliciting fees for fraudulent resume optimization services.
