Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Nx npm malware (Aug 2025): attackers published malicious Nx packages that weaponized AI coding agents (Claude Code, Gemini CLI, Amazon Q) via a postinstall script to inventory sensitive files and exfiltrate sensitive data to public GitHub repos named “s1ngularity-repository-*.” We break down what happened, affected versions, and how to check + respond (rotate credentials, hunt IoCs, and more). Resources.

Discover the chilling details of the Nx “s1ngularity” supply chain attack. On August 26, 2025, the massively popular Nx npm package, with millions of weekly downloads, was compromised with credential‑harvesting malware.

Chinese cyber operations aren’t random hacks; they are part of a broader geopolitical competition for information, economic advantage, and strategic influence. Every operation ties back to China’s long-term national objectives. Mei Danowski, Co-Founder of Natto Thoughts Online Publication, explains how these attacks serve national objectives and why cybersecurity defenders must adapt.

Chinese state-backed cyber operations are often misunderstood as a single, centrally controlled machine. In reality, they are fragmented, diverse, and strategically aligned with China’s national objectives, from economic development to critical infrastructure positioning. In this episode of Data Security Decoded, join Caleb Tolin as he sits down with Mei Danowski, Co-Founder of Natto Thoughts and expert in geopolitical intelligence, to explore how China’s cyber ecosystem operates and how it is shaped by cultural, political, and economic structures.

Check out the full episode on our channel for more details about PipeMagic and other cybersecurity stories from this week's Intel Chat.

This demo video showcases Xworm attacks and Splunk detections finding the different ways it executes on an OS.

Is your Android phone acting strangely? It could be spyware! Learn how to detect the warning signs and remove spyware from your device. Follow these simple steps to protect your personal data and keep your phone secure.

GPT-5 was jailbroken in under 24 hours using simple "storytelling" techniques that bypass safety guardrails. The key insight from our podcast? Individual AI requests appear legitimate but become dangerous when combined. Bad actors can request network code in one session, convincing emails in another, and credential collection forms in a third. Each task seems normal individually, but together they form a complete phishing toolkit.

In traditional intel roles, analysts avoid making direct recommendations. But Scott Scher explains why that doesn’t work in the business world. CTI teams can’t just present options, they need to say what should happen next. Scott breaks down why effective CTI must go beyond context and offer clear, actionable guidance for defenders. Hidden Truths: Traditional intel avoids giving direct recommendations Business leaders and defenders want clear next steps CTI teams must say.

Weak passwords are a major security risk, leaving your organization vulnerable to ransomware attacks, account takeovers and data breaches. In this video, we break down how weak passwords lead to ransomware, the additional risks they pose and how organizations can protect themselves.

CTI isn’t just about detecting threats, it’s about helping defenders justify the decisions they make. Scott Scher explains why cyber threat intelligence should be seen as cover, not an excuse. It should be seen as a way to prioritize and explain security actions with confidence. Scott lays out how CTI can give defenders clarity, accountability, and the ability to say.

Unwanted pop-ups, a slow system or a homepage you don’t recognize could be signs of spyware. In this video, we’ll show you the warning signs of spyware and how to remove it from your laptop. Don’t let cybercriminals spy on you — take action now!

When your AI agents go awry, rewind those changes easily with Agent Rewind from Rubrik. As AI agents gain autonomy and optimize for outcomes, unintended errors can lead to business downtime. Agent Rewind will enable organizations to undo mistakes made by agentic AI by providing visibility into agents' actions and enabling enterprises to rewind those changes to applications and data. We’ve integrated Predibase's advanced AI infrastructure with Rubrik's recovery capabilities to enable enterprises to embrace agentic AI confidently.

Defense teams and many others across the organization don’t always understand what intelligence is or how to use it. Scott Scher explains why that second part, how to use it, is what CTI teams often miss. Scott shares why intelligence must go beyond reports and clearly communicate what matters and what to do next. Key Points: Most teams don’t know how to apply raw intelligence CTI must embed the “so what” and “what now” Reports alone are not enough Actionability is what makes intel valuable.

Cyber threat intelligence is often misunderstood, seen as a niche reporting function instead of the connective tissue that links defenders, leaders, and strategy. In this episode of Data Security Decoded, join Caleb Tolin as he sits down with Scott Scher, a cyber threat intelligence (CTI) expert with an unconventional backstory, to explore how his off‑grid years shaped his view on resilience, why CTI should be seen as “counter‑threat intelligence,” and how intelligence defenders, and policy teams can work as one to turn raw data into actionable security decisions.

Agent Rewind, powered by Predibase AI infrastructure, will enable organizations to undo mistakes made by agentic AI by providing visibility into agents' actions and enabling enterprises to rewind those changes to applications and data.

AI agents have already caused unintended record updates, broken workflows, and pushed flawed logic into production systems. These misfires often go unnoticed until forecasts stall, pipelines break, or sensitive data is affected. These aren’t hallucinations. They’re executed actions with real consequences. At Rubrik, we’ve spent years helping enterprises recover from ransomware, insider threats, and operational errors. The pattern is always the same: Damage happens fast. The root cause is murky. And visibility is fragmented.

A keylogger is sneaky malware that records everything you type — passwords, emails and even payment details — without your consent. In this video, we’ll break down the warning signs of a keylogger, show you how to detect one on your device and, most importantly, how to remove it.

Is your phone acting strange? Lagging, overheating or randomly turning on the camera? You might have spyware! In this video, we break down the warning signs, how spyware gets on your phone and what you can do to protect your personal information.

The Splunk Threat Research Team created a simple script tool to automatically extract the hidden stub modules from the resource entry images. This video demo shows how this tool can extract hidden payload on those images on non-corrupted.NET Loaders.

In the fight against ransomware, every second counts—if you're manually responding only after an attack, you could already be too late. In this video, we'll explore Rubrik's Preemptive Recovery Engine, a groundbreaking capability designed to proactively detect threats and speed up your recovery response. Unlike traditional, reactive solutions, Rubrik automatically identifies clean snapshots, pinpoints the optimal recovery points, and prepares your critical data ahead of threats—dramatically shrinking your recovery window and minimizing disruption.

Too many think cybersecurity is just tools and workflows. Cyber threat intelligence expert Dustin Droullard sets the record straight: it’s complex, adaptive, and demands real critical thinking. You can’t automate instincts, and future pros need to learn how to think, not just react.

Cyber pros who ignore business strategy are hitting a ceiling. Cyber threat intelligence expert Dustin Droullard explains why understanding operations, policy, and value alignment is the missing link for future cybersecurity leaders. If you want a seat at the table, learn how the business runs.

Think malware is all code? Think again. Cyber threat intelligence expert Dustin Droullard reveals how cultural indicators, like language settings and regional context, offer hidden clues in cyber investigations. Understanding human behavior isn’t a bonus in cybersecurity. It’s the strategy. Listen to the full episode.

In this episode of Data Security Decoded, host Caleb Tolin sits down with Dustin Droullard, a cyber threat intelligence expert and former Army intelligence analyst, to discuss how global conflict is increasingly playing out in cyberspace, from digital espionage to civilian-targeted cyber operations. This episode highlights why organizations must rethink their cyber risk strategies in light of modern geopolitical threats and growing digital exposure.