Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Payment Infrastructure Is Now Part of the Attack Surface

Every payment creates a moment of trust. A customer enters card details, a gateway approves or rejects the transaction, fraud checks run in the background, and sensitive data moves between systems in seconds. When that process works, it feels invisible. When it fails, the damage can reach far beyond a lost sale.

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

Mend’s security research team has identified a previously undocumented fifth wave of the PhantomRaven campaign, an ongoing NPM supply chain attack that has been stealing developer credentials and secrets since August 2025. This new wave uses a fresh command-and-control server, 33 new malicious packages, and a more sophisticated three-stage payload chain.

How to Stop Digital Impersonation Attacks: Why Email Authentication Alone Isn't Enough

Phishing reports and customer complaints are not early warning signals. By the time they arrive, attackers have already built the infrastructure. Lookalike domains are live, credential harvesting pages are indexed, and the exposure window is open. To stop digital impersonation attacks, organizations need to shift detection to the infrastructure preparation stage, before distribution begins.

Turning Attackers into Signals: How Deception is Redefining Threat Detection | Fidelis Security

Traditional detection methods are struggling to keep up with modern threats. What if you could turn attackers into your strongest signal? In this session, our Sales Engineer Jim breaks down how deception technology is transforming cybersecurity by: Delivering high-fidelity alerts with minimal noise Adapting dynamically to attacker behavior Extending protection to IoT and non-standard devices Scaling seamlessly across enterprise environments.

CyberPhysical Security: Protecting the Modern EV Charging Perimeter

Electric vehicles have crossed from niche technology into mainstream infrastructure. Charging networks now form a critical layer of both the energy grid and the transportation system, and attackers have noticed. EV charging sits at a three-way intersection of cloud software, operational technology, and automotive systems. Each domain has its own threat model, its own tooling, and its own team assuming someone else owns the risk. That gap is where adversaries operate.

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

A new npm supply-chain compromise is targeting the SAP developer ecosystem. The affected packages we are tracking so far are: The pattern is familiar but also a bit different: a trusted package receives a new preinstall hook, the hook runs a new setup.mjs file, and that loader downloads the Bun JavaScript runtime to execute a large obfuscated payload named execution.js. The payload is an 11.7 MB credential stealer and propagation framework.

Stryker Hack: What We Know So Far

On March 11, 2026, the Iranian hacktivist group Handala Hack Team claimed responsibility for compromising the American healthcare technology company Stryker. Public reporting suggests more than 200,000 systems were impacted and up to 50TB of data exfiltrated. While these figures remain unverified, the scale of operational disruption alone places this incident among the most significant enterprise cyber events of the year so far.

Inside the Hidden VM: How Attackers Stay Undetected

Threat actors are getting better at hiding in plain sight through using virtual environments to evade detection and deliver ransomware. New research from Sophos X-Ops reveals an increase in the abuse of QEMU, an open-source emulator, to conceal malicious activity inside virtual machines. While this technique isn’t new, its use for defense evasion is accelerating, making visibility and detection even more challenging for defenders.