ReversingLabs
@reversinglabs.com
ReversingLabs is the trusted name in file and software security. RL - Trust Delivered.
When the user becomes the vulnerability, new threats emerge. No exploits, just trust breaches. Dive into our #ClickFix report by Toni Dujmović for more insights! #CyberAwareness #ReversingLabs youtube.com/shorts/MHm4K...
ClickFix: The Fake CAPTCHA That Hijacks Your Clipboard
YouTube video by ReversingLabs
youtube.com
📢 New ReversingLabs research: Copy, Paste, Compromise: The Tale of ClickFix The complete #ClickFix attack chain, the MaaS economy behind it, and an open-source #YARA rule validated against 4K+ samples — 123 of them lures that evaded every #Antivirus engine. 👇 www.reversinglabs.com/clickfix
ClickFix Threat Report: Copy, Paste, Compromise | ReversingLabs | ReversingLabs
Original RL research on ClickFix: the attack chain, the MaaS economy behind it, and the YARA detection strategy that catches what AV and EDR miss.
reversinglabs.com
Gartner just defined a new market — and that matters more than it sounds. ReversingLabs was named a Visionary in the new Gartner® Magic Quadrant™ for the category we helped build. www.reversinglabs.com/blog/gartner... #SoftwareSupplyChain
This Report from Gartner Defines the Software Supply Chain Security Market | RL Blog
Explore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.
reversinglabs.com
The question is no longer "Is this software secure?" It's "Can this software be trusted?" Trust should be verified, not assumed. Download your copy of the inaugural Gartner® Magic Quadrant™ for Software Supply Chain Security report here: www.reversinglabs.com/2026-gartner...
npm v12 turns off install script execution by default — the vector Shai-Hulud, Mini Shai-Hulud, and Miasma all relied on. Security experts break down what it fixes and what attackers are already doing instead: www.reversinglabs.com/blog/npm-v12...
npm v12 blocks install scripts: What it means for software supply chain security | RL Blog
By disabling install scripts by default, it closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
reversinglabs.com
Threat actors are using #TikTok & #Instagram tutorials to deliver #Vidarstealer. One video hit 100K views and 1,700 saves — because attackers know which metrics move the algorithm. Research breakdown + IoCs: www.reversinglabs.com/blog/social-... #SocialEngineering #Phishing
Phishing Attacks Leverage TikTok, Instragram Reels | RL Blog
RL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.
reversinglabs.com
48,000 CVEs in 2025. Only 58 posed a real, exploitable threat to enterprise supply chains. "Patch everything" is mathematically dead. The signal that matters: malware, tampering, exposed secrets. Go from noise to signal: www.reversinglabs.com/blog/noise-t... #AppSec #SoftwareSupplyChainSecurity
CVE noise drowns out software supply chain threats | RL Blog
48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.
reversinglabs.com
🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.
Megalodon compromised GitHub Actions YAML files across dozens of repos — base64-encoded credential stealer, C2 on RouterHosting LLC. RL retrohunted to a related campaign 2 weeks earlier. Same C2 pattern. Same adversary. IOCs + YARA rule published: hubs.ly/Q04hVW-v0
Researcher's Notebook: Hunting Megalodon Fossils | RL Blog
Analyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.
hubs.ly
RL documented 163 samples of the Dirty Frag Linux exploit (formerly Copy Fail), active malware — and developed YARA rules for identification. Patch the kernel. Run the queries. Deploy the rules. The detection gap is now. www.reversinglabs.com/blog/dirtyfr...
How Dirty Frag rose from the Linux exploit Copy Fail | RL Blog
RL researchers documented 163 samples tied to CVE-2026-31431, identified active malware adoption — and developed YARA rules to identify them.
reversinglabs.com
Is frontier #AI risk keeping your #AppSec team up at night? Doug Levin shares the facts on #ClaudeMythos. Doug also lays out the case for why a layered #AppSec framework is essential — and what it should look like. 👇 www.reversinglabs.com/blog/how-myt...
How Claude Mythos changes the application security calculus | ReversingLabs
Here are the facts on Mythos — and why your organization must adopt a layered security framework to match the new frontier models.
reversinglabs.com
A new class of #AI-derived threats is raising red flags: #MCP post-deployment drift ("rug pull") attacks. They exploit trust of agents over time rather than at the initial point of compromise, which requires deeper visibility. Here's what you need to know. hubs.ly/Q04fhLR30
MCP client rug-pull attack worries mount for AppSec | ReversingLabs
This class of AI tool supply chain attack highlights how trust of agents can be exploited by threat actors.
hubs.ly
Malware is evolving—and targeting AI workflows. Our research on the PromptMink campaign shows how attackers are abusing AI coding agents like Claude to deliver crypto-stealing malware. This isn’t just prompt injection. It’s supply chain risk in a new form. Read: www.reversinglabs.com/blog/claude-...
Claude adds PromptMink malicious dependency to crypto agent | ReversingLabs
The malicious npm package has evolved into a dependency that allows attackers to access users’ crypto wallets and funds.
reversinglabs.com
It looks like #TeamPCP has again compromised #Checkmarx #VSCode extensions and #Docker images. Newly published VSCode extensions checkmarx.cx-dev-assist (1.17.0 & 1.19.0) and checkmarx.ast-results (2.63.0 & 2.66.0) contain malicious code. secure.software/vscode/packa...
It’s no secret modern #AppDev relies on #OpenSource — what’s catching up is how teams secure it. RL’s free Spectra Assure Community helps teams make smarter decisions about the software they use and ship. 👇 www.reversinglabs.com/blog/why-rl-...
Securing the Village: Why RL Built Spectra Assure Community | ReversingLabs
ReversingLabs built it to help development and AppSec teams secure open source dependencies, detect malware — and prevent supply chain attacks.
reversinglabs.com
High-end AppSec isn’t just for the Fortune 500. Spectra Assure Community gives devs, AppSec teams & OSS maintainers pro-grade supply chain security insights — without the cost or complexity. Move beyond blind trust 👉 secure.software/user/signup
CTA Member @reversinglabs.com on a fake recruiter campaign: www.reversinglabs.com/blog/graphal... #cybersecurity #scam #fakerecruiter
Graphalgo fake recruiter-test campaign respawned | ReversingLabs
NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.
reversinglabs.com
🚨 New RL #ThreatResearch: The #Graphalgo fake developer recruiter interview campaign is back. RL researchers have uncovered a broader network of fake companies tied to this fake recruiter operation — plus new attacker techniques. Read what the RL team found: www.reversinglabs.com/blog/graphal...
Graphalgo fake recruiter-test campaign respawned | ReversingLabs
NK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.
reversinglabs.com
The axios supply chain attack should be front an center for #AppSec teams given it's wide reach. Here's RL's immediate-response checklist — and best practices for ongoing defense. Also learn how RL’s xBOM and Spectra Assure Community can help. 👇 www.reversinglabs.com/blog/axios-a...
Axios supply chain attack: How AppSec teams should respond | ReversingLabs
Here's an incident-response checklist and ongoing best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.
reversinglabs.com
At #RSAC, JPMorgan Chase CISO Patrick Opet revisited third-party risk — and the supplier changes that followed. Is your organization learning the lesson on “trust debt”? Learn how to move beyond blind trust: www.reversinglabs.com/blog/opet-jp...
How JPMorgan Chase tackles third-party software ‘trust debt’ | ReversingLabs
JPMC CISO Patrick Opet discussed his open letter on third-party software risk — and the changes suppliers have made since.
reversinglabs.com
🚨 RL Research Alert! Look out for the compromised versions 1.14.1 and 0.30.4 of axios npm package with almost 11 billion downloads. secure.software/npm/packages...
axios@1.14.1 - npm | ReversingLabs Spectra Assure Community
Supply chain risk analysis for axios@1.14.1. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.
secure.software
Look out for compromised versions 4.87.1 and 4.87.2 of telnyx PyPI package with more than 3.75 million downloads. secure.software/pypi/package...
telnyx@4.87.2 - PyPI | ReversingLabs Spectra Assure Community
Supply chain risk analysis for telnyx@4.87.2. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.
secure.software
📢 Just dropped: New RL research! 👻 Ghost campaign returns via malicious #npm packages ⚠️ Phishes sudo passwords + hides behind fake install logs 🔍 www.reversinglabs.com/blog/npm-fak... 🛡️ Ask us about it — + Spectra Assure Community — at Booth #4328 #RSAC2026
Malicious npm packages use fake install logs to load RAT | ReversingLabs
The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.
reversinglabs.com
Security Advisory: our research team is tracking threat actor #TeamPCP, who hacked the #Trivy supply chain and infected over 140 npm packages with self-propagating malware #CanisterWorm. View our platform's analysis of a known infected package here: secure.software/npm/packages...
@teale.io/eslint-config@1.8.9 - npm | ReversingLabs Spectra Assure Community
Supply chain risk analysis for @teale.io/eslint-config@1.8.9. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.
secure.software
"Ambiguous package names & fragmented tracking methods leave organizations vulnerable to sophisticated supply chain attacks. By demanding PURLs in your SBOMs, you enforce a strict standard of visibility and accountability" www.reversinglabs.com/blog/why-you... #cybersecurity #SBOM @reversinglabs.com
How to Make Your SBOMs Actionable with PURLs | ReversingLabs
Package URLs give software components an exact address to improve vulnerability matching, which reduces alert fatigue and simplifies compliance.
reversinglabs.com
BSIMM16 reinforces that #AIcoding is the new reality — and it will further destabilize #softwaresupplychainsecurity. So step up your #AppSec. 👇 www.reversinglabs.com/blog/bsimm16...
BSIMM16 confirms it: AI redefines the AppSec landscape | ReversingLabs
AI coding is the new reality — and it will further destabilize software supply chain security. So step up your AppSec.
reversinglabs.com
🚨 RL researchers discovered a malicious package impersonating a legitimate Stripe package on #NuGet — marking a move away from blockchain-related targets while staying focused on financial development tools. Read here: www.reversinglabs.com/blog/malicio...
Malicious NuGet package targets Stripe | ReversingLabs
In this latest incident, threat actors target developers with a bogus package — a shift away from cryptocurrency development targets.
reversinglabs.com
ReversingLabs' Ashlee Benge shares how to use YARA retrohunting for detection engineering by leverageing RL's dynamic analysis of "pkr_mtsi" for defense in Spectra Analyze. 👉 hubs.ly/Q043qJY-0 #yararules #detectionengineering #malwareanalysis
How to Use YARA Retrohunting for Detection Engineering | ReversingLabs
Learn how to leverage ReversingLabs’s dynamic analysis of <em>pkr_mtsi</em> for defense using YARA Rules in Spectra Analyze.
hubs.ly
⚠️ RL #ThreatResearch: A new branch of a fake job recruitment campaign by the NK Lazarus Group, dubbed "graphalgo," is targeting #Javascript & #Python devs with a remote access trojan (RAT). Read more: hubs.ly/Q042HLPR0
Fake recruiter campaign targets crypto developers with RAT | ReversingLabs
A new branch of a well-coordinated fake job recruitment campaign is targeting Javascript and Python developers via social channels.
hubs.ly
⛓️ The recent compromise of Notepad++ underscores supply chain attack method diversification. It also serves as a reminder for why going beyond implicit trust is a must: hubs.ly/Q041-Cb30 #SoftwareSupplyChainSecurity #AppSec #DevSecOps
Notepad++ hack marks an evolution of supply chain threats | ReversingLabs
A months-long compromise of the popular source code editor underscores a diversification of attack methods. Here's why going beyond trust is key.
hubs.ly