VS Code Extensions Exploited by Evelyn Stealer for Data Theft

The trusted tools in a developer’s arsenal are becoming the latest attack vector. A sophisticated new malware campaign is weaponizing the Microsoft Visual Studio Code (VS Code) extension marketplace to deliver a powerful information stealer called Evelyn Stealer. This malware specifically targets software developers, a high-value target group with access to critical credentials, proprietary code, and organizational infrastructure. Understanding the mechanics of this attack is the first step in building effective defenses for your development environment.

AWS CodeBuild Misconfiguration Could Have Led to GitHub Supply Chain Attacks

In the high-speed world of DevOps, the AWS CodeBuild service is a cornerstone for continuous integration and delivery (CI/CD). However, a pervasive and often overlooked misconfiguration can transform this powerful tool into a critical vulnerability, silently exposing sensitive credentials like AWS IAM keys, API tokens, and SSH keys to the public internet. This isn’t a theoretical flaw; it’s a real-world attack vector actively exploited by threat actors scanning for improperly secured build logs.

The Challenge of Measuring Attack Surface Management ROI

You’ve pitched a new Attack Surface Management (ASM) platform to your leadership. You’ve talked about shadow IT, unknown attack vectors, and digital risk. Yet, when the CFO asks for the Return on Investment (ROI), the conversation stalls. How do you quantify the value of a threat that was never allowed to become a breach? This is the fundamental ROI problem in cybersecurity, and it’s particularly acute for proactive disciplines like attack surface management.

Google Cloud Feature Exploited in Sophisticated Phishing Campaign

In the ever-evolving landscape of cyber threats, a disturbing trend has gained prominence: hackers are increasingly abusing legitimate cloud services to launch sophisticated phishing campaigns. A prime target is Google Cloud email infrastructure, including Google Workspace and Gmail. This tactic, a form of Google Cloud email abuse, allows attackers to bypass traditional security filters that often trust emails from major providers like Google. By setting up seemingly legitimate Google domains or compromising existing accounts, cybercriminals craft emails that appear highly credible, dramatically increasing their success rate for stealing credentials, distributing malware, and orchestrating financial fraud.