GhostFrame phishing kit fuels widespread attacks against millions

GhostFrame is a new phishing-as-a-service PhaaS kit, tracked since September 2025, that has already powered more than a million phishing attacks. Threat analysts spotted a series of phishing attacks featuring tools and techniques they hadn't seen before. A few months later, they had linked over a...

MAL-2025-192421 Malicious code in vue2-amis-custom-widget123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027b467c811b36f60dc7589ccd8251ffc56de7f40345d6a471a3a550a2a8df7e The package vue2-amis-custom-widget123 was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-63094

XiangShan Nanhu V2 and XiangShan Kunmighu V3 are affected by a speculative execution/indirect branch prediction vulnerability that enables side-channel access to data in the cache, allowing potential disclosure of sensitive information. Exploitation details are not provided in the connected docum...

Malicious code in libxmlussr1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a26137f4b62749b9f491cb82c0c0f9d95f0fa03f7dcd2e8067b39b5de0e005 The package libxmlussr1 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192426 Malicious code in libxmljsololo2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf08b4bf0c122f751f82c3c5b909759570d84e47e5059bde5729221ae910a15 The package libxmljsololo2 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192425 Malicious code in libxmlfinal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac89e3df77030c41a5f9d5ac7a10bf66dad824ef1d013c47d913be27080f190 The package libxmlfinal2 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in baidu-oscp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1707ecb3311268a4753a44190db82280e80d16015e5474475863a3e1487aa5c0 The package baidu-oscp was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in do-not-install-this-package-001 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 27c17335ba5378258efc5d22274e8104e45a493eec51d60d0adbeb9c4f627714 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

CVE-2022-50650

The CVE-2022-50650 entry concerns the Linux kernel BPF verifier and synchronous callbacks. The issue arises because the verifier treats callbacks as if they execute only once, which mismanages reference state for for_each style helpers that invoke callbacks multiple times. This can lead to refere...

MAL-2025-192378 Malicious code in shop-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0306448f7e93f12777f1ee6bfa83d502c06b0a61ae631c612fabd3f8a5d6021 The package shop-api-sdk was found to contain malicious code. Source: ossf-package-analysis...

Inside the Fix: AI-Powered Root Cause Analysis of CVE-2025-60719

...

AI-Automated Threat Hunting Brings GhostPenguin Out of the Shadows

In this blog entry, Trend™ Research provides a comprehensive breakdown of GhostPenguin, a previously undocumented Linux backdoor with low detection rates that was discovered through AI-powered threat hunting and in-depth malware analysis...

MAL-2025-192361 Malicious code in datadog-checks-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c81f3e37fe2d626410665826364d682e76edf32642b1cf36d4b12b987a9b102 The package datadog-checks-base was found to contain malicious code. Source: ghsa-malware...

Malicious code in ssf-desktop-api-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5940c26ac6aa2f9c3682f4d383922757d2d5c361b5a70140ca289eabe304be8d The package ssf-desktop-api-browser was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192360 Malicious code in ssf-desktop-api-openfin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367b2689b7d50c48e26747ef1edce3a36165d64fd361ad3fc19f1c52fce204f9 The package ssf-desktop-api-openfin was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192350 Malicious code in express-my-error-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f2d01a1484943569d365369896d46ee7229516152d056b0403048a740e7bcc The package express-my-error-handler was found to contain malicious code. Source: ghsa-malware...

AgenticCyber: A GenAI-Powered Multi-Agent System for Multimodal Threat Detection and Adaptive Response in Cybersecurity

The increasing complexity of cyber threats in distributed environments demands advanced frameworks for real-time detection and response across multimodal data streams. This paper introduces AgenticCyber, a generative AI powered multi-agent system that orchestrates specialized agents to monitor...

BEACON: A Unified Behavioral-Tactical Framework for Explainable Cybercrime Analysis with Large Language Models

Cybercrime increasingly exploits human cognitive biases in addition to technical vulnerabilities, yet most existing analytical frameworks focus primarily on operational aspects and overlook psychological manipulation. This paper proposes BEACON, a unified dual-dimension framework that integrates...

Docker-Exploit-Mapper

DEM — Docker Exploit Mapper Welcome to DEM, a fully con...

LLM Causality Analysis Framework

A comprehensive framework for multi-level causality analysis in Large Language Models LLMs, enabling systematic investigation of safety mechanisms and misbehavior detection across token, neuron, layer, and representation levels. Includes the whitepaper 2512.04841.pdf titled SoK: A Comprehensive...