Malicious code in guras-asia-thaila (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 584a3eaf7789cf64408448deec33673358cf8787deea0a0a3a8fdebd5f052757 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-viet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d5f87625ab54d914e2bdf610e8d8e02d35dcfdfd48470cee3b895296fd36b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-nguy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dec6dd05dac813c9e303f620294c4109d49f88ab393f921bb2eaa69bd913279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-nguyen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e0917fe059a90efe2a3ebd69fb74fcc91d64c59bb9a8476043167d78a60e9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-bang (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a30634e2dd308ce521fefbe1c634d5e98dcacf263f42708644ee625c724a34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-nguye (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1adab17972c15caa7faa7438a08aaea1a3eb8fd14d8cd0735ee2941bc92f42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b1c8b4b6a595142fbaf255a932612159acf70fb1a9feaca12e2fa2f388180f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99fef1eb6e329ecece75e0dfef8538545ff6311683490344b22f04885b652918 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-koreaselatan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e0f4978d4ea16cd80f59f7bf6d10a69550616c69dd37771221e687bcf4b7e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155368 Malicious code in guras-asia-bangkok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68fa9cc2ab0575044acebe1897f19982f4dcec43859e98aa6e5c4b47ca3f829d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155385 Malicious code in guras-asia-vietn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b856eb5a2dd4f4ed709cb9a6011474bff95cbf7bf91fa93123dacda0c9e6d4fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155375 Malicious code in guras-asia-nguyen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e0917fe059a90efe2a3ebd69fb74fcc91d64c59bb9a8476043167d78a60e9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155383 Malicious code in guras-asia-vei (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33f77f6d1e46688f45224139239dce5a5d72aca47a834a58305e06b1f300bc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155365 Malicious code in guras-asia-ban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 857beb4c00b238a20cff9917d1bc515b2014fe6cb8557955d1f3ef9a300a3858 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155384 Malicious code in guras-asia-viet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d5f87625ab54d914e2bdf610e8d8e02d35dcfdfd48470cee3b895296fd36b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155382 Malicious code in guras-asia-v (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45faebf774d4bc77174806ed291f085e894027e5145addc89728ddac5c45f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155366 Malicious code in guras-asia-bang (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4a30634e2dd308ce521fefbe1c634d5e98dcacf263f42708644ee625c724a34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats

A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...

Researchers Identify PassiveNeuron APT Using Neursite and NeuralExecutor Malware

Government, financial, and industrial organizations located in Asia, Africa, and Latin America are the target of a new campaign dubbed PassiveNeuron , according to findings from Kaspersky. The cyber espionage activity was first flagged by the Russian cybersecurity vendor in November 2024, when it...

Mysterious Elephant: a growing threat

Introduction Mysterious Elephant is a highly active advanced persistent threat APT group that we at Kaspersky GReAT discovered in 2023. It has been consistently evolving and adapting its tactics, techniques, and procedures TTPs to stay under the radar. With a primary focus on targeting government...