MAL-2025-50015 Malicious code in candra-semur75-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e5c2bfeb6069df20fd7e5fe1feeb41921037b008def540a1488177b85a33e5 The package candra-semur75-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51869 Malicious code in fauzi-miemee32-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dab3fbc9d8e9f4e2e5e163bed074d731515392ff02db143d296f5abc7e12df2 The package fauzi-miemee32-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50713 Malicious code in wibowo-donat72-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ff8b810c13e478b35c4e662d3b90ea845174a9da748f785554507d390fc463e The package wibowo-donat72-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51366 Malicious code in cindy-naget91-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3aa942798c153cfcc01cf68019aeea3332b43e8ff4255728e07eb3a92b126d9 The package cindy-naget91-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51071 Malicious code in bella-peyek48-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46bc96beeeccc8574187fffa49ff3fd30eb40c95762da53259b6c5267c8edc65 The package bella-peyek48-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-51465 Malicious code in citra-toge29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c485fb2307e3e3eb03ddc278119316b051b1131ff3a90372108f611b97a46e The package citra-toge29-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-51687 Malicious code in eko-rangi54-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9b80963f49f03cb091da6b88b1c248651019b9d2948133b3969a2d38ecac25e The package eko-rangi54-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-51775 Malicious code in fadhil-bakso42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b3403dde5fe42153a986ff6f9f3e3497eea14658d0fa6d414bd129dd541582b The package fadhil-bakso42-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-51735 Malicious code in erick-tapai63-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c87786fa2bb9046f5ae5a5b583b26475e85a47261e84f9a7f03568e02455ca2 The package erick-tapai63-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

What Security Teams Need to Know as PHP and IoT Exploits Surge

Attack automation is accelerating, widening the window between detection and response. Qualys TRU telemetry reveals how these attacks unfold and what defenders can do next. The Qualys Threat Research Unit TRU has identified a sharp increase in attacks targeting PHP servers, IoT devices, and cloud...

Russian Hackers Exploit Adaptix Pentesting Tool in Ransomware Attacks

Silent Push wars of Russian hackers exploiting Adaptix, a pentesting tool built for Windows, Linux, and macOS, in ransomware campaigns...

New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human

Cybersecurity researchers have disclosed details of a new Android banking trojan called Herodotus that has been observed in active campaigns targeting Italy and Brazil to conduct device takeover DTO attacks. "Herodotus is designed to perform device takeover while making first attempts to mimic...

The CISO imperative: Building resilience in an era of accelerated cyberthreats

The latest Microsoft Digital Defense Report 2025 paints a vivid picture of a cyberthreat landscape in flux. The surge in financially motivated cyberattacks and the persistent risk of nation-state actors demand urgent attention. But for those of us in the Office of the Chief Information Security...

Reducing abuse of Microsoft 365 Exchange Online’s Direct Send

Overview Microsoft 365 Exchange Online's Direct Send is designed to solve an enterprise-scale operational challenge: certain devices and legacy applications such as multifunction printers, scanners, building systems, and older line‑of‑business apps, need to send email into the tenant but lack the...

When the Call Comes from Inside: The Rising Threat of Insider Recruitment in Ransomware Campaigns

In cybersecurity, we often say that attackers only need to be right once – and defenders need to be right every time. Traditionally, we’ve focused on perimeter breaches, phishing campaigns, and zero-day exploits. But increasingly, attackers are bypassing these hardened defenses and taking a...

Infrastructure Patterns in Toll Scam Domains: A Comprehensive Analysis of Cybercriminal Registration and Hosting Strategies

Toll scams involve criminals registering fake domains that pretend to be legitimate transportation agencies to trick users into making fraudulent payments. Although these scams are rapidly increasing and causing significant harm, they have not been extensively studied. We present the first...

Signal in the noise: what hashtags reveal about hacktivism in 2025

What do hacktivist campaigns look like in 2025? To answer this question, we analyzed more than 11,000 posts produced by over 120 hacktivist groups circulating across both the surface web and the dark web, with a particular focus on groups targeting MENA countries. The primary goal of our research...

Researchers Expose TA585's MonsterV2 Malware Capabilities and Attack Chain

Cybersecurity researchers have shed light on a previously undocumented threat actor called TA585 that has been observed delivering an off-the-shelf malware called MonsterV2 via phishing campaigns. The Proofpoint Threat Research Team described the threat activity cluster as sophisticated, leveragi...

From HealthKick to GOVERSHELL: The Evolution of UTA0388's Espionage Malware

A China-aligned threat actor codenamed UTA0388 has been attributed to a series of spear-phishing campaigns targeting North America, Asia, and Europe that are designed to deliver a Go-based implant known as GOVERSHELL. "The initially observed campaigns were tailored to the targets, and the message...

From Phishing to Malware: AI Becomes Russia's New Cyber Weapon in War on Ukraine

Russian hackers' adoption of artificial intelligence AI in cyber attacks against Ukraine has reached a new level in the first half of 2025 H1 2025, the country's State Service for Special Communications and Information Protection SSSCIP said. "Hackers now employ it not only to generate phishing...