Malicious code in iproduce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9793afabdea98cc294df5335305541ec8d48c6f0fe655e511f82c46d2bd5685 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tkn-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3230b2e14e4f5e50ae022fdb7a081a52260e3c68f1a4b50add1dcca4afdc1a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jupyter Infostealer Returns with New Addition to Its Arsenal

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Jupyter Infostealer is a malware variant initially discovered in late 2020. Since then, it has undergone continued evolution, altering its delivery methods and techniques to avoid detection and establish...

New GootLoader Malware Variant Evades Detection and Spreads Rapidly

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using...

Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discordstreams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ecd29a8cad2b5a03c4966ae6e4e1f9879d9a26bcf5b48b620074ac2e65d197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in djsmusiccc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97843d99a4edd4ddf8c30e9c20d9779108bf139af236b556a657e48805a1b567 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Redefining the StripedFly Malware Framework

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An intricate cross-platform malware framework, known as StripedFly, operated discreetly for five years, surreptitiously compromising over a million Windows and Linux systems. It skillfully evaded in-dept...

Malicious code in pragmaticplay-situs-slot-online-banyak-hoki-paling-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0bb9559484405e38427ba29fe4572ce1df42fa5a9932f8f785d2ed5295f3240 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f4a779c84bc2b1936964dfbf4fc200f36f4dc6fb95b0a426c8a0e48459f2f30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agopoweryea123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca5c5e5ef3f588541558976ee86112900b01f69ca9fe775b740d12315b8ddd01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Operation Rusty Flag: Azerbaijan Targeted in New Rust-Based Malware Campaign

Targets located in Azerbaijan have been singled out as part of a new campaign that's designed to deploy Rust-based malware on compromised systems. Cybersecurity firm Deep Instinct is tracking the operation under the name Operation Rusty Flag. It has not been associated with any known threat actor...

Malicious code in fca-bucu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2908145aa0c6daa50e572b3120bf06a85fcc270fc0cdf0733af4bf1e624bf0da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-nvt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96380ff5d08b4a65d9a20156bb99f8945ff4b34487354b250d78b583013b8d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rodashe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f179c54800c846ae564beed30b98bb86607fdfcd37763da621c699d6736f13cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in purplebricks-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8044c661c6223ef46436635423b8c74bbebf2796ae2252435a5592288dceca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in antdesignpro2021 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2743e3748612ab32fe4aaa84ec3ee0b4a6f6063b07bdf9afa1bad50ade1d6ff2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cybercriminals Using PowerShell to Steal NTLMv2 Hashes from Compromised Windows

A new cyber attack campaign is leveraging the PowerShell script associated with a legitimate red teaming tool to plunder NTLMv2 hashes from compromised Windows systems primarily located in Australia, Poland, and Belgium. The activity has been codenamed Steal-It by Zscaler ThreatLabz. "In this...

Malicious code in @huoshanjiebai/ethereumjs-utill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7a36fccca657e26ff9ded801631d537ad159e26045c0be4de99b31d351e20d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Nation-State Actors Infiltrate U.S. by Exploiting Zoho and Fortinet Flaws

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary Multiple nation-state entities infiltrated a prominent U.S. aeronautics organization by capitalizing on vulnerabilities within Fortinet FortiOS SSL-VPN and Zoho ManageEngine ServiceDesk Plus,...