Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Noisy Bear Campaign Targeting Kazakhstan Energy Sector Outed as a Planned Phishing Test

A threat actor possibly of Russian origin has been attributed to a new set of attacks targeting the energy sector in Kazakhstan. The activity, codenamed Operation BarrelFire, is tied to a new threat group tracked by Seqrite Labs as Noisy Bear. The threat actor has been active since at least April...

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute...

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Cybersecurity researchers have discovered two new malicious packages on the npm registry that make use of smart contracts for the Ethereum blockchain to carry out malicious actions on compromised systems, signaling the trend of threat actors constantly on the lookout for new ways to distribute...

CVE-2010-10017

WM Downloader 3.1.2.2 is affected by a buffer overflow when parsing a crafted .m3u playlist. The vulnerability stems from insufficient input length validation, allowing an attacker to overwrite SEH records and execute arbitrary code. Exploitation is local: the payload runs with the privileges of ...

CVE-2010-10017

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler SEH records and execute arbitrary code. Exploitation...

Slient-URL-Exploit

URL Exploit Hidden Downloader URL contamination and muted Jav...

DC Mobile Studio WM Downloader 安全漏洞

DC Mobile Studio WM Downloader is a movie and image downloader from DC Mobile Studio, Inc. A security vulnerability exists in DC Mobile Studio WM Downloader version 3.1.2.2, which originates from insufficient input validation when processing .m3u files and could lead to a buffer overflow and...

CVE-2010-10017: Buffer Copy without Checking Size of Input

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file. The application fails to properly validate input length, allowing an attacker to overwrite structured exception handler SEH records and execute arbitrary code. Exploitation...

Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named...

Researchers Find VS Code Flaw Allowing Attackers to Republish Deleted Extensions Under Same Names

Cybersecurity researchers have discovered a loophole in the Visual Studio Code Marketplace that allows threat actors to reuse names of previously removed extensions. Software supply chain security outfit ReversingLabs said it made the discovery after it identified a malicious extension named...

UNC6384 Deploys PlugX via Captive Portal Hijacks and Valid Certificates Targeting Diplomats

A China-nexus threat actor known as UNC6384 has been attributed to a set of attacks targeting diplomats in Southeast Asia and other entities across the globe to advance Beijing's strategic interests. "This multi-stage attack chain leverages advanced social engineering including valid code signing...

Apache ActiveMQ Flaw Exploited to Deploy DripDropper Malware on Cloud Linux Systems

Threat actors are exploiting a nearly two-year-old security flaw in Apache ActiveMQ to gain persistent access to cloud Linux systems and deploy malware called DripDropper. But in an unusual twist, the unknown attackers have been observed patching the exploited vulnerability after securing initial...

Malicious code in creepy-downloader (npm)

The package creepy-downloader was found to contain malicious code...

MAL-2025-17671 Malicious code in creepy-downloader (npm)

The package creepy-downloader was found to contain malicious code...

Malicious code in treehouse-downloader (npm)

The package treehouse-downloader was found to contain malicious code...

MAL-2025-15129 Malicious code in ava-ilable-down-load-mp3-today-15541-troubled-shaken-etc-0oakd-xtjnkz (npm)

The package ava-ilable-down-load-mp3-today-15541-troubled-shaken-etc-0oakd-xtjnkz was found to contain malicious code...

MAL-2025-37181 Malicious code in treehouse-downloader (npm)

The package treehouse-downloader was found to contain malicious code...

New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In-Memory Attacks

Cybersecurity researchers have discovered a new malvertising campaign that's designed to infect victims with a multi-stage malware framework called PS1Bot. "PS1Bot features a modular design, with several modules delivered used to perform a variety of malicious activities on infected systems,...

New PS1Bot Malware Campaign Uses Malvertising to Deploy Multi-Stage In-Memory Attacks

Cybersecurity researchers have discovered a new malvertising campaign that's designed to infect victims with a multi-stage malware framework called PS1Bot. "PS1Bot features a modular design, with several modules delivered used to perform a variety of malicious activities on infected systems,...