MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control C2 technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two...

Malicious code in @rentwise/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...

Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding

We have detected several campaigns using fake downloads of games, mods, cracks, and software to spread RenPy Loader. Once installed, the loader starts a complex, multi-stage infection chain that abuses MSBuild and the EtherHiding technique before ultimately delivering Amatera Stealer. Amatera is ...

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

TrendAI™ Research analyzed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The attack chain ended with two simultaneously deployed stealers, SectopRAT and ACRStealer alongside an on-chain...

Open VSX Supply Chain Attack Used Compromised Dev Account to Spread GlassWorm

Cybersecurity researchers have disclosed details of a supply chain attack targeting the Open VSX Registry in which unidentified threat actors compromised a legitimate developer's resources to push malicious updates to downstream users. "On January 30, 2026, four established Open VSX extensions...

North Korean Hackers Combine BeaverTail and OtterCookie into Advanced JS Malware

The North Korean threat actor linked to the Contagious Interview campaign has been observed merging some of the functionality of two of its malware programs, indicating that the hacking group is actively refining its toolset. That's according to new findings from Cisco Talos, which said recent...

North Korean Hackers Use EtherHiding to Hide Malware Inside Blockchain Smart Contracts

A threat actor with ties to the Democratic People's Republic of Korea aka North Korea has been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been...

ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers

The threat actors behind the ClearFake campaign are using fake reCAPTCHA or Cloudflare Turnstile verifications as lures to trick users into downloading malware such as Lumma Stealer and Vidar Stealer. ClearFake, first highlighted in July 2023, is the name given to a threat activity cluster that...

Binance's Smart Chain Exploited in New 'EtherHiding' Malware Campaign

Threat actors have been observed serving malicious code by utilizing Binance's Smart Chain BSC contracts in what has been described as the "next level of bulletproof hosting." The campaign, detected two months ago, has been codenamed EtherHiding by Guardio Labs. The novel twist marks the latest...