MAL-2025-6487 Malicious code in crto0 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bdcf6d997fa4676ca2da647171f21e944f9b7d0f34010e6ea8da42364a2d03d Importing the module starts downloading or decrypting, and then executing an executable being a wide recognized malware/Infostealer Redline family --- Category...

ADAPT: a Pseudo-Labeling Approach to Combat Concept Drift in Malware Detection

Whitepaper called ADAPT: A Pseudo-Labeling Approach To Combat Concept Drift In Malware Detection...

VOLTRON: Detecting Unknown Malware Using Graph-Based Zero-Shot Learning

The persistent threat of Android malware presents a serious challenge to the security of millions of users globally. While many machine learning-based methods have been developed to detect these threats, their reliance on large labeled datasets limits their effectiveness against emerging,...

MAL-2025-5654 Malicious code in malicus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d151385056670ff22bfb80dc356c10ff622a77e115f8d81ee5f066220e05fda1 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

MAL-2025-5480 Malicious code in webgl-fingerprinting (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 016147915e679ae2b97b3c040f72eb1171882e3785e1ae3aea0765497138c268 Any computer that has this package installed or running should be considered...

MAL-2025-5221 Malicious code in art19-web-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 833f7a38c823fdd26727d7a6aec9c75365b96860e4723badca46db54163128da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Efficient Malware Detection with Optimized Learning on High-Dimensional Features

Malware detection using machine learning requires feature extraction from binary files, as models cannot process raw binaries directly. A common approach involves using LIEF for raw feature extraction and the EMBER vectorizer to generate 2381-dimensional feature vectors. However, the high...

MAL-2025-5168 Malicious code in readium-shared-js (npm)

Malicious preinstall script exfiltrates system info hostname, user, pwd, id to a remote server. Likely a malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c907ca12944ad675a60dbfd27a1680a1b2ebf1186512d0106676795741a558a Any computer that has this package...

MAL-2025-4984 Malicious code in dojo.aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d31fd63b97c3cdde47f88984fbd8825829cf78c16098685c438206151cbc31f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Empirical Quantification of Spurious Correlations in Malware Detection

End-to-end deep learning exhibits unmatched performance for detecting malware, but such an achievement is reached by exploiting spurious correlations -- features with high relevance at inference time, but known to be useless through domain knowledge. While previous work highlighted that deep...

MAL-2025-4723 Malicious code in 0x000asdqwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ea8c61fc9f49cdc0f6a22b805c76011ff8bd9143b77d223068fdb6f7d0d342e The OpenSSF Package Analysis project identified '0x000asdqwe' @ 5.0.0 npm as malicious. It is considered malicious because: - The package...

Network Threat Detection: Addressing Class Imbalanced Data with Deep Forest

With the rapid expansion of Internet of Things IoT networks, detecting malicious traffic in real-time has become a critical cybersecurity challenge. This research addresses the detection challenges by presenting a comprehensive empirical analysis of machine learning techniques for malware detecti...

Are Trees Really Green? A Detection Approach of IoT Malware Attacks

Nowadays, the Internet of Things IoT is widely employed, and its usage is growing exponentially because it facilitates remote monitoring, predictive maintenance, and data-driven decision making, especially in the healthcare and industrial sectors. However, IoT devices remain vulnerable due to the...

MAL-2025-4717 Malicious code in pay-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6dab6c4477e3fd12beb2c023319675dd83f706e7347db70a12265b80e8e38c56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IT threat evolution in Q1 2025. Non-mobile statistics

IT threat evolution in Q1 2025. Non-mobile statistics IT threat evolution in Q1 2025. Mobile statistics The statistics in this report are based on detection verdicts returned by Kaspersky products unless otherwise stated. The information was provided by Kaspersky users who consented to sharing...

Malware Masquerades as Legitimate, Hidden WordPress Plugin with Remote Code Execution Capabilities

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. The Wordfence Threat Intelligence team recently discovered an interestin...

New Windows RAT Evades Detection for Weeks Using Corrupted DOS and PE Headers

Cybersecurity researchers have taken the wraps off an unusual cyber attack that leveraged malware with corrupted DOS and PE headers, according to new findings from Fortinet. The DOS Disk Operating System and PE Portable Executable headers are essential parts of a Windows PE file, providing...

Domainator: Detecting and Identifying DNS-Tunneling Malware Using Metadata Sequences

In recent years, malware with tunneling or: covert channel capabilities is on the rise. While malware research led to several methods and innovations, the detection and differentiation of malware solely based on its DNS tunneling features is still in its infancy. Moreover, no work so far has used...

MADCAT: Combating Malware Detection under Concept Drift with Test-Time Adaptation

We present MADCAT, a self-supervised approach designed to address the concept drift problem in malware detection. MADCAT employs an encoder-decoder architecture and works by test-time training of the encoder on a small, balanced subset of the test-time data using a self-supervised objective. Duri...

MAL-2025-4298 Malicious code in agic-code-standards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc112253b7449973439fb3e54e02932c89644b30a3bc100193f687da852e7320 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...