UAC-0050 Targets European Financial Institution With Spoofed Domain and RMS Malware

A Russia-aligned threat actor has been observed targeting a European financial institution as part of a social engineering attack to likely facilitate intelligence gathering or financial theft, signaling a possible expansion of the threat actor's targeting beyond Ukraine and into entities...

MAL-2026-1012 Malicious code in ultimates-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199dbb458ff55c6d08022e6326014d56aceb99ef7748d6e898a6faac9bff201b The package ultimates-express was found to contain malicious code. Source: ghsa-malware...

Malicious code in ultimates-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199dbb458ff55c6d08022e6326014d56aceb99ef7748d6e898a6faac9bff201b The package ultimates-express was found to contain malicious code. Source: ghsa-malware...

New ZeroDayRAT Malware Claims Full Monitoring of Android and iOS Devices

Meet ZeroDayRAT, a newly advertised malware targeting Android and iOS devices with surveillance, location tracking, and crypto theft tools sold via Telegram as a MaaS service...

Wormable XMRig Campaign Uses BYOVD Exploit and Time-Based Logic Bomb

Cybersecurity researchers have disclosed details of a new cryptojacking campaign that uses pirated software bundles as lures to deploy a bespoke XMRig miner program on compromised hosts. "Analysis of the recovered dropper, persistence triggers, and mining payload reveals a sophisticated,...

Malicious code in npm-security-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf7ca4cfc33128c3d392d0df3b413365624b0e28a8215a7f0226ca4ec459730 The package npm-security-testing was found to contain malicious code. Source: ghsa-malware...

Malicious code in rbxm-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cc90689ea111d792b6dc071f39e060c440f492130ef599233cf0c4526f55e4 The package rbxm-tools was found to contain malicious code. Source: ghsa-malware 8b70ded43c5def740a34e33c94903aa957ced0450fffd844a1e0f0d4122aea94 Any...

Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer

Malicious OpenClaw skills trick AI agents and users into installing a new AMOS variant that steals extensive data at scale...

An Explainable Memory Forensics Approach for Malware Analysis

Memory forensics is an effective methodology for analyzing living-off-the-land malware, including threats that employ evasion, obfuscation, anti-analysis, and steganographic techniques. By capturing volatile system state, memory analysis enables the recovery of transient artifacts such as decrypt...

Routing-Aware Explanations for Mixture of Experts Graph Models in Malware Detection

Mixture-of-Experts MoE offers flexible graph reasoning by combining multiple views of a graph through a learned router. We investigate routing-aware explanations for MoE graph models in malware detection using control flow graphs CFGs. Our architecture builds diversity at two levels. At the node...

MAL-2026-955 Malicious code in crypto-locale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e346cfc58b0d84fb5b56985729f7ec92a226ef106b0ab10f299e65a62028834d The package crypto-locale was found to contain malicious code. Source: ghsa-malware 00686734db6a3f5477c1047f779749296dddb0c7eab5294000e13ed7b194c74d...

Malicious code in uudi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb12754a69bd912f7d51fb243c65d7c681cc0e15a17b561e0a491dd49dbb095 The package uudi was found to contain malicious code. Source: ghsa-malware f7b138cbc39567b6578a6cd48c9b8c7384a2bf7623d0d4542c9e37a1960b329b Any...

Malicious code in crypto-locale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e346cfc58b0d84fb5b56985729f7ec92a226ef106b0ab10f299e65a62028834d The package crypto-locale was found to contain malicious code. Source: ghsa-malware 00686734db6a3f5477c1047f779749296dddb0c7eab5294000e13ed7b194c74d...

MAL-2026-958 Malicious code in ethres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba3cafe0e65ebbd1b4bdd577f7277b921eb7e3cf52e5fb46d8e6f6f34b2debd5 The package ethres was found to contain malicious code. Source: ghsa-malware 10924cf4fae0e118a99b95cf45376a7f42ff743f1e8830e78e801c473e0ddd88 Any...

MAL-2026-968 Malicious code in rimarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2b9a60774917db6a41edfa73a6fd3857866642eb502367b1d1551d9a1bc0f3 The package rimarf was found to contain malicious code. Source: ghsa-malware a34f8c6537be93ad97761160da11ce153ecb0e128aa76add4d2c46671c4de0c1 Any...

MAL-2026-956 Malicious code in crypto-reader-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28e31fe14a706d54aaad373a2174a83c58af8a065a0e8e5c98c201e3b986430d The package crypto-reader-info was found to contain malicious code. Source: ghsa-malware...

MAL-2026-961 Malicious code in iru-caches (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bedff4313b653182b12500ff93779e0605bbd045470b58245a0ab47629e3404f The package iru-caches was found to contain malicious code. Source: ghsa-malware 2f24ac88d53abde060c0a707ee445377609019c4e9f93e40218672b204cb50ff Any...

MAL-2026-954 Malicious code in cloude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec24ba80068a14617a513915da6a3751b60345b9c1e9144a362c4b85abefdc6 The package cloude-code was found to contain malicious code. Source: ghsa-malware 8da7714f501eed0c20e3432333dc73d1707e7ef16a803df07b6d73fab1945be7 An...

Malicious code in cloude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b744a4fe3734f90aaf8d25e66146a0673fa2e1a806c8d6a573d9a7013ca04b6 The package cloude was found to contain malicious code. Source: ghsa-malware b64dc9c2967ed5f2f54160b6bd780fb24ad29af8c22355f706b026ea25c3b3e1 Any...

Malicious code in claud-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 858992810c1a4133d95b6fa19033c07591db548a46df39b67e0d393d7dd212ad The package claud-code was found to contain malicious code. Source: ghsa-malware 5fe9842d778d45ad5b5e4d81db678d608711dd4b186e053569dae6f210481651 Any...