Malicious code in wlwz-2311-4202 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edb2ef58709bbb10b0e4b8a8f60ef3590e147d4825a37b8c4ac1605fa215cec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-3808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 803fde2c3a643704d2dea0d6332c867c4e254aaef1ff8807f785435bd52bce12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

"Activator" Alert: MacOS Malware Hides in Cracked Apps, Targeting Crypto Wallets

Cracked software have been observed infecting Apple macOS users with a previously undocumented stealer malware capable of harvesting system information and cryptocurrency wallet data. Kaspersky, which identified the artifacts in the wild, said they are designed to target machines running macOS...

Malicious code in djs-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90af6bf24f0980f65d17a778346be0ea84cae8bc6179efae6e701d838674426f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lunar-sb.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387a2f7e6dc2c3022b63ec2ea875bfdbcc6ee0fd07b1ff68475859ea718566d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Experts Warn of macOS Backdoor Hidden in Pirated Versions of Popular Software

Pirated applications targeting Apple macOS users have been observed containing a backdoor capable of granting attackers remote control to infected machines. "These applications are being hosted on Chinese pirating websites in order to gain victims," Jamf Threat Labs researchers Ferdous Saljooki a...

Malicious code in oscompatible (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9569a20b29ab9fcf758c7fa43268c1d1d42034ef4b8d06ec9f234e008e27d54c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uhqsniper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bc3babfc8b7310621d81f76510b2c16c577e4714f44f2b4f205ddc360f4f876 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks

Cybersecurity researchers have identified a new attack that exploits misconfigurations in Apache Hadoop and Flink to deploy cryptocurrency miners within targeted environments. "This attack is particularly intriguing due to the attacker's use of packers and rootkits to conceal the malware," Aqua...

Malicious code in tsb-authorization (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1d452a4bd47f42cf7a842bd2d7d6f8cec14202d1741e5557d5a1ce0db511e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nylas-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5602bd87c7faf2a73e7b984206cdbcb31f0d9f270860598179af76722d291f0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cordova-plugin-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c72f98238b951534c1437dc8a7c3ee8ab8463beb50c44c59d07cccdd15829386 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

D3m0n1z3dShell - Demonized Shell Is An Advanced Tool For Persistence In Linux

Demonized Shell is an Advanced Tool for persistence in linux. Install git clone https://github.com/MatheuZSecurity/D3m0n1z3dShell.git cd D3m0n1z3dShell chmod +x demonizedshell.sh sudo ./demonizedshell.sh One-Liner Install Download D3m0n1z3dShell with all files: curl -L...

Malicious code in d5-es6-sass-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3090df994b516cfc30ee58cc5871282f61ebc4e378a73744fb779705e16a1a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Bandook RAT Variant Resurfaces, Targeting Windows Machines

A new variant of remote access trojan called Bandook has been observed being propagated via phishing attacks with an aim to infiltrate Windows machines, underscoring the continuous evolution of the malware. Fortinet FortiGuard Labs, which identified the activity in October 2023, said the malware ...

UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT

The threat actor known as UAC-0050 is leveraging phishing attacks to distribute Remcos RAT using new strategies to evade detection from security software. "The group's weapon of choice is Remcos RAT, a notorious malware for remote surveillance and control, which has been at the forefront of its...

Malicious code in @serenity-web/common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca192112e75d572b4acfa46a40cbca00653059b1452b396d996396c27648ced Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

Security researchers have detailed a new variant of a dynamic link library DLL search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages...

Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware

By Mike Gentile, Asheer Malhotra and Vitor Ventura. Editors note: This blog post is a public version of a talk presented at LabsCon 2023 on Sept. 22, 2023. You can watch a recording of the talk here. Some of the intelligence presented at LabsCon was later confirmed by an Amnesty International blo...

TRST-M-8 from previous audit still present

Lines of code Vulnerability details Proof of Concept TRST-M-8 from previous audit describes the fact, that when repaying is paused, then pool still continue accruing interests. Usually this is not considered as a medium bug anymore. However, protocol team has stated, that they have fixed...