WordPress plugin Wallet System for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

WalletProbe: a Testing Framework for Browser-Based Cryptocurrency Wallet Extensions

Serving as the first touch point for users to the cryptocurrency world, cryptocurrency wallets allow users to manage, receive, and transmit digital assets on blockchain networks and interact with emerging decentralized finance DeFi applications. Unfortunately, cryptocurrency wallets have always...

Pre-Installed Malware on Cheap Android Phones Steals Crypto via Fake WhatsApp

Cheap Android phones with preinstalled malware use fake apps like WhatsApp to hijack crypto transactions and steal wallet recovery phrases...

npm Malware Targets Atomic and Exodus Wallets to Hijack Crypto Transfers

ReversingLabs reveals a malicious npm package targeting Atomic and Exodus wallets, silently hijacking crypto transfers via software patching...

Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses

Threat actors are continuing to upload malicious packages to the npm registry so as to tamper with already-installed local versions of legitimate libraries and execute malicious code in what's seen as a sneakier attempt to stage a software supply chain attack. The newly discovered package, named...

WordPress Wallet System for WooCommerce plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Wallet System for WooCommerce versions = 2.6.8...

MAL-2025-3086 Malicious code in r5-zknet-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 070dfd4d90ed4eb9d2cd623b84d76f1b2cf1fcfd6bb9704350773e5344446c94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Android Trojan Crocodilus Abuses Accessibility to Steal Banking and Crypto Credentials

Cybersecurity researchers have discovered a new Android banking malware called Crocodilus that's primarily designed to target users in Spain and Turkey. "Crocodilus enters the scene not as a simple clone, but as a fully-fledged threat from the outset, equipped with modern techniques such as remot...

Malicious code in ecko-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a46943965c7587fa7324d2b2470423dd46497cf100d65a55135a1a3c01ef79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ecko-wallet-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0abf27a0a21da3cbad3585aecbe105d054575fe79c1b9c788c93ff4b6478bcab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ecko-wallet

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ecko-wallet-react

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2756 Malicious code in ecko-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a46943965c7587fa7324d2b2470423dd46497cf100d65a55135a1a3c01ef79c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2757 Malicious code in ecko-wallet-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0abf27a0a21da3cbad3585aecbe105d054575fe79c1b9c788c93ff4b6478bcab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Treasury Lifts Tornado Cash Sanctions Amid North Korea Money Laundering Probe

The U.S. Treasury Department has announced that it's removing sanctions against Tornado Cash, a cryptocurrency mixer service that has been accused of aiding the North Korea-linked Lazarus Group to launder their ill-gotten proceeds. "Based on the Administration's review of the novel legal and poli...

Malicious code in nl-wallet-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bf94087c465bb67e65d34148f6aad2a5592fa4653e4705ca81533f5ac3f6091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2268 Malicious code in nl-wallet-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bf94087c465bb67e65d34148f6aad2a5592fa4653e4705ca81533f5ac3f6091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...

CVE-2025-27839

operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation genuineness check that causes verification results to be disregarded during the first scan of a card. Exploitation may not have been possible...