Malicious code in whatsapp-sdk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 788206c160622c7c87f5e0b19b4be9383f89a8918fa3aace86ec99350a06daa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2440 Malicious code in whatsapp-sdk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 788206c160622c7c87f5e0b19b4be9383f89a8918fa3aace86ec99350a06daa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hackers Tricking Users Into Linking Devices to Steal Signal Messages

Is your Signal, WhatsApp, or Telegram account safe? Google warns of increasing attacks by Russian state-backed groups. Learn…...

A week in security (February 3 – February 9)

Last week on Malwarebytes Labs: WhatsApp says Paragon is spying on specific users New AI "agents" could hold people for ransom in 2025 Valley News Live exposed more than a million job seeker’s resumes Small business owners, secure your web shop University site cloned to evade ad detection...

CVE-2025-25138

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through = 2.0.0...

CVE-2025-25138

CVE-2025-25138 is a CSRF to Stored XSS vulnerability in the WordPress On Page SEO + Social Live Chat (formerly OPS) plugin that affects versions up to 2.0.0. CVSS 3.1 base score 7.1 (HIGH) with network attack vector, requiring user interaction. Exploit status is not publicly detailed in the docum...

CVE-2025-25138 WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + Whatsapp Chat Button: from n/a through = 2.0.0...

WordPress plugin On Page SEO + Whatsapp Chat Button 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

Malicious code in whatsapp-reader (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-883 Malicious code in whatsapp-reader (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress On Page SEO + Social Live Chat (Formerly OPS) plugin <= 2.0.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin On Page SEO + Whatsapp Chat Button versions = 2.0.0...

WhatsApp says Paragon is spying on specific users

WhatsApp has accused the professional spyware company Paragon of spying on a select group of users. WhatsApp, the Meta-owned, end-to-end encrypted messaging platform, said it has reliable information that nearly 100 journalists and other “members of civil society” were targets of a spyware campai...

Journalists and Civil Society Members Using WhatsApp Targeted by Paragon Spyware

This is yet another story of commercial spyware being used against journalists and civil society members. The journalists and other civil society members were being alerted of a possible breach of their devices, with WhatsApp telling the Guardian it had "high confidence" that the 90 users in...

Malicious code in whatsapp-otp-sample-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b68f95ddfc2a8e35a703d6ec0be419b3e447d050bf3672fd492058ea9284651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1197 Malicious code in whatsapp-otp-sample-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b68f95ddfc2a8e35a703d6ec0be419b3e447d050bf3672fd492058ea9284651 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Israeli Spyware Firm Paragon Linked to WhatsApp Zero-Click Attack

WhatsApp recently revealed a targeted spyware campaign linked to the Israeli firm Paragon, which affected 90 individuals, including…...

Foreign Hackers Are Using Google’s Gemini in Attacks on the US

Plus: WhatsApp discloses nearly 100 targets of spyware, hackers used the AT&T breach to hunt for details on US politicians, and more...

Meta Confirms Zero-Click WhatsApp Spyware Attack Targeting 90 Journalists, Activists

Meta-owned WhatsApp on Friday said it disrupted a campaign that involved the use of spyware to target journalists and civil society members. The campaign, which targeted around 90 members, involved the use of spyware from an Israeli company known as Paragon Solutions. The attackers were neutraliz...

No need to RSVP: a closer look at the Tria stealer campaign

Introduction Since mid-2024, we've observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app APK, which we have named "Tria Stealer" after unique strings found in campaign samples. The primary targets of the...

WhatsApp spear phishing campaign uses QR codes to add device

A cybercriminal campaign linked to Russia is deploying QR codes to access the WhatsApp accounts of high-profile targets like journalists, members of think tanks, and employees of non-governmental organizations NGOs, according to new details revealed by Microsoft. The group, which Microsoft tracks...