U.K. Government Drops Apple Encryption Backdoor Order After U.S. Civil Liberties Pushback

The U.K. government has apparently abandoned its plans to force Apple to weaken encryption protections and include a backdoor that would have enabled access to the protected data of U.S. citizens. U.S. Director of National Intelligence DNI Tulsi Gabbard, in a statement posted on X, said the U.S...

GodRAT – New RAT targeting financial institutions

Summary In September 2024, we detected malicious activity targeting financial trading and brokerage firms through the distribution of malicious .scr screen saver files disguised as financial documents via Skype messenger. The threat actor deployed a newly identified Remote Access Trojan RAT named...

Fake ChatGPT Desktop App Delivering PipeMagic Backdoor, Microsoft

Microsoft warns that a fake ChatGPT desktop app was used to deliver PipeMagic malware, linked to ransomware attacks…...

Microsoft Windows Vulnerability Exploited to Deploy PipeMagic RansomExx Malware

Cybersecurity researchers have lifted the lid on the threat actors' exploitation of a now-patched security flaw in Microsoft Windows to deploy the PipeMagic malware in RansomExx ransomware attacks. The attacks involve the exploitation of CVE-2025-29824, a privilege escalation vulnerability...

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

Among the plethora of advanced attacker tools that exemplify how threat actors continuously evolve their tactics, techniques, and procedures TTPs to evade detection and maximize impact, PipeMagic, a highly modular backdoor used by Storm-2460 masquerading as a legitimate open-source ChatGPT Deskto...

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

Among the plethora of advanced attacker tools that exemplify how threat actors continuously evolve their tactics, techniques, and procedures TTPs to evade detection and maximize impact, PipeMagic, a highly modular backdoor used by Storm-2460 masquerading as a legitimate open-source ChatGPT Deskto...

Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824

In April 2025, Microsoft patched 121 vulnerabilities in its products. According to the company, only one of them was being used in real-world attacks at the time the patch was released: CVE-2025-29824. The exploit for this vulnerability was executed by the PipeMagic malware, which we first...

CVE-2025-8047

The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert...

CVE-2025-8938

A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclos...

CVE-2011-10018

myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of...

Malicious code in @michaljaz/backdoor (npm)

The package @michaljaz/backdoor was found to contain malicious code...

Malicious code in bad-idea-express-backdoor (npm)

The package bad-idea-express-backdoor was found to contain malicious code...

MAL-2025-25734 Malicious code in m-backdoor (npm)

The package m-backdoor was found to contain malicious code...

MAL-2025-9102 Malicious code in @michaljaz/backdoor (npm)

The package @michaljaz/backdoor was found to contain malicious code...

Malicious code in m-backdoor (npm)

The package m-backdoor was found to contain malicious code...

MAL-2025-15328 Malicious code in bad-idea-express-backdoor (npm)

The package bad-idea-express-backdoor was found to contain malicious code...

Malicious code in browser-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b45aebce3647704ac54d30a38e86493e0246f9ea44131394f84628656ef00ed Package uses the name as popular NPM package https://www.npmjs.com/package/browser-run, but the only thing it does is adding a hardcoded public SSH key and the...

MAL-2025-191696 Malicious code in browser-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b45aebce3647704ac54d30a38e86493e0246f9ea44131394f84628656ef00ed Package uses the name as popular NPM package https://www.npmjs.com/package/browser-run, but the only thing it does is adding a hardcoded public SSH key and the...

CVE-2025-8047

The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert...

CVE-2025-8047 Multiple Plugins from itayamar - Supply Chain Compromise

The disable-right-click-powered-by-pixterme through v1.2 and pixter-image-digital-license thtough v1.0 WordPress plugins load a JavaScript file which has been compromised from an apparent abandoned S3 bucket. It can be used as a backdoor by those who control it, but it currently displays an alert...