Malicious code in github.com/boltdb-go/bolt (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 9323424d3dfc7569b307842f79fb0c4bd960808214ec219f536fd5bb747422b2 This malicious Go package is a typosquat of the legitimate BoltDB package. It contains a backdoor that enables remote code execution...

New 'Rules File Backdoor' Attack Lets Hackers Inject Malicious Code via AI Code Editors

Cybersecurity researchers have disclosed details of a new supply chain attack vector dubbed Rules File Backdoor that affects artificial intelligence AI-powered code editors like GitHub Copilot and Cursor, causing them to inject malicious code. "This technique enables hackers to silently compromis...

Chinese Cyber Espionage Group UNC3886 Backdoored Juniper Routers

UNC3886 hackers target Juniper routers with custom backdoor malware, exploiting outdated systems for stealthy access and espionage. Learn how to stay protected...

Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits

The China-nexus cyber espionage group tracked as UNC3886 has been observed targeting end-of-life MX Series routers from Juniper Networks as part of a campaign designed to deploy custom backdoors, highlighting their ability to focus on internal networking infrastructure. "The backdoors had varying...

Malicious code in googlepeay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49a49d099f1afc949e3c7a4c1985568353a3cbdddacf2f212072589d1582f851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Lazarus Group Hid Backdoor in Fake npm Packages in Latest Attack

Lazarus Group targets developers with malicious npm packages, stealing credentials, crypto, and installing backdoor. Stay alert to protect your projects...

Malicious code in image-watermarks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 696779031d179d99d69d2fd89de3ae89e25e8bc093c528000aeb73c0bf7525f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-10828 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows Win32 Kernel Subsystem versions prior to the fixed version Description: A use-after-free vulnerability in the Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. The vulnerability has been...

Thousands of WordPress Websites Infected with Malware

The malware includes four separate backdoors: Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed. A unique case we haven't seen before. Which introduces another type of attack made possibly by abusing websites that don't monitor...

Cybercriminals Allegedly Used a StubHub Backdoor to Steal Taylor Swift Tickets

Plus: The world’s “largest illicit online marketplace” gets hit by regulators, police seize the Garantex crypto exchange, and scammers trick targets by making up ransomware attacks...

Chinese APT Lotus Panda Targets Governments With New Sagerunex Backdoor Variants

The threat actor known as Lotus Panda has been observed targeting government, manufacturing, telecommunications, and media sectors in the Philippines, Vietnam, Hong Kong, and Taiwan with updated versions of a known backdoor called Sagerunex. "Lotus Blossom has been using the Sagerunex backdoor...

Suspected Iranian Hackers Used Compromised Indian Firm's Email to Target U.A.E. Aviation Sector

Threat hunters are calling attention to a new highly-targeted phishing campaign that singled out "fewer than five" entities in the United Arab Emirates U.A.E. to deliver a previously undocumented Golang backdoor dubbed Sosano. The malicious activity was specifically directed against aviation and...

Malicious code in toloka-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c7326d0e79737f24ac6ba12b7f58459b7aa76c833af0bffc5791d2ef4f1a1ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Backdoor Auto-color Linux Targets Systems in US and Asia

Auto-color: New Linux backdoor malware targeting the US and Asia. Learn about its advanced evasion, persistence, and detection…...

Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools

Cisco Talos discovered multiple cyber espionage campaigns that target government, manufacturing, telecommunications and media, delivering Sagerunex and other hacking tools for post-compromise activities. Talos attributes these attacks to the threat actor known as Lotus Blossom. Lotus Blossom has...

PolarEdge Botnet Exploits Cisco and Other Flaws to Hijack ASUS, QNAP, and Synology Devices

A new malware campaign has been observed targeting edge devices from Cisco, ASUS, QNAP, and Synology to rope them into a botnet named PolarEdge since at least the end of 2023. French cybersecurity company Sekoia said it observed the unknown threat actors deploying a backdoor by leveraging...

UK Demanded Apple Add a Backdoor to iCloud

Last month, the UK government demanded that Apple weaken the security of iCloud for users worldwide. On Friday, Apple took steps to comply for users in the United Kingdom. But the British law is written in a way that requires Apple to give its government access to anyone, anywhere in the world. I...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...

CVE-2024-56525

In Public Knowledge Project PKP OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin...