LofyLife: malicious npm packages steal Discord tokens and bank card data

On July 26, using the internal automated system for monitoring open-source repositories, we identified four suspicious packages in the Node Package Manager npm repository. All these packages contained highly obfuscated malicious Python and JavaScript code. We dubbed this malicious campaign...

Ukrainian Authorities Arrested Phishing Gang That Stole 100 Million UAH

The Cyber Police of Ukraine last week disclosed that it apprehended nine members of a criminal gang that embezzled 100 million hryvnias via hundreds of phishing sites that claimed to offer financial assistance to Ukrainian citizens as part of a campaign aimed at capitalizing on the ongoing...

Revamped Nukebot Malware Changes Targets, Adds Functions

A revamped version of the Nukebot banking trojan dubbed Jimmy Nukebot has shifted focus from stealing bankcard data and now acts as a conduit for quietly downloading malicious payloads for web-injects, cryptocurrency mining, and taking screenshots of targeted systems. The code is a modification o...

California Man Gets 6 Years for Laundering

A Long Beach, California man who helped funnel stolen cash to a global network of hackers and carders was sentenced Thursday to 6 years in prison for conspiracy to launder money. Cesar Carranza, 38, sold MSR-206’s to carders to encode stolen bank card data onto blank cards, and he served as a...