108 matches found
cookie-monster
Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...
SCRAPPER
🕷️ سكربّر من BertUI مراقب الجلسة لأتمتة الويب سكربّر ليس أداة كشط — إنه مراقب جلسة يلتقط بيانات متصفحك الحقيقية لاستخدامها في أي أداة أتمتة. مبني على إطار عمل BertUI React GitHub: BunElysiaReact/SCRAPY لا نطاق. لا سحابة. كل شيء محلي. كل شيء لك. 📋 جدول المحتويات المشكلة التي يحلها سكربّر ما هو...
MAL-2026-12057 Malicious code in @zzzgenesis00/playwrite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28a7a4b265a274814769439b7bcc3e03e573308ac72036558815feabfec0c8af The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch returns empty stub methods, while postinstall.js also loaded...
Malicious code in voipms-service (PyPI)
Source: kam193 6482a67f89f2d1c1c86faa07e57079b58fc63b84013774eeced6ed752da99ba3 The package pretends to do something meaningful, but in fact, just exfiltrates users' cookies from the browser --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
Malicious code in codefrequencychecker (PyPI)
Source: kam193 4202ead7b36e01a039c10a9379f617de02b50d5a69d5923652cfafb6f22067b6 Package exfiltrates browser cookies and passwords, and starts a Telegram bot allowing re-exfiltrating later. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-10732 Malicious code in hehehe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...
Malicious code in monogrok (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...
MAL-2026-10638 Malicious code in monogrok (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b1e012dd879b5435693fcaba708830625930df758bb32ac15058898e9244a3 Package advertises itself as a bulk-mailing / mail-server abuse toolkit homepage mntmc.rip and ships modules for bulk mail delivery func/snd/mlr/, SM...
Malicious code in log-taker1 (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...
Malicious code in console-fmt-cli (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. console-fmt-cli uses a side-loader technique: it declares decimal-format-core =3.0 as a dependency, which contains a dropper that executes at install time via a postinstall hook. The dropper fetches a...
MAL-2026-6575 Malicious code in @ibrahim1337/baksen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...
Malicious code in @ibrahim1337/baksen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea195bd44e54cd1051fc279a0e871b02c15eea04f65c80979d756fa767f541b4 Package @ibrahim1337/baksen ships a Windows x64 infostealer toolkit that targets Chromium-family browsers Chrome, Brave, Edge, Opera, Opera GX on the...
Malicious code in weavedb-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25ff456baf684075b65ecf808bbfe36cbf91811fb4b04b70c13a3dd9d8a9403 package.json declares "preinstall": "./tools/setup", where tools/setup is a 976KB stripped Linux x86-64 ELF binary sha256...
CVE-2026-34403: Missing Origin Validation in WebSockets
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.5, all WebSocket endpoints in nginx-ui use a gorilla/websocket Upgrader with CheckOrigin unconditionally returning true, allowing Cross-Site WebSocket Hijacking CSWSH. Combined with the fact that authentication tokens...
MAL-2026-126 Malicious code in codefrequencychecker (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4202ead7b36e01a039c10a9379f617de02b50d5a69d5923652cfafb6f22067b6 Package exfiltrates browser cookies and passwords, and starts a Telegram bot allowing re-exfiltrating later. --- Category: MALICIOUS - The campaign has clearly...
Malicious code in codefrequencychecker (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4202ead7b36e01a039c10a9379f617de02b50d5a69d5923652cfafb6f22067b6 Package exfiltrates browser cookies and passwords, and starts a Telegram bot allowing re-exfiltrating later. --- Category: MALICIOUS - The campaign has clearly...
Phantom Stealer Spread by ISO Phishing Emails Hitting Russian Finance Sector
Cybersecurity researchers have disclosed details of an active phishing campaign that's targeting a wide range of sectors in Russia with phishing emails that deliver Phantom Stealer via malicious ISO optical disc images. The activity, codenamed Operation MoneyMount-ISO by Seqrite Labs, has primari...
ToddyCat: your hidden email assistant. Part 1
Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...
