Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...

EUVD-2026-51308

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...

CVE-2026-68503 LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...

CVE-2026-68503 LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...

SUSE CVE-2026-34227

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to version 1.7.4, a single click on a malicious link gives an unauthenticated attacker immediate, silent control over every active C2 session or beacon, capable of exfiltrating all collected target data e.g. SS...

PT-2026-66609

Name of the Vulnerable Software and Affected Versions LazyOwn RedTeam/APT Framework versions prior to 0.2.154 Description LazyOwn ships with default C2 credentials in payload.json and core/payload schema.py, which are passed unchanged to lazyc2.py for HTTP Basic authentication. This allows a...

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

PT-2026-65916

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

MAL-2026-11132 Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

Dysphoria IoT Botnet Adds Blockchain C2 and Victim Relays After JackSkid Disruption

Dysphoria , an Internet of Things IoT botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT,...

Malicious Package

Overview mrmustard is a malicious package. This package contains malicious code, and its content was quarantined by the official package manager. Version 0.7.4 was published to PyPI using stolen maintainer credentials and contained an injected credential stealer. The malicious code ran upon impor...

fawkes — Updated!

Fawkes Mythic C2 Agent Fawkes is an entirely vibe-coded Mythic C2 agent. It started as an "I wonder" and has turned into a goal. My goal is to not write a single line of code for this agent, instead, exclusively producing it at a prompt. I originally attempted to write the agent myself, but after...

A Method of Risk Analysis and Threat Management Using Analytic Hierarchy Process

Efficient risk analysis and threat management are essential requirements of modern air defense AD systems. The paper is halfway between the analytic hierarchy process AHP and practical reasoning to model and analyze the risks and threats associated with military AD applications. The models are...

New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

Introduction In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and i...

TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things IoT botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model LLM, albeit with not so successful results. "While the AI complied with...

Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

Malicious code in tennacity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7933cd1ec11531feba788870555eeac615535d8e230b4d252880def9c68ff5e tennacity is a one-character typosquat of the popular 'tenacity' library; its README/PKG-INFO are copied verbatim from real tenacity while setup.py...