Malicious code in azure-arm-powerbidedicated-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e949858ae810e1567a6a2d7b0da9d70a05c271905a357bde28cacd667e0596f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sample-helpers-device-twin-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1719b03426e3d34f13f74584d955bcc1d86ee68fbaf91dcd1175f2cde07c5eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mean_time_recovery (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9868d86d65bf9cee47652418fdb993413f0844bd54ed2b66ca87aa949e3c04bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in protocol-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ac7cf1b107d0a039df68b6a90b2dde45d4bad6b65d71ffdd45ab063a1b6c40d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in colors-art (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5587ffbdeed60934be88ad8eb58300897b814bff6155ed177c26c73892ad3128 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in techdocs-cli-embedded-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6523ca476cc6b141bf6eb3cc01162248af09aeb7f527940ba0927c5961fbf35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @exxonmobil/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07cbce5057646ec034af51e508b9f7df4b0956de2210c13e7dd4b254d4b00b79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in snapcanvas-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca63100b204e0ac6e533a20260a056f1616b745eeddc35ba6894b4cf462c548f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pages-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfe3d4394aecb07bd6acf8c1e4b1bad280125dda893323a1029ce6a468600546 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in boilerplate-fig-autocomplete (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67389c3e44cfbfd442d460784b14296f67697f35c7c4ea8077f730582e56c619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in du_npm_integ (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2244883b8339efbd2bb7b97adb76d2fbf350e6b4913aa9907e6125a3ebc77aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in holvipartners (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f64b4ac4a1fbb5c742f5167e97bd54deaf588ccc6c9ff7ec77da3bbab98e6555 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in systemuser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cdb22bc0a07f98d90b08efd3dedbf7af55fcc0f3097f068e2ec41f1e09f83dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

TrickBot Malware Abusing MikroTik Routers as Proxies for Command-and-Control

Microsoft on Wednesday detailed a previously undiscovered technique put to use by the TrickBot malware that involves using compromised Internet of Things IoT devices as a go-between for establishing communications with the command-and-control C2 servers. "By using MikroTik routers as proxy server...

China Chopper still active 9 years later

By Paul Rascagneres and Vanja Svajcer. Introduction Threats will commonly fade away over time as they're discovered, reported on, and detected. But China Chopper has found a way to stay relevant, active and effective nine years after its initial discovery. China Chopper is a web shell that allows...

MuddyWater expands operations

Summary MuddyWater is a relatively new APT that surfaced in 2017. It has focused mainly on governmental targets in Iraq and Saudi Arabia, according to past telemetry. However, the group behind MuddyWater has been known to target other countries in the Middle East, Europe and the US. We recently...

Ansible: Compromised remote hosts can lead to running commands on the Ansible controller

An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server...

BigTree CMS 4.2.3 - (Authenticated) SQL Injection

BigTree CMS 4.2.3: Multiple SQL Injection Vulnerabilities Security Advisory – Curesec Research Team Online-Reference: http://blog.curesec.com/article/blog/BigTree-CMS-423-Multiple-SQL-Injection-Vulnerabilities-39.html 1. Introduction Affected Product: BigTree CMS 4.2.3 Fixed in: 4.2.4 Fixed Versi...

Wireless Network Auditing Tool: FruityWifi

FruityWifi is an open source tool to audit wireless networks. It allows the user to deploy advanced attacks by directly using the web interface or by sending messages to it. Initialy the application was created to be used with the Raspberry-Pi, but it can be installed on any Debian based system...

Sefnit Click-Fraud Malware Related to Mevade Tor Botnet

A malware family, likely developed by the same authors who built a massive botnet recently discovered on the Tor network, has been revived with a stealthy new click-fraud scam. Microsoft reports a rash of new click-fraud activity linked to the Sefnit malware, which was thought dead and buried as ...