New Malvertising Campaign Distributing PikaBot Disguised as Popular Software

The malware loader known as PikaBot is being distributed as part of a malvertising campaign targeting users searching for legitimate software like AnyDesk. "PikaBot was previously only distributed via malspam campaigns similarly to QakBot and emerged as one of the preferred payloads for a threat...

MAL-2023-8716 Malicious code in bv-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94e80ca26866e3606d109422a90b437b22822a2c3cd64b9d0584b35114f07c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 2e6d5f64604be31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac5657b36ff4ea9f051859c1d7f0d6c56e2f56a183ac03f41a104cbc8a629f42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shinchina (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 967f0a4218cd8cc54f913248689a647f13975a604619d82492ee72b9a9c9f2f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-hook-form-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0cf2d07005ec432f85b35387c34d03f3229f9aaeeff947232ac2f58f6015853 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lognex/services-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba6d3d357986e72d67ec3f308dd50c1159d1fb8d2a740a5eca2ba15388295d6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8613 Malicious code in tari_wallet_ffi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ad37d363a37a8ab9bf54a878d2953d20ff4dfb6f2ac7e1c49f9216ac7a97f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-bottt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d1455d70483781388da15d3fb31b7905f74de5677c1158fa76039f8e412b2de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bds-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb86d6e10a764d9de055f1e941aaabd3c07c262bd4182f27d8258212ed8c0169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iproduce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9793afabdea98cc294df5335305541ec8d48c6f0fe655e511f82c46d2bd5685 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tkn-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3230b2e14e4f5e50ae022fdb7a081a52260e3c68f1a4b50add1dcca4afdc1a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Jupyter Infostealer Returns with New Addition to Its Arsenal

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Jupyter Infostealer is a malware variant initially discovered in late 2020. Since then, it has undergone continued evolution, altering its delivery methods and techniques to avoid detection and establish...

New GootLoader Malware Variant Evades Detection and Spreads Rapidly

A new variant of the GootLoader malware called GootBot has been found to facilitate lateral movement on compromised systems and evade detection. "The GootLoader group's introduction of their own custom bot into the late stages of their attack chain is an attempt to avoid detections when using...

Malicious code in fa-icdc-form-api-bdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24842401e160323f0909c7f6e561fbaa5cbdb6f3b5e3c0dfe2a4dd0fe1877e5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discordstreams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ecd29a8cad2b5a03c4966ae6e4e1f9879d9a26bcf5b48b620074ac2e65d197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in djsmusiccc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97843d99a4edd4ddf8c30e9c20d9779108bf139af236b556a657e48805a1b567 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Redefining the StripedFly Malware Framework

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary An intricate cross-platform malware framework, known as StripedFly, operated discreetly for five years, surreptitiously compromising over a million Windows and Linux systems. It skillfully evaded in-dept...

Malicious code in pragmaticplay-situs-slot-online-banyak-hoki-paling-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0bb9559484405e38427ba29fe4572ce1df42fa5a9932f8f785d2ed5295f3240 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3-abi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f4a779c84bc2b1936964dfbf4fc200f36f4dc6fb95b0a426c8a0e48459f2f30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agopoweryea123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca5c5e5ef3f588541558976ee86112900b01f69ca9fe775b740d12315b8ddd01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...