cromos

Cromos Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files...

Log4j-Vulnerability

Log4j Vulnerability Tutorial: https://youtu.be/PNDBjoT83zA Tutorial: https://cryptodeeptech.ru/log4j-vulnerability Background on Log4j Alibaba Cloud Security Team publicly disclosed a critical vulnerability CVE-2021-44228 enabling unauthenticated remote code execution against multiple versions of...

MAL-2026-14288 Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

Malicious code in @wizloft/harness-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85 dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints eth.drpc.org,...

MAL-2026-14287 Malicious code in @wizloft/harness-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85 dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints eth.drpc.org,...

Malicious code in timed-assess (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d39931b57405563b5114ee92146f85eeeddbeb0e235dae9f483c2b30764f47e package.json declares postinstall: node apps, which loads apps/index.js. The script reads a bundled file, decrypts it with hardcoded DES key...

Malicious code in @years19/n8n-nodes-utils-helper-p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2796fa0be5e82ae475ed35463aa9f400091a3856a0fc96426e8515b012dd0e9a On npm install postinstall and on require of the main entry index.js, the package fetches multiple tarballs mhddos, pyroxy-full, impacket, multidict...

Crypto Mining Malware - Detect

Checks websites for crypto-mining malware. !/usr/bin/env python3 -- coding: utf-8 -- """Checks websites for crypto-mining malware.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Crypto Mining Malware -...

WS-2021-0014

All versions of "Jquerry" NPM package contains malicious code. The index.js file appears to download and execute a crypto mining script. The file is not run upon installation - the package needs to be required or the index.js run manually...

EUVD-2021-34087

Malicious code in bioql PyPI...

INTERPOL Arrests 1,209 Cybercriminals Across 18 African Nations in Global Crackdown

INTERPOL on Friday announced that authorities from 18 countries across Africa have arrested 1,209 cybercriminals who targeted 88,000 victims. "The crackdown recovered $97.4 million and dismantled 11,432 malicious infrastructures, underscoring the global reach of cybercrime and the urgent need for...

Alert: Exposed JDWP Interfaces Lead to Crypto Mining, Hpingbot Targets SSH for DDoS

Threat actors are weaponizing exposed Java Debug Wire Protocol JDWP interfaces to obtain code execution capabilities and deploy cryptocurrency miners on compromised hosts. "The attacker used a modified version of XMRig with a hard-"coded configuration, allowing them to avoid suspicious command-li...

Sleep with one eye open: how Librarian Ghouls steal data by night

Introduction Librarian Ghouls, also known as "Rare Werewolf" and "Rezet", is an APT group that targets entities in Russia and the CIS. Other security vendors are also monitoring this APT and releasing analyses of its campaigns. The group has remained active through May 2025, consistently targetin...

Outlaw cybergang attacking targets worldwide

Introduction In a recent incident response case in Brazil, we dealt with a relatively simple, yet very effective threat focused on Linux environments. Outlaw also known as "Dota" is a Perl-based crypto mining botnet that typically takes advantage of weak or default SSH credentials for its...

Storm-1977 Hits Education Clouds with AzureChecker, Deploys 200+ Crypto Mining Containers

Microsoft has revealed that a threat actor it tracks as Storm-1977 has conducted password spraying attacks against cloud tenants in the education sector over the past year. "The attack involves the use of AzureChecker.exe, a Command Line Interface CLI tool that is being used by a wide range of...

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

The developers of Rspack have revealed that two of their npm packages, @rspack/core and @rspack/cli, were compromised in a software supply chain attack that allowed a malicious actor to publish malicious versions to the official package registry with cryptocurrency mining malware. Following the...

WS-2021-0217

An issue was found in github.com/argoproj/argo-workflows Go package up to 3.0.0 including. Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g...

Notorious Hacker Group TeamTNT Launches New Cloud Attacks for Crypto Mining

The infamous cryptojacking group known as TeamTNT appears to be readying for a new large-scale campaign targeting cloud-native environments for mining cryptocurrencies and renting out breached servers to third-parties. "The group is currently targeting exposed Docker daemons to deploy Sliver...

Cybercriminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks

Bad actors have been observed targeting Docker remote API servers to deploy the SRBMiner crypto miner on compromised instances, according to new findings from Trend Micro. "In this attack, the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining...

Exposed Selenium Grid Servers Targeted for Crypto Mining and Proxyjacking

Internet-exposed Selenium Grid instances are being targeted by bad actors for illicit cryptocurrency mining and proxyjacking campaigns. "Selenium Grid is a server that facilitates running test cases in parallel across different browsers and versions," Cado Security researchers Tara Gould and Nate...