DriveLife-PsTrojan

DriveLife-PsTrojan TrojanDropper/PS.Maloader.d Introduction to the "DriveLife" Virus Since its emergence in 2018, the "DriveLife" virus has spawned multiple variants and continuously refined its techniques to evade detection and removal by security software. The virus exploits multiple high-risk...

RedTeamCoin

RedTeamCoin RedTeamCoin is a blockchain-based cryptocurrency mining pool implementation designed for authorized security testing and red team operations. Built in Go with Java client support, it simulates real-world cryptomining attacks to help organizations assess their detection capabilities an...

MSC-2026-13032

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Package downloads and installs a cryptocurrency...

Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

MAL-2026-14185 Malicious code in mutex-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e142539248a690ef78ebe7ceeaa4c16e9903107a04704e1947cf296bce543097 The package presents itself as a mutex library but lib/Mutex.js contains an injected branch in runExclusive that, when a caller passes...

Malicious code in @lodash-js/lodash-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e8f6925f88772bdb738b691a200f670aebecaef33c066a379d9424c7910a5a The package is published under a name mimicking lodash but its manifest's main entry is dist/xelis-miner.browser.js, a Xelis Stratum cryptocurrency...

Malicious code in envpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. T...

MSC-2026-6443

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Package contains binary files with partial...

MSC-2026-6442

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Package contains binary files with partial...

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

Threat actors are continuing to exploit a critical Langflow vulnerability as part of fresh attacks designed to deliver a Monero cryptocurrency miner. The activity has been found to weaponize CVE-2026-33017 CVSS score: 9.3, an unauthenticated remote code execution RCE vulnerability in Langflow,...

From Langflow to Monero: Inside CVE-2026-33017 Cryptominer

We tracked a cryptocurrency-mining campaign exploiting CVE-2026-33017, which revealed how threat actors are now scanning exposed AI application infrastructure for their next foothold...

WS-2019-0199

dogecoin 1.0.2 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0200

omniauth-amazon 1.0.1 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0198

comingsoon 0.2.8 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0197

coinbase 4.2.1 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0196

capistranocolors 0.5.5 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0195

blockchainwallet 0.0.6 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0194

awesomebot 1.18.0 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contains a backdoor mechanism that allows the attacker to send a cookie file back to project and allow the attacker to execute malicious commands...

WS-2019-0193

lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute maliciou...

cPanel CVE-2026-41940 Under Active Exploitation to Deploy Filemanager Backdoor

A threat actor named MrRot13 has been attributed to the exploitation of a recently disclosed critical cPanel flaw to deploy a backdoor codenamed Filemanager on compromised environments. The attack exploits CVE-2026-41940, a vulnerability impacting cPanel and WebHost Manager WHM that could result ...