MAL-2024-11932 Malicious code in bs-auto-dark-mode (npm)

This package has a preinstall script to download an execute a Go-variant of the Cobalt Strike beacon. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a5c6958e14a49e20ebdd6902cdb4cad7872983ed4d39e94b625cc50a20314ac The OpenSSF Package Analysis project...

Drug Dealers Have Moved on to Social Media

The marketing of illegal drugs on open platforms is “gaining prominence,” authorities note, while the number of drug transactions on the dark web has decreased in recent years...

Dark web threats and dark market predictions for 2025

Review of last year's predictions The number of services providing AV evasion for malware cryptors will increase We continuously monitor underground markets for the emergence of new "cryptors," which are tools specifically designed to obfuscate the code within malware samples. The primary purpose...

CVE-2024-54337

Cross-Site Request Forgery CSRF vulnerability in DevriX DX Dark Site devrix-dark-site allows Stored XSS.This issue affects DX Dark Site: from n/a through = 1.0.1...

CVE-2024-54337

CVE-2024-54337 is a CSRF-to-stored XSS vulnerability in the DX Dark Site plugin (DevriX) affecting versions up to 1.0.1. It has a CVSS v3.1 base score of 7.1 (HIGH). Wordfence and RH/Red Hat records indicate a patched fix is available; affected installations should update to the patched version i...

PT-2024-36221 · Devrix · Devrix Dx Dark Site

Name of the Vulnerable Software and Affected Versions: DevriX DX Dark Site versions 1.0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored Cross-Site Scripting XSS in DevriX DX Dark Site. Recommendations: For DevriX DX Dark Site versions 1.0...

WordPress plugin DX Dark Site 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

WordPress DX Dark Site plugin <= 1.0.1 - CSRF to Stored Cross-Site Scripting vulnerability

CSRF to Stored Cross-Site Scripting vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin DX Dark Site versions = 1.0.1...

US Officials Recommend Encryption Apps Amid Chinese Telecom Hacking

Plus: Russian spies keep hijacking other hackers’ infrastructure, Hydra dark web market admin gets life sentence in Russia, and more of the week’s top security news...

Dark Web Hydra Market Mastermind Sentenced to Life by Russia

Stanislav Moiseyev, the organizer of the notorious Hydra Market, has been sentenced to life imprisonment by a Moscow court. Learn about the massive scale of this dark web marketplace and the international efforts to dismantle it...

Bitcoin Fog Operator Gets 12.5 Years for Longest-Running Bitcoin Laundering

Bitcoin Fog operator sentenced to 12.5 years for laundering $400M in crypto. The dark web's longest-running mixer processed…...

Dark Web Anti-Bot Services Let Phishers Bypass Google’s Red Page

Anti-bot services on the dark web allow phishers to bypass Google's Red Page warnings, evading detection and making…...

Stealer here, stealer there, stealers everywhere!

Introduction Information stealers, which are used to collect credentials to then sell them on the dark web or use in subsequent cyberattacks, are actively distributed by cybercriminals. Some of them are available through a monthly subscription model, thus attracting novice cybercriminals. Accordi...

Malicious code in theme-one-dark (npm)

--- -= Per source details. Do not edit below this line.=-...

Authorities Seize Dark Web Marketplaces Sipulitie and Tsätti

Finnish Customs and Swedish Police, with Bitdefender's support, shut down dark web marketplaces Sipulitie and Tsätti. These platforms…...

Whispers from the Dark Web Cave. Cyberthreats in the Middle East

The Kaspersky Digital Footprint Intelligence team analyzed cybersecurity threats coming from dark web cybercriminals who targeted businesses and governments in the Middle East in H1 2024. Our research highlights the most severe and pervasive threats, and identifies potential risks and consequence...

Bohemia and Cannabia Dark Web Markets Taken Down After Joint Police Operation

The Dutch police have announced the takedown of Bohemia and Cannabia, which has been described as the world's largest and longest-running dark web market for illegal goods, drugs, and cybercrime services. The takedown is the result of a collaborative investigation with Ireland, the United Kingdom...

[SECURITY] Fedora 41 Update: crosswords-0.3.13.3-4.fc41

A simple and fun game of crosswords. Load your crossword files, or play one of the included games. Features include: - Support for shaped and colored crosswords - Loading .ipuz and .puz files - Hint support, such as showing mistakes and suggesting words - Dark mode support - Locally installed...

Gamers Tricked Into Downloading Lua-Based Malware via Fake Cheating Script Engines

Users searching for game cheats are being tricked into downloading a Lua-based malware that is capable of establishing persistence on infected systems and delivering additional payloads. "These attacks capitalize on the popularity of Lua gaming engine supplements within the student gamer...

Facebook and Instagram passwords were stored in plaintext, Meta fined

Ireland’s privacy watchdog Data Protection Commission DPC has fined Meta €91M $101M after the discovery in 2019 that Meta had stored 600 million Facebook and Instagram passwords in plaintext. The DPC ruled that Meta was in violation of GDPR on several occasions related to this breach. It determin...