EUVD-2025-64521

Malicious code in diplomaticslugz3n npm...

EUVD-2025-64524

Malicious code in diplomaticlungfishz3n npm...

EUVD-2025-64522

Malicious code in diplomaticravenz3n npm...

EUVD-2025-64526

Malicious code in diplomaticaardwolfz3n npm...

EUVD-2025-64523

Malicious code in diplomaticquailz3n npm...

Malicious code in diplomatic_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 000f803bdf52a7d4e6f39dd47bdda7a489fef4cd6210e8cb5c77cd4de1ff0dd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in diplomatic_mollusk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8305b8362b3db0e2da90be96a5650b56c61833fbda8718bc9d2801c49b9ba469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in diplomatic-copper-rabbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10093549052610acf4bedde1b1cb0249ccee438fffa4cd2d85855cbb04f2a58f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54887

Malicious code in diplomatic-maroon-wildcat npm...

Malicious code in diplomatic-maroon-wildcat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 395e3433b9c2fe3cdc69ece01952861b7a12a9f97fecb15b97aff2ff2136dcd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54888

Malicious code in diplomatic-copper-rabbit npm...

EUVD-2025-54886

Malicious code in diplomatic-white-anglerfish npm...

Malicious code in diplomatic-white-anglerfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f793a60e4bd0e2dba27fb4a3eac8793279fcaf03eac9720be550393b0d165c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-60070

Malicious code in diplomaticgiraffez3n npm...

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025. The activity targeted diplomatic organizations in Hungary,...

Iran-Linked MuddyWater Targets 100+ Organizations in Global Espionage Campaign

The Iranian nation-state group known as MuddyWater has been attributed to a new campaign that has leveraged a compromised email account to distribute a backdoor called Phoenix to various organizations across the Middle East and North Africa MENA region, including over 100 government entities. The...

SideWinder's Shifting Sands: Click Once for Espionage

SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...

Phantom Taurus: New China-Linked Hacker Group Hits Governments With Stealth Malware

Government and telecommunications organizations across Africa, the Middle East, and Asia have emerged as the target of a previously undocumented China-aligned nation-state actor dubbed Phantom Taurus over the past two-and-a-half years. "Phantom Taurus' main focus areas include ministries of forei...

Iranian Hackers Exploit 100+ Embassy Email Accounts in Global Phishing Targeting Diplomats

An Iran-nexus group has been linked to a "coordinated" and "multi-wave" spear-phishing campaign targeting the embassies and consulates in Europe and other regions across the world. The activity has been attributed by Israeli cybersecurity company Dream to Iranian-aligned operators connected to...

The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign

The Coordinated Embassy Hunt: Unmasking the DPRK-linked GitHub C2 Espionage Campaign By Pham Duy Phuc and Alex Lanstein · August 18, 2025 The Trellix Advanced Research Center uncovered a sophisticated espionage operation targeting diplomatic missions across several regions in South Korea during...