A week in security (February 17 – February 23)

Last week on Malwarebytes Labs: Healthcare security lapses keep piling up SecTopRAT bundled in Chrome installer distributed via Google Ads Google Docs used by infostealer ACRStealer as part of attack DeepSeek found to be sharing user data with TikTok parent company ByteDance Malwarebytes introduc...

Google Docs used by infostealer ACRStealer as part of attack

An infostealer known as ACRStealer is using legitimate platforms like Google Docs and Steam as part of an attack, according to researchers. ACRStealer is often distributed via the tried and tested method of download as cracks and keygens, which are used in software piracy. The infostealer has bee...

DocsGPT 安全漏洞

DocsGPT is a cutting edge open source solution from Arc53 Open Source. It simplifies the process of finding information in project documentation. A security vulnerability exists in DocsGPT versions 0.8.1 through 0.12.0 that stems from improper parsing of JSON data using the eval function. An...

CVE-2024-23563

HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data...

PT-2025-25284

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs DocumentServer version 8.3.1 and earlier Description The issue is a reflected cross-site scripting XSS problem that occurs when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST...

MAL-2025-1363 Malicious code in gestalt-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc35868180fe5879113537fbdce9118cb06ace84a31d55fa9268d5bc050091e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gestalt-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edc35868180fe5879113537fbdce9118cb06ace84a31d55fa9268d5bc050091e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-23563

HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data...

CVE-2024-23563

HCL Connections Docs is vulnerable to a sensitive information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data...

CVE-2025-22696

Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from n/a through = 1.1.0...

CVE-2024-49672

Cross-Site Request Forgery CSRF vulnerability in giffordcheung Google Docs RSVP google-docs-rsvp-guestlist allows Stored XSS.This issue affects Google Docs RSVP: from n/a through = 2.0.1...

CVE-2024-42370

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions 2.10.0 and prior, Litestar's docs-preview.yml workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the...

CVE-2024-35696

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Fahad Mahmood WP Docs allows Reflected XSS.This issue affects WP Docs: from n/a through 2.1.3...

Security Bulletin: IBM Instana Observability is vulnerable to AuthZ Plugin Bypass and Privilege Escalation

Summary Vulnerability in Docker Engine that could allow attackers to bypass authorization plugins AuthZ was remediated in IBM Observability with Instana Build 279. CVE-2024-41110 Vulnerability Details CVEID:CVE-2024-41110 DESCRIPTION: Moby is an open-source project created by Docker for software...

CVE-2025-22696

CVE-2025-22696): WordPress Document Block – Upload & Embed Docs plugin (Document Block – Upload & Embed Docs) contains a Missing Authorization vulnerability affecting versions 1.1.0 and earlier. The issue arises from insufficient authorization checks, enabling an unauthenticated actor to perform ...

PT-2025-4631 · Unknown · Embedpress Document Block – Upload & Embed Docs

Name of the Vulnerable Software and Affected Versions: Document Block – Upload & Embed Docs versions 1.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in the EmbedPress Document Block – Upload & Embed Docs. This vulnerability affects the ability to...

MAL-2025-1211 Malicious code in continue-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4758de25ad99ec1a3c7b2bc7bfe0e9657ccef34aa389e3f39db67720e64b3705 Any computer that has this package installed or running should be considered...

Malicious code in k6-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d7cb564097694bf695333aae5e27e5a57cf646842369831d93bfad2391e9309 Any computer that has this package installed or running should be considered...

MAL-2025-1041 Malicious code in k6-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d7cb564097694bf695333aae5e27e5a57cf646842369831d93bfad2391e9309 Any computer that has this package installed or running should be considered...

Malicious code in continue-docs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4758de25ad99ec1a3c7b2bc7bfe0e9657ccef34aa389e3f39db67720e64b3705 Any computer that has this package installed or running should be considered...