Malicious code in down-lo-ad-now-zip-mp3-261895-fake-it-flowers-fr14h-gmqthe (npm)

The package down-lo-ad-now-zip-mp3-261895-fake-it-flowers-fr14h-gmqthe was found to contain malicious code...

MAL-2025-18694 Malicious code in down-lo-ad-now-zip-mp3-261895-fake-it-flowers-fr14h-gmqthe (npm)

The package down-lo-ad-now-zip-mp3-261895-fake-it-flowers-fr14h-gmqthe was found to contain malicious code...

Malicious code in fake-twilio (npm)

The package fake-twilio was found to contain malicious code...

MAL-2025-20178 Malicious code in fake-twilio (npm)

The package fake-twilio was found to contain malicious code...

Home Office Phishing Scam Target UK Visa Sponsorship System

Fake Home Office emails target the UK Visa Sponsorship System, stealing logins to issue fraudulent visas and run…...

New Android Malware Wave Hits Banking via NFC Relay Fraud, Call Hijacking, and Root Exploits

Cybersecurity researchers have disclosed a new Android trojan called PhantomCard that abuses near-field communication NFC to conduct relay attacks for facilitating fraudulent transactions in attacks targeting banking customers in Brazil. "PhantomCard relays NFC data from a victim's banking card t...

Fake Minecraft Installer Spreads NjRat Spyware to Steal Data

Fake Minecraft clone Eaglercraft 1.12 Offline spreads NjRat spyware stealing passwords, spying via webcam and microphone, warns Point…...

Malicious File Parsing

@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...

That “Amazon Safety Recall” message may well be a scam

Scammers are using the age old tactic of scaring victims into clicking by sending out fake product recall messages from Amazon. The text message tells you that the item does not meet Amazon’s standards, and tries to install some urgency by claiming it is not safe to use. It also includes a link...

Microsoft PlayReady Activation Protocol Issues

This advisory builds on prior disclosed work in 2022 regarding Microsoft PlayReady protocol issues that can lead to leaf certificate generation using fake identities...

GreedyBear: 40 Fake Crypto Wallet Extensions Found on Firefox Marketplace

A new, coordinated cybercrime campaign called "GreedyBear" has stolen over $1 million from crypto users. Learn how the group uses malicious extensions, malware, and fake websites in an industrial-scale attack uncovered by Koi Security...

Fake VPN and Spam Blocker Apps Tied to VexTrio Used in Ad Fraud, Subscription Scams

The malicious ad tech purveyor known as VexTrio Viper has been observed developing several malicious apps that have been published on Apple and Google's official app storefronts under the guise of seemingly useful applications. These apps masquerade as VPNs, device "monitoring" apps, RAM cleaners...

15,000 Fake TikTok Shop Domains Deliver Malware, Steal Crypto via AI-Driven Scam Campaign

Cybersecurity researchers have lifted the veil on a widespread malicious campaign that's targeting TikTok Shop users globally with an aim to steal credentials and distribute trojanized apps. "Threat actors are exploiting the official in-app e-commerce platform through a dual attack strategy that...

Malicious code in bh-25-req-ase (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ddd759ada90b89401904e23b4e8cbe6a3021baf3c34495150b4a713ca7063be0 If run, the package exfiltrates AWS credentials. Though it's described as test, the exfiltration really happens --- Category: MALICIOUS - The campaign has...

New JSCEAL Malware Targets Millions via Fake Crypto App Ads

JSCEAL malware targets millions using fake crypto app ads to steal wallets and data. Users urged to stay alert and avoid downloading from untrusted sources...

PlayPraetor Android Trojan Infects 11,000+ Devices via Fake Google Play Pages and Meta Ads

Cybersecurity researchers have discovered a nascent Android remote access trojan RAT called PlayPraetor that has infected more than 11,000 devices, primarily across Portugal, Spain, France, Morocco, Peru, and Hong Kong. "The botnet's rapid growth, which now exceeds 2,000 new infections per week, ...

CVE-2025-51726

CVE-2025-51726 concerns the CyberGhostVPNSetup.exe Windows installer. The supplied documents confirm two concrete issues: (1) signing with the weak hash algorithm SHA-1 , enabling potential forged certificates that may bypass signature checks on systems without strict SmartScreen/trust policy enf...

CVE-2025-54573

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.1.0 through 2.41.0, email verification was not enforced when using Basic HTTP Authentication. As a result, users could create accounts using fake email addresses and use the product as verified...

Attackers Use Fake OAuth Apps with Tycoon Kit to Breach Microsoft 365 Accounts

Cybersecurity researchers have detailed a new cluster of activity where threat actors are impersonating enterprises with fake Microsoft OAuth applications to facilitate credential harvesting as part of account takeover attacks. "The fake Microsoft 365 applications impersonate various companies,...

OnlyFans, Discord ClickFix-Themed Pages Spread Epsilon Red Ransomware

Beware of Epsilon Red ransomware as attackers impersonate Discord, Twitch and OnlyFans using fake verification pages with .HTA files and ActiveX to spread malware...