640 matches found
Malicious code in apollo-gmail-grabber (npm)
The package apollo-gmail-grabber was found to contain malicious code. --- Credit: OpenSSF source...
What’s the Scam?
To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from subscribing addresses other than their own. Starting last weekend, I have been receiving a lot of individu...
mboxshell v0.7.1
mboxShell Fast terminal viewer for MBOX files of any size. Open, search and export emails from Gmail Takeout backups 50 GB+ without loading them into memory. Leer en Espanol / Spanish Why this project exists When you export your email from Gmail using Google Takeout, you get one or more .mbox fil...
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens,...
GMail API - Detect
GMail API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GMail API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GMail API - Detect', 'description': 'GMail API was detected.', 'author':...
Malicious code in gmail-changer (npm)
Source: amazon-inspector 913e56ded5b9c46e15c7589a0883bfb708b2488aa54f4c25ca05b1c13e4d75fe Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers waitForRemoveRecovery, waitForRecoveryAdd, waitForPasswordChange, waitForDeviceLogout,...
Malicious code in coffin-grave (PyPI)
Source: kam193 21110452950ae0dced9cfd59dd55627b8634f47f3dd2be36558c338437532fac So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by socket.dev team --- Category: MALICIOUS - The campaign has...
Malicious code in coffin-codes-pro (PyPI)
Source: kam193 fa99dd73d11cc6b2756fb43cff1eb16f5f80b4ffd436dbfd635b8417f821c7ba So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by socket.dev team --- Category: MALICIOUS - The campaign has...
Malicious code in coffin-codes-net (PyPI)
Source: kam193 df624a59b2cb5ef5cf295a7e63718bf7938250f59c5cda19bb6f43c40824e99b So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by socket.dev team --- Category: MALICIOUS - The campaign has...
Claude for Chrome flaw could let rogue extensions access your Gmail
First reported in May, ClaudeBleed is basically a “fake remote control” problem. A sneaky browser extension can pretend to be Claude’s own website and secretly drive the Claude for Chrome extension to read your data and take action in your accounts. The Claude for Chrome browser extension is an...
MAL-2026-10635 Malicious code in gmail-changer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913e56ded5b9c46e15c7589a0883bfb708b2488aa54f4c25ca05b1c13e4d75fe Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers waitForRemoveRecovery, waitForRecoveryAdd...
Malicious code in gmail-changer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913e56ded5b9c46e15c7589a0883bfb708b2488aa54f4c25ca05b1c13e4d75fe Package exports a complete Gmail account-hijack pipeline driven by stolen session cookies. Exported helpers waitForRemoveRecovery, waitForRecoveryAdd...
Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages
Researchers found a flaw in Opera GX, the gaming-focused version of the Opera browser, that let a malicious website silently install a browser add-on and use it to lift specific data from the pages a victim visits. In a proof of concept, they reconstructed a signed-in user's full Gmail address fr...
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API
The threat actor known as ToddyCat has been attributed to a new malware called Umbrij that's designed to gain surreptitious access to a victim's email correspondence via the Google API. "In this campaign, the attackers focused their attention on corporate email communications hosted on Gmail,...
ToddyCat: your hidden email assistant. Part 2
Introduction We continue to share details on the malicious techniques and toolsets used by the ToddyCat APT group. In the first part of this report, we examined the group's attacks aimed at stealing data from browsers, as well as from local and cloud email services. The methods used in that...
CVE-2026-57657
Unauthenticated Cross Site Request Forgery CSRF in Gmail SMTP = 1.2.3.19 versions...
CVE-2026-57657
Unauthenticated Cross Site Request Forgery CSRF in Gmail SMTP = 1.2.3.19 versions...
CVE-2026-57657 WordPress Gmail SMTP plugin <= 1.2.3.19 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery CSRF in Gmail SMTP = 1.2.3.19 versions...
CVE-2026-57657
The connected sources confirm an unauthenticated Cross Site Request Forgery (CSRF) vulnerability in the WordPress Gmail SMTP plugin, affecting versions up to 1.2.3.19. The issue is documented across CVE entries and third-party listings as CVE-2026-57657 and specifies the affected product as the W...
