Malicious code in idnna (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f2ec3b09fbcf061a9f4ffefe1c179983ad8cdc0af705f2218280ade3c1da3 The package publishes under a name that closely resembles the widely-used idna package and advertises itself as 'HTTP client utilities', but the only...

Malicious code in tprelibpost (PyPI)

Source: checkmarx eef860542870f41cd93fe5dce25dfa9e6476b898889f085fc1f522955bbcac6e EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in tppaypalver (PyPI)

Source: checkmarx 8fe1c611b20ea153bb8216eca206317a8cccdcdeb862f1c1cc82c8062070a6d4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in minecc (PyPI)

Source: checkmarx 346324e80b7fdd082fd9c18592544f6f9f0e19e036d4f8ea73ecf1274e7ab426 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in libpywramgrand (PyPI)

Source: checkmarx 416f5a7ac259bc6371a0966dde66e31e7497662085958c78cadfa7bc72919b6a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in libcandyintelvisa (PyPI)

Source: checkmarx 1a66d5d6fc74aa2df237c71269e7db605de1bc9e1d80b7678867bc3ee63f8f87 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in esqstringramgui (PyPI)

Source: checkmarx 3d945c815717e70dad051c66a2654794041dd4e3405fe438e703518a890788e0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in controlpyw (PyPI)

Source: checkmarx 03f7ff3cfefa377068ddd81f6d4d3adc7354e4c83335e25e4063b7863534cee7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Researchers Uncover 73 Fake VS Code Extensions Delivering GlassWorm v2 Malware

Cybersecurity researchers have flagged dozens of Microsoft Visual Studio Code VS Code extensions on the Open VSX repository that are linked to a persistent information-stealing campaign dubbed GlassWorm. The cluster of 73 extensions has been identified as cloned versions of their legitimate...

Watering Hole Attack Targets EmEditor Users with Information-Stealing Malware

TrendAI™ Research provides a technical analysis of a compromised EmEditor installer used to deliver multistage malware that performs a range of malicious actions...

Google Identifies Three New Russian Malware Families Created by COLDRIVER Hackers

A new malware attributed to the Russia-linked hacking group known as COLDRIVER has undergone numerous developmental iterations since May 2025, suggesting an increased "operations tempo" from the threat actor. The findings come from Google Threat Intelligence Group GTIG, which said the...

Inside Russian Market: Uncovering the Botnet Empire

Eliran Alon contributed to this post. Inside Russian Market: Key insights from Rapid7 threat research The online cybercrime marketplace, Russian Market, has evolved from selling Remote Desktop Protocol RDP access to becoming one of the most active underground hubs for information-stealing malware...

UAC-0226 Deploys GIFTEDCROOK Stealer via Malicious Excel Files Targeting Ukraine

The Computer Emergency Response Team of Ukraine CERT-UA has revealed a new set of cyber attacks targeting Ukrainian institutions with information-stealing malware. The activity is aimed at military formations, law enforcement agencies, and local self-government bodies, particularly those located...

ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers

The threat actors behind the ClearFake campaign are using fake reCAPTCHA or Cloudflare Turnstile verifications as lures to trick users into downloading malware such as Lumma Stealer and Vidar Stealer. ClearFake, first highlighted in July 2023, is the name given to a threat activity cluster that...

Microsoft Warns of Malvertising Campaign Infecting Over 1 Million Devices Worldwide

Microsoft has disclosed details of a large-scale malvertising campaign that's estimated to have impacted over one million devices globally as part of what it said is an opportunistic attack designed to steal sensitive information. The tech giant, which detected the activity in early December 2024...

Google Docs used by infostealer ACRStealer as part of attack

An infostealer known as ACRStealer is using legitimate platforms like Google Docs and Steam as part of an attack, according to researchers. ACRStealer is often distributed via the tried and tested method of download as cracks and keygens, which are used in software piracy. The infostealer has bee...

Information Stealer Masquerades as LDAPNightmare (CVE-2024-49113) PoC Exploit

Our blog entry discusses a fake PoC exploit for LDAPNightmare CVE-2024-49113 that is being used to distribute information-stealing malware...

“Can you try a game I made?” Fake game sites lead to information stealers

The background and the IOCs for this blog were gathered by an Expert helper on our forums and Malwarebytes researchers. Our thanks go out to them. A new, malicious campaign is making the rounds online and it starts simple: Unwitting targets receive a direct message DM on a Discord server asking...

PT-2024-9433

Name of the Vulnerable Software and Affected Versions Windows Lightweight Directory Access Protocol LDAP affected versions not specified Description The issue is related to a denial-of-service vulnerability in Windows Lightweight Directory Access Protocol LDAP. This vulnerability can cause the...

Vietnamese Hacker Group Deploys New PXA Stealer Targeting Europe and Asia

A Vietnamese-speaking threat actor has been linked to an information-stealing campaign targeting government and education entities in Europe and Asia with a new Python-based malware called PXA Stealer. The malware "targets victims' sensitive information, including credentials for various online...