GHSA-X5VX-C2C8-M3W9

creationtimestamp| type| source ---|---|--- 2026-07-27 19:20:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmis3k5v2n...

GHSA-35Q8-9MJ6-WJMF

creationtimestamp| type| source ---|---|--- 2026-07-27 19:18:57+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmfzh6ff2o...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

GHSA-GPFC-H59V-63CV

creationtimestamp| type| source ---|---|--- 2026-07-25 17:51:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrigld2ef32d...

MAL-2026-11050 Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646 The package exfiltrates Roblox cookies and Discord tokens from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b8c073af489e9e7102ec43ca525f91f88615b572d4d0b0e65c6b64b647f93ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff ha...

EUVD-2026-48533

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

CVE-2026-49744

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

GHSA-8QQM-FP2Q-V734

creationtimestamp| type| source ---|---|--- 2026-07-23 23:59:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre2ahctmm2e...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

CVE-2026-44909

creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...

CVE-2026-65537

creationtimestamp| type| source ---|---|--- 2026-07-23 14:44:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrd3a2mgit2y...

CVE-2026-9264

creationtimestamp| type| source ---|---|--- 2026-07-23 12:33:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrctusfvqj2c...

CVE-2026-21723

creationtimestamp| type| source ---|---|--- 2026-07-23 04:04:27+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbxh45kxz2u 2026-07-23 23:55:20+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971989915718782...

MAL-2026-11030 Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5309dc413289d10c8d1cf1b2593f5e29c7810c23f60cb8e2c7709884cdba4c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ae70168cf816c36428f7c33d9beff0f159fbc6cd23b66eccc375e94aae4985 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e862c6a1d5cf9a77c2060f767e7144e9a73b77913c801dbf23f571ca5d3e054 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...