Malicious code in flagstealerfinal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b9cc9bb0bafe61901221efe8e6c9359eef4061151cc1a35544721addc6b8f2 The package flagstealerfinal was found to contain malicious code. Source: ghsa-malware eecc837f74a9e474ce6f056e83fc505b9f1126d18a96a5eb879def906682fd...

MAL-2025-192615 Malicious code in tnactgfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc53eec6bc0141b35cd02a25f78b5c7862e6b8ed845eb0b47da084b5d3582396 The package tnactgfds was found to contain malicious code. Source: ghsa-malware 40a7fc6d425dcaf14cd401ae7c14ef495455f779891345d9844a6465c7d4f795 Any...

MAL-2025-192610 Malicious code in ctfepakageflgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb15daff30154b098e6c84f0b4c7de85afc9489566fdca3adc3013fd4034857 The package ctfepakageflgs was found to contain malicious code. Source: ghsa-malware bb83a42ae050458182d5e671b9ff648bf0eee356acb6684eac514c2144bf5683...

Malicious code in my-ctf-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1937327d3ed32ee35590bce097cac61388dff43915682f2fceee4e7cc074c29f The package my-ctf-package was found to contain malicious code. Source: ghsa-malware 4ffe4e6f718d8543dc984772c0f919e029ffc02ed49b70f89ba018d787408ddb...

MAL-2025-192658 Malicious code in connections-api-hidden-runner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70 Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in connections-api-hidden-runner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70 Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-192659 Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAD-OOD: A Deep Learning Cluster-Driven Framework for an Out-Of-Distribution Malware Detection and Classification

Out of distribution OOD detection remains a critical challenge in malware classification due to the substantial intra family variability introduced by polymorphic and metamorphic malware variants. Most existing deep learning based malware detectors rely on closed world assumptions and fail to...

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan. The end goal of these attacks is cyber espionage, Slovak cybersecurity company ESET said in a report publishe...

Iranian APT ‘Prince of Persia’ Resurfaces With New Tools and Targets

SafeBreach reports the resurgence of the Iranian APT group Prince of Persia Infy. Discover how these state-sponsored hackers are now using Telegram bots and Thunder and Lightning malware to target victims globally across Europe, India, and Canada...

Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics formerly CJ Korea Express. "The threat actor leveraged QR codes...

ShadyPanda: The Silent Browser Takeover Threat and How Qualys TruRisk Eliminate Helps You Stop It

Executive Summary ShadyPanda has exploited trusted browser extensions to compromise millions of users, illustrating how legitimate software can unexpectedly become harmful. Qualys TruRisk Eliminate empowers organizations to identify risky behaviors, prioritize real threats, and eliminate maliciou...

New ClickFix Attack Uses Fake Browser Fix to Install DarkGate Malware

Researchers at Point Wild have discovered a new ClickFix attack campaign that tricks users into manually installing DarkGate malware via fake browser extension alerts. Learn how this attack bypasses security by using the Windows Run box and how you can stay safe...

Inside a purchase order PDF phishing campaign

A PDF named "NEW Purchase Order 52177236.pdf" turned out to be a phishing lure. So we analyzed the phishing script behind it. A customer contacted me when Malwarebytes blocked the link inside a “purchase order” email they had received. Malwarebytes blocked this ionoscloud.com subdomain When I...

GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads

A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud. The extensions have been collectively downloaded over 50,000...

Quantum Machine Learning for Cybersecurity: A Taxonomy and Future Directions

The increasing number of cyber threats and rapidly evolving tactics, as well as the high volume of data in recent years, have caused classical machine learning, rules, and signature-based defence strategies to fail, rendering them unable to keep up. An alternative, Quantum Machine Learning QML, h...

Packed Malware Detection Using Grayscale Binary-To-Image Representations

Detecting packed executables is a critical step in malware analysis, as packing obscures the original code and complicates static inspection. This study evaluates both classical feature-based methods and deep learning approaches that transform binary executables into visual representations,...

Malicious Package

Overview yb2bacceleratorstorefront-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Android mobile adware surges in second half of 2025

Android users spent 2025 walking a tighter rope than ever, with malware, data‑stealing apps, and SMS‑borne scams all climbing sharply while attackers refined their business models around mobile data and access. Looking back, we may view 2025 as the year when one-off scams were replaced on the sco...