MAL-2026-17274 Malicious code in @hrmony/pladddform-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2de81847796671c2a5e9f97a94fae50352b0dff0816e4f0a7dfaf707fbb92629 index.js executes at module top level on require/import. It performs an unconditional POST check-in to...

MAL-2026-17279 Malicious code in @hrmony/pladddform-shared-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89319d39ad6d753459be90c221d657a73f70955c63d1675b347c11b5743209cc On module import, index.js executes three exfiltration routines that POST harvested secrets to the hardcoded endpoint...

MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

Star Blizzard refines phishing and malware delivery with the RedFlick technique

In this article 1. Star Blizzard TTPs observed in 2026 2. Defending against Star Blizzard and RedFlick-related activity 3. Microsoft Defender detections 4. Hunting queries 5. Indicators of compromise Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their...

Star Blizzard refines phishing and malware delivery with the RedFlick technique

In this article 1. Star Blizzard TTPs observed in 2026 2. Defending against Star Blizzard and RedFlick-related activity 3. Microsoft Defender detections 4. Hunting queries 5. Indicators of compromise Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their...

YARA-X 1.21.0

YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...

Behavior-Centric Malware Classification with Fine-Grained Malicious Logic Localization

Effective malware analysis requires understanding not only whether a program is malicious, but also which behaviors it exhibits and where those behaviors originate in the code. Existing machine-learning-based malware detectors largely operate as black boxes, providing limited insight into the...

honeypot-stuff

honeypot-stuff I am a ho...

RatHat Android Malware Console Uses Gemini to Identify Higher-Value Victims

RatHat's operators build and publish the Android banking trojan and control infected phones from a web console, according to security company Cleafy. Cleafy has traced nearly 100 deployments of that console since April 2026. It said this fits a malware-as-a-service model, in which each customer...

MAL-2026-17218 Malicious code in native-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c057973da17ec629b4cd8c10a2b74108761f4a9ad4a1a31b280031da1f7139ca On require'native-runner', a top-level IIFE in index.js polls for up to two minutes for a file at %APPDATA%\Microsoft\Windows\noderuntimehelper.exe...

Malicious code in nebulajs-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077 package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single 232KB opaque Function... invocation containing a custom...

Malicious code in my-skibidi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02c4b3433d9f819c70b6ec69fe7bcc0ae0a7ff48540e11394ea5fb8f3c49049c [email protected] contains top-level code in its main module that unconditionally POSTs document.cookie to the hardcoded remote endpoint...

NeedyMantis: Unpacking a post-compromise malware family used in targeted operations

In this article 1. Observed operators and targeting 2. Malware packaging and distribution 3. NeedyMantis architecture and capabilities 4. Mitigation and protection guidance 5. Hunting queries 6. Indicators of compromise Microsoft Threat Intelligence has identified NeedyMantis, a modular...

WordPress Malcure Malware Shield — Removal, Repair, Monitor plugin < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability

Multisite Subsite Admin+ Arbitrary File Write and Deletion vulnerability discovered by Charles Vosburgh in WordPress Plugin Malcure Malware Scanner versions 19.9.7...

Malicious code in @wbnr/lottiefiles-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f4124e4c91354a00657c25874fb6b9f762438eee2ecd1d8b686af3d4d4ea8c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wbnr/design-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b05ae1cf2f1c184b793a46f4bebd59f7945ef1f671c4e6bd64ee946c416e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kjj81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4c29ba9ea960c7f8e350f68be2c3a6dc320bc3e230be0fb6c8f30d186b1417 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in uuid-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1794c1dba5ffb902f0c8011a60990baff7cf5ebc1f90ab634937734944696995 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vinzzsync-wacli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6515588ac57ec4218f28d221b4c94d785d9455f03c0c6ae27b97fc66fdd6db5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17202 Malicious code in @consts/links (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddcbc6f472b5dba063f65d700ffb3669e4b33c439ec16445d623240b028202a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...