Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844bb41cfa32b3ead1bd2558d13f9114c93fc9cea7be43ed4063726f259d405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be4b64316a832dd3482cc41c21d79e2005d5984e2458ed45e957ee761862de31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers

Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack...

Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5c66c5e78670d2099776492aa1a836a031eea3a9d43b2ffe5911a19b62c71d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

speakeasy v2.0.0b8

Speakeasy Speakeasy is a Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled Windows runtime instead of a full VM. It emulates APIs, process/thread behavior, filesystem, registry, and network activity so samples can keep moving through realistic executi...

Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

KREMLIN Banking Malware Hijacks Chrome and Edge to Steal Credentials and Session Tokens

Cybersecurity researchers have shed light on a previously undocumented Brazilian banking malware operation that delivers a toolkit called KREMLIN. Elastic Security Labs is tracking the activity under the moniker REF9334. Active since at least May 2025, the threat actor has used lures that...

Malicious code in tailwind-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f06c2ce29f04ce06cfb494996cb6ffde7aea02af92489abcacf10cbcb7beb2 tailwind-forms-styles ships a src/index.js that is fully obfuscated with obfuscator.io rotated 303-entry string array, hex-named identifiers,...

CVE-2026-40058: Time-of-check Time-of-use (TOCTOU) Race Condition

CrowdStrike released a security update to address a vulnerability in the Falcon sensor for Windows. The vulnerability only exists when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled and customers remain protected through the Cloud Anti-malware for Microsoft...

Astra Linux – Vulnerability in Firefox and Thunderbird

When opening Diagcab files, Firefox did not warn the user that these files might contain malicious code. This vulnerability affects Firefox 115, Firefox ESR 102.13, and Thunderbird 102.13...

Astra Linux – Vulnerability in Derby

A cleverly designed username can bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could allow an attacker to create unnecessary Derby databases, thereby filling up storage space. In LDAP-authenticated Derby installations, the attacker could also execute malware...

CAPE-parsers v0.1.69

CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...

MAL-2026-16168 Malicious code in @biz44/id79-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Harden-Windows-Security HardenSystemSecurity-v1.0.88.0

Harden Windows Security | A New Threat to Malware Harden Windows Safely, Securely, Only With Official Microsoft Methods How To Use Related Trust Support Security Recommendations Resources License Wiki Basic FAQs Roadmap Donation !IMPORTANT Here are Quick Access Points to Important Sections of thi...

Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection

Anthropic on Thursday revealed it disrupted a campaign mounted by a Russian state-sponsored threat actor that abused Claude for developing an AI-assisted workflow to get ahead of the detection curve. The operation has been attributed to a cyber espionage group it calls GTG-20006 where "GTG" stand...

TALKINGEBN

|-------------------| TALKINGBEN : --- Un malware BootKit que primero realiza una escalada de privilegios en la máquina víctima. Utilizando parcheo en NtTraceEvent y AMSI escáner de búfer de memoria, lo que le permite evadir Windows Defender y cargar un payload sin ser detectado. Luego usamos...

The vulnerability of the Microsoft Malware Protection Engine, a component of the Microsoft Defender antivirus protection tool, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Microsoft Malware Protection Engine, a component of the Microsoft Defender antivirus protection tool, relates to an improper definition of symbolic links before accessing a file. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protecte...