MAL-2026-1921 Malicious code in resolvrtest (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1916 Malicious code in freshworks-ruby (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1911 Malicious code in prometheus-quicker-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in prometheus-analysis-1 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in loveclose (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1904 Malicious code in loveclose (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1901 Malicious code in ethical-demo-liviy (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1898 Malicious code in curl-requester (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1897 Malicious code in bigmathutils (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1895 Malicious code in bigmathex (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1894 Malicious code in async-substrate-interface-sub (PyPI)

--- -= Per source details. Do not edit below this line.=-...

The SOC Files: Time to “Sapecar”. Unpacking a new Horabot campaign in Mexico

Introduction In this installment of our SOC Files series, we will walk you through a targeted campaign that our MDR team identified and hunted down a few months ago. It involves a threat known as Horabot , a bundle consisting of an infamous banking Trojan, an email spreader, and a notably complex...

New ClickFix Scam Tricks Users Into Mapping Hacker-Controlled Drives

A new ClickFix scam tricks Windows users into running hidden commands that map hacker-controlled drives and load malware…...

Transparent COM instrumentation for malware analysis

COM automation is a core Windows technology that allows code to access external functionality through well-defined interfaces. It is similar to traditionally loading a DLL, but is class-based rather than function-based. Many advanced Windows capabilities are exposed through COM, such as Windows...

Malicious code in rowrap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 606ce541a3ef4a98e4e1639e96c6431e7ec83be6f987c640a63c03991eae4f6e The package hides code to download and start malicious script containing malware, identified as adware. The triggering method seems to be PTH file, although it...

MAL-2026-1543 Malicious code in aniresolve (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c29943544c9e6ba7e0a3075c393fa1fa89673c99b73634c0263ef164e52ac306 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

Malicious code in aniresolve (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c29943544c9e6ba7e0a3075c393fa1fa89673c99b73634c0263ef164e52ac306 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

MAL-2026-1499 Malicious code in anistream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57e4902ca2172a78b93acf6ec1413ab098e72c158dc1ab74c3a84f28f50382f1 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

Malicious code in anistream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57e4902ca2172a78b93acf6ec1413ab098e72c158dc1ab74c3a84f28f50382f1 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

ClickFix Attack Targets Devs with MacSync Malware via Fake Claude Tools

Cybersecurity researchers at 7AI have revealed a new Claude Fraud campaign in which hackers use fake AI extensions and Google ads to steal data from tech professionals...