OGhidra — Updated!

OGhidra 3 - AI-Powered Reverse Engineering with Ghidra For the version using a Claude-inspired Orchestrator, see https://github.com/llnl/OGhidra/tree/orchestrator OGhidra bridges Large Language Models with Ghidra's reverse engineering platform, enabling AI-driven binary analysis through natural...

GHSA-GPFC-H59V-63CV

creationtimestamp| type| source ---|---|--- 2026-07-25 17:51:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrigld2ef32d...

malicious_extension_sentry — Updated!

Malicious Chrome/Edge Extensions Database An automatically updated database of Chrome extensions removed from the Chrome Web Store for containing malware, policy violation, or bundling unwanted software 🌐 Live Dashboard Real-time search, filtering by threat category, and source reports, built on...

From Signals to Behaviors: Evidence-Based Android Malware Detection

Android malware remains a persistent threat, and detecting it accurately is a long-standing open problem. Whether an app is malicious depends on what it actually does and the context in which it does it, not on the surface signals it happens to exhibit. Existing detectors instead reason about...

speakeasy v2.0.0b4

Speakeasy Speakeasy is a Windows malware emulation framework that executes binaries, drivers, and shellcode in a modeled Windows runtime instead of a full VM. It emulates APIs, process/thread behavior, filesystem, registry, and network activity so samples can keep moving through realistic executi...

MAL-2026-11050 Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff ha...

New Dolphin X Malware Uses AI Profiler to Rank High-Value Victims

Dolphin X malware targets more than 300 apps and includes an AI Profiler that scores infected Windows PCs to help criminals identify high-value victims quickly...

Golden Chickens Resurfaces With Four New Malware Families and Modular Implants

The threat actors behind the Golden Chickens malware-as-a-service MaaS ecosystem have resurfaced with four new malware families, indicating that the operators are showing no signs of stopping despite extensive public disclosures into their inner workings. The malware families in question are:...

CVE-2026-49744

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

EUVD-2026-48533

Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...

Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks

The Computer Emergency Response Team of Ukraine CERT-UA has warned of a new campaign that involves the use of a malicious program that's dressed up as a Notepad++ plugin to compromise Windows systems. The activity has been attributed by the agency to a threat cluster it tracks as UAC-0099 , a...

GHSA-8QQM-FP2Q-V734

creationtimestamp| type| source ---|---|--- 2026-07-23 23:59:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre2ahctmm2e...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...

CVE-2026-44909

creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...

Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45dbfe79dd6fb079811b798a734de0a661605d420454d97a0635dbdaec621efd The package contains no static or traced indicators of exfiltration, install-time remote code execution, silent-relay, credential distribution,...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ac54ede0c029cfc28fa42ff5bdbd04ea17ebb610987c50a9108912588a82c The package advertises pure calendar/streak math but its main entry index.mjs schedules an async routine on module import via...