MAL-2025-191919 Malicious code in uzip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ee20087db4a86ce68765ba8046732e8f1fc906c58a0303e836429a63788dc97f During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The...

Malicious code in @eagleview/ev-mapviewer-interactions (npm)

Package is malware. It exfiltrates sensitive info, executes arbitrary code during install, and matches multiple YARA rules. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2d7da79dc7cea55b1c51c17952322ec30f3d03000a7b075252e9f74084a7a06 The package...

MAL-2025-190621 Malicious code in @eagleview/ev-mapviewer-interactions (npm)

Package is malware. It exfiltrates sensitive info, executes arbitrary code during install, and matches multiple YARA rules. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2d7da79dc7cea55b1c51c17952322ec30f3d03000a7b075252e9f74084a7a06 The package...

New Sturnus Android Malware Reads WhatsApp, Telegram, Signal Chats via Accessibility Abuse

Sturnus, an advanced Android banking trojan, has been discovered by ThreatFabric. Learn how this malware bypasses end-to-end encryption on Signal and WhatsApp, steals bank credentials using fake screens, and executes fraudulent transactions...

APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains

A China-nexus threat actor known as APT24 has been observed using a previously undocumented malware dubbed BADAUDIO to establish persistent remote access to compromised networks as part of a nearly three-year campaign. "While earlier operations relied on broad strategic web compromises to...

MAL-2025-191772 Malicious code in kdewebhelper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 da8701a407522875f63d2aaa28d27194fe8e2faa4d7782fd66639f224ae62dcd Importing the module connects to a Telegram bot and provides its operator with abilities to execute commands, exfiltrate and encrypt data. The target group see...

Comet Browser Flaw Lets Hidden API Run Commands on Users’ Devices

SquareX warns Perplexity's Comet AI browser contains a hidden MCP API that bypasses security, allowing attackers to install malware and seize full device control...

ThreatsDay Bulletin: 0-Days, LinkedIn Spies, Crypto Crimes, IoT Flaws and New Malware Waves

This week has been crazy in the world of hacking and online security. From Thailand to London to the US, we've seen arrests, spies at work, and big power moves online. Hackers are getting caught. Spies are getting better at their jobs. Even simple things like browser add-ons and smart home gadget...

MAL-2025-190582 Malicious code in just-a-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1b3b6dacc63b42851c61ae55e5168dbd9ff40172851cbfa980f489da54826f7 The package just-a-calculator was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190579 Malicious code in hellospa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0582933888e4badd81ead15c78b68f8de23a0c728b5a1584f737bedcfd569184 The package hellospa was found to contain malicious code. Source: ghsa-malware f4e9282a1da51cf6409a4e5196d718d73e8f6f8dbddd339cbdd0535658517576 Any...

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol...

Malicious code in react-svg-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e399f2b08fcb5a17dce3bb49a4f5dbeec6d8c56b34dab5586e8a84c5232d08 The package react-svg-helper was found to contain malicious code. Source: ghsa-malware f872307ebcfe0abab5b4fb796f5d770fd3678292ff059768bc62144d97fe03...

Malicious code in react-svg-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b392459196e5602d6e40cd38445d10e87e49d85b53b966aee554dd758fc1bd The package react-svg-module was found to contain malicious code. Source: ghsa-malware dd046bd4ddd4da53330303e0802201fda828bce7e1a21524aa7fc0da1fed95...

Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks

Suspected espionage-driven threat actors from Iran have been observed deploying backdoors like TWOSTROKE and DEEPROOT as part of continued attacks aimed at aerospace, aviation, and defense industries in the Middle East. The activity has been attributed by Google-owned Mandiant to a threat cluster...

Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages

Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and security researchers to ultimately redirect them to sketchy crypto-themed sites. The malicious npm...

What We Do In The Shadow (AI): New Malware Strain Vamps Up

...

Malicious code in node-calculator-3e62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1703fc5c6d064d50b797ea676b0a02186a5cce75afc97191661b8aaa82624543 The package node-calculator-3e62 was found to contain malicious code. Source: ghsa-malware...

Malicious code in tailwindcss-breezium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92d0ba07d104ef809e0b5b17fe93670e80af4cceecde2f9afb14f8357febcdc The package tailwindcss-breezium was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190564 Malicious code in tailwindcss-breezium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92d0ba07d104ef809e0b5b17fe93670e80af4cceecde2f9afb14f8357febcdc The package tailwindcss-breezium was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190557 Malicious code in @grumpycoffeecup/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a093b0e1fa1064f7696cf7ea0b583ffaf5470026f8c5da1613204168b33b09ed The package @grumpycoffeecup/hello-npm-world was found to contain malicious code. Source: ghsa-malware...