MAL-2025-192623 Malicious code in chai-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b74105dd25d6c4527e469282746ab5847ca41c5f21873099aa73bcf848f99432 The package chai-async was found to contain malicious code. Source: ghsa-malware 5eadd1bc38807a3c5bcec1c37a5d1a1de8bf81bfed4a5a7ba235a1e6f8ec34aa Any...

Malicious code in @pluxee-design-system/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95edac344588e8262b1cfdc979c7eb4585329df2ce47b7adc45f23930971e7b The package @pluxee-design-system/core was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192611 Malicious code in ctfparsertna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52cd5612214cb1fd0ed34899c5e686c4fdbecb4a820e170a3589987c20b9b3da The package ctfparsertna was found to contain malicious code. Source: ghsa-malware 90b9a48b58422c5d9853769c983bd04388558c312be191e3bfd8a82158214d38 A...

Malicious code in flagstealerfinal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b9cc9bb0bafe61901221efe8e6c9359eef4061151cc1a35544721addc6b8f2 The package flagstealerfinal was found to contain malicious code. Source: ghsa-malware eecc837f74a9e474ce6f056e83fc505b9f1126d18a96a5eb879def906682fd...

MAL-2025-192610 Malicious code in ctfepakageflgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb15daff30154b098e6c84f0b4c7de85afc9489566fdca3adc3013fd4034857 The package ctfepakageflgs was found to contain malicious code. Source: ghsa-malware bb83a42ae050458182d5e671b9ff648bf0eee356acb6684eac514c2144bf5683...

MAL-2025-192615 Malicious code in tnactgfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc53eec6bc0141b35cd02a25f78b5c7862e6b8ed845eb0b47da084b5d3582396 The package tnactgfds was found to contain malicious code. Source: ghsa-malware 40a7fc6d425dcaf14cd401ae7c14ef495455f779891345d9844a6465c7d4f795 Any...

Malicious code in my-ctf-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1937327d3ed32ee35590bce097cac61388dff43915682f2fceee4e7cc074c29f The package my-ctf-package was found to contain malicious code. Source: ghsa-malware 4ffe4e6f718d8543dc984772c0f919e029ffc02ed49b70f89ba018d787408ddb...

MAL-2025-192658 Malicious code in connections-api-hidden-runner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70 Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in connections-api-hidden-runner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae6bedba7c21e763c5a0e27952cf75a13a7705e7681027c87a833417a2035b70 Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-192659 Malicious code in hidden-powershell-runner-ax7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5785c01837ec1727b89125cf1a3fec3ad941c4ff0b1246d8d16fec1dff53223a Importing the module downloads and starts remote executable identified as malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAD-OOD: A Deep Learning Cluster-Driven Framework for an Out-Of-Distribution Malware Detection and Classification

Out of distribution OOD detection remains a critical challenge in malware classification due to the substantial intra family variability introduced by polymorphic and metamorphic malware variants. Most existing deep learning based malware detectors rely on closed world assumptions and fail to...

China-Aligned Threat Group Uses Windows Group Policy to Deploy Espionage Malware

A previously undocumented China-aligned threat cluster dubbed LongNosedGoblin has been attributed to a series of cyber attacks targeting governmental entities in Southeast Asia and Japan. The end goal of these attacks is cyber espionage, Slovak cybersecurity company ESET said in a report publishe...

Iranian APT ‘Prince of Persia’ Resurfaces With New Tools and Targets

SafeBreach reports the resurgence of the Iranian APT group Prince of Persia Infy. Discover how these state-sponsored hackers are now using Telegram bots and Thunder and Lightning malware to target victims globally across Europe, India, and Canada...

Kimsuky Spreads DocSwap Android Malware via QR Phishing Posing as Delivery App

The North Korean threat actor known as Kimsuky has been linked to a new campaign that distributes a new variant of Android malware called DocSwap via QR codes hosted on phishing sites mimicking Seoul-based logistics firm CJ Logistics formerly CJ Korea Express. "The threat actor leveraged QR codes...

ShadyPanda: The Silent Browser Takeover Threat and How Qualys TruRisk Eliminate Helps You Stop It

Executive Summary ShadyPanda has exploited trusted browser extensions to compromise millions of users, illustrating how legitimate software can unexpectedly become harmful. Qualys TruRisk Eliminate empowers organizations to identify risky behaviors, prioritize real threats, and eliminate maliciou...

New ClickFix Attack Uses Fake Browser Fix to Install DarkGate Malware

Researchers at Point Wild have discovered a new ClickFix attack campaign that tricks users into manually installing DarkGate malware via fake browser extension alerts. Learn how this attack bypasses security by using the Windows Run box and how you can stay safe...

Inside a purchase order PDF phishing campaign

A PDF named "NEW Purchase Order 52177236.pdf" turned out to be a phishing lure. So we analyzed the phishing script behind it. A customer contacted me when Malwarebytes blocked the link inside a “purchase order” email they had received. Malwarebytes blocked this ionoscloud.com subdomain When I...

GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads

A new campaign named GhostPoster has leveraged logo files associated with 17 Mozilla Firefox browser add-ons to embed malicious JavaScript code designed to hijack affiliate links, inject tracking code, and commit click and ad fraud. The extensions have been collectively downloaded over 50,000...

Quantum Machine Learning for Cybersecurity: A Taxonomy and Future Directions

The increasing number of cyber threats and rapidly evolving tactics, as well as the high volume of data in recent years, have caused classical machine learning, rules, and signature-based defence strategies to fail, rendering them unable to keep up. An alternative, Quantum Machine Learning QML, h...