43058 matches found
GHSA-X5VX-C2C8-M3W9
creationtimestamp| type| source ---|---|--- 2026-07-27 19:20:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmis3k5v2n...
GHSA-35Q8-9MJ6-WJMF
creationtimestamp| type| source ---|---|--- 2026-07-27 19:18:57+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmfzh6ff2o...
MAL-2026-11102 Malicious code in riskunifiedgatewayserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...
MAL-2026-11095 Malicious code in @array-util/subsearch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...
Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...
A week in security (July 20 – July 26)
Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...
Malicious code in edu-npm-helper-alpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48359fa2dbbcd9c21e22de20140343078cd697b1bdfa5f3c59ce5ee77b4865b0 No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this package version. Nothing i...
MAL-2026-11083 Malicious code in edu-npm-helper-beta (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7f857929420503555e28dd3c702b2f60cbd705fd7be4a15009fc0536646978 No suspicious behaviors were identified in this package version. There is no evidence of install-time network activity, lifecycle scripts performing...
Malicious code in txs-sdk-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...
Malicious code in sixbails (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91338e6d735e538b7defb669e5b213cad127a9fd64290fa32d83bb855dcf9bd sixbails is a WhatsApp Web library Baileys-family fork. On every socket creation — the package's primary documented API — a 5-second timer fires...
Malicious code in amanexzyra-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...
Malicious code in fazzgram (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8799da09b9c2cf933d99463789c230da7d238000ba0fde0b311a4050353a6ead fazzgram is a Telegram Bot API wrapper. Supporting modules ApiClient.js, Dispatcher.js, LongPoller.js, WebhookServer.js, Context.js, Markup.js are...
GHSA-GPFC-H59V-63CV
creationtimestamp| type| source ---|---|--- 2026-07-25 17:51:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrigld2ef32d...
MAL-2026-11050 Malicious code in discordnv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f79139609558d677545faa7d5f1d30ec31a54abe9fba990117ec0d27ea3ba48 On import discordnv, init.py invokes mainentry which hides the console window, walks Discord/Chrome/Edge/Brave/Opera/Yandex/Firefox LevelDB/SQLite...
MAL-2026-11054 Malicious code in app-node-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...
MAL-2026-11052 Malicious code in app-data-layer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc306d8463afd4c0baadf4af1627986a5cb136d516c71415957fa606150008bd Analysis of [email protected] 3 files scanned produced no static or traced findings. No lifecycle hooks fetching or executing remote content, no...
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff ha...
EUVD-2026-48533
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...
CVE-2026-49744
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow privilege escalation which escapes...