CVE-2016-10979

The CVE-2016-10979 entry concerns the fossura-tag-miner WordPress plugin prior to version 1.1.5, which is vulnerable to Cross-Site Scripting (XSS). Root cause is an XSS flaw in the plugin that could affect site users; the vulnerability is documented across multiple sources (NVD, Red Hat and CVE l...

CVE-2016-10978

CVE-2016-10978 affects the fossura-tag-miner WordPress plugin (pre-1.1.5). The connected documents consistently describe a CSRF vulnerability in this plugin. Public details confirm the affected product and vulnerability class, but do not provide further exploit vectors, affected platforms beyond ...

CVE-2016-10978

The fossura-tag-miner plugin before 1.1.5 for WordPress has CSRF...

Cryptocurrency miners aren’t dead yet: Documenting the voracious but simple “Panda”

By Christopher Evans and David Liebenberg. Executive summary A new threat actor named "Panda" has generated thousands of dollars worth of the Monero cryptocurrency through the use of remote access tools RATs and illicit cryptocurrency-mining malware. This is far from the most sophisticated actor...

A week in security (August 12 – 18)

Last week on Malwarebytes Labs, we took a look at the potential pitfalls of facial recognition technology, looked at ways domestic abuse survivors can secure their data, and explored the education threat landscape. We also kicked off a series looking at the Hidden Bee infection chain, and put...

This Week in Security News: Unpatched Systems and Lateral Phishing

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about an attack against Elasticsearch that delivers backdoors as its payload. Additionally, read how cybercriminals are turning to...

GreenFlash Sundown exploit kit expands via large malvertising campaign

Exploit kit activity has been relatively quiet for some time, with the occasional malvertising campaign reminding us that drive-by downloads are still a threat. However, during the past few days we noticed a spike in our telemetry for what appeared to be a new exploit kit. Upon closer inspection ...

This Cryptomining Malware Launches Linux VMs On Windows and macOS

Cybersecurity researchers from at least two firms today unveiled details of a new strain of malware that targets Windows and macOS systems with a Linux-based cryptocurrency mining malware. It may sound strange, but it's true. Dubbed "LoudMiner " and also "Bird Miner, " the attack leverages...

LoudMiner Cryptominer Uses Linux Image and Virtual Machines

An unusual cryptocurrency miner, dubbed LoudMiner, is spreading via pirated copies of Virtual Studio Technology. It uses virtualization software to mine Monero on a Tiny Core Linux virtual machine – a unique approach, according to researchers. Virtual Studio Technology VST is an audio plug-in...

New Mac cryptominer Malwarebytes detects as Bird Miner runs by emulating Linux

A new Mac cryptocurrency miner Malwarebytes detects as Bird Miner has been found in a cracked installer for the high-end music production software Ableton Live. The software is used as an instrument for live performances by DJs, as well as a tool for composing, recording, mixing, and mastering. A...

Millions of Linux Servers Under Worm Attack Via Exim Flaw

A widespread campaign is exploiting a vulnerability in the Exim mail transport agent MTA to gain remote command-execution on victims’ Linux systems. Researchers say that currently more than 3.5 million servers are at risk from the attacks, which are using a wormable exploit. Specifically under...

This Week in Security News: Gray Alerts and Wormable Malware

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn about the new wormable malware that’s dropping a Monero miner in web servers, networks and removable drivers. Also, read about the bes...

Malicious Package

blubird is a malicious package. It contains a malware that attempts to start a cryptocurrency miner using coin-hive...

Malicious Package

commqnder is a malicious package. It contains a malware that attempts to start a cryptocurrency miner using coin-hive...

Malicious Package

epress is a malicious package. It contains a malware that attempts to start a cryptocurrency miner using coin-hive...

Malicious Package

Overview Version 4.13.2 of epress contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. Recommendation Remove the package...

Malicious Package

Overview All versions of commqnder contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. Recommendation Remove the package...

Malicious Package

Overview All versions of commmander contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. Recommendation Remove the packag...

Malicious Package

Overview Version 3.5.0 of blubird contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. Recommendation Remove the package...

Hidden Bee: Let’s go down the rabbit hole

Some time ago, we discussed the interesting malware, Hidden Bee. It is a Chinese miner, composed of userland components, as well as of a bootkit part. One of its unique features is a custom format used for some of the high-level elements this format was featured in my recent presentation at SAS...