Vietnamese Hackers Target U.K., U.S., and India with DarkGate Malware

Attacks leveraging the DarkGate commodity malware targeting entities in the U.K., the U.S., and India have been linked to Vietnamese actors associated with the use of the infamous Ducktail stealer. "The overlap of tools and campaigns is very likely due to the effects of a cybercrime marketplace,"...

CVE-2023-45814

CVE-2023-45814 affects Bunkum’s AuthenticationService token caching. The issue arises from caching ITokens and IUser relations after 4.0, causing a use-after-free when a cached token outlives a request and is later accessed (IToken.User) in subsequent requests. Red Hat/OSV/GHSA entries summarize ...

CVE-2023-45145

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...

A New XorDDoS Linux Trojan That Launches Powerful DDoS Attacks

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The XorDDoS Trojan, a Linux-based malware, orchestrates DDoS attacks through infected devices, with a recent campaign detected in 2023. Attackers employ scanning, persistence, and C2 infrastructure...

Malicious code in very-bad-npm-package2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a584dd679c45e7c26cb11a9996bf739b091a6bd7e73289844b51a3a48102a1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kempremium-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ce69947fee989e38a8cb1396ceaf8b70bd343327c511cf946c8c9f4a3f364d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @momo-miniapp/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6007d4e44cc4c068a9bb068cda01c272f184a9023da891b3f63737a50f814575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in situs-slot-gacor-slot-online-resmi-terbaik-mudah-menang-dan-maxwin-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed117fc0df745b25c18fac4374260486998e37259de0c6bdc83baab0df4a485a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

kernel: LoadPin bypass via dm-verity table reload

A flaw was found in the Linux kernel. Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module and firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out...

Malicious code in hyvee.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d097078bcb2a164d3761c80c52b4604ffd7e592ad363583f38e38192f542f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b198073a3c6c8c48eaa78a60790eebe24d1bce34d24bdcbba4e0f077f329c56b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-rebel-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b16fd5704b976681c8db55a38f76be6ba66ec571b41cc624d49b7a3f3c05aaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in corporate-delegate-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 177836844dbb30a41ac458ca968707ca386ae3dce8f06fc76b0cc7b9285a6518 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BunnyLoader: New Malware-as-a-Service Threat Emerges in the Cybercrime Underground

Cybersecurity experts have discovered yet another malware-as-a-service MaaS threat called BunnyLoader that's being advertised for sale on the cybercrime underground. "BunnyLoader provides various functionalities such as downloading and executing a second-stage payload, stealing browser credential...

Malicious code in imagery_export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ded43ce2e4a423411edd79212bce33e88313d38fa2930daa39e9a329ba99aa70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cm-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac624ff32f672028e8dca14a6a9207e93af47cde418a00eec1b1a8dbcae0baae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arcotest1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 729c32fc154769efa0f919edac30e00d9e8a63dc05f166d3a156924f939750f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Raise Red Flag on P2PInfect Malware with 600x Activity Surge

The peer-to-peer P2 worm known as P2PInfect has witnessed a surge in activity since late August 2023, witnessing a 600x jump between September 12 and 19, 2023. "This increase in P2PInfect traffic has coincided with a growing number of variants seen in the wild, suggesting that the malware's...

Malicious code in @zettle-bo/inventory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6262bbe576936f351b23ae859a7a6109329ac53866ece0189c1a9feee444159 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zettle-bo/account-statement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e421dbf9f81cc4fbfbcfb01be2a65fa8509eb33a2be27ee6aab920ca00359f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...