Malicious code in aot-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 387dbb36bb1161598fbfa2872fbf071892696c3a1df11c616ffa424495bacdb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-38696

ParsedReport ChatGPT Translated Autotext: TI Report Analyser + ChatGPT + Auto Translate ------ Группа компаний Belsen, действующая с января 2025 года, допустила утечку 1,6 ГБ данных с более чем 15 000 уязвимых устройств Fortinet из-за CVE-2022-406841, что указывает на постоянный доступ до взлома...

Metasploit Weekly Wrap-Up 09/19/2025

Consistently Persistent The Metasploit Framework has around 26 different modules which can be used to establish persistence on a target. Persistence modules help operators ensure they can maintain a consistent foothold within an environment once a target has been compromised and are quite helpful...

Yum Package Manager Persistence

This module will run a payload when the package manager is used. This module modifies a yum plugin to launch a binary of choice. grep -F 'enabled=1' /etc/yum/pluginconf.d/ will show what plugins are currently enabled on the system. root persmissions are likely required. Verified on Centos 7.1...

MAL-2025-47464 Malicious code in fast-proxies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80cd3bbfb200cc0af579901773019a1d152ff4adda7764bbae1b9516e38a11c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v915 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3514c2a5f4c17fc8f3a153f8c5601c0308a3dded83b19b0b6a387943c2425178 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Acacium-PostEx-Toolkit

Acacium Automated Post-Exploitation & Lateral Movement Toolkit...

CISA Warns of Two Malware Strains Exploiting Ivanti EPMM CVE-2025-4427 and CVE-2025-4428

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday released details of two sets of malware that were discovered in an unnamed organization's network following the exploitation of security flaws in Ivanti Endpoint Manager Mobile EPMM. "Each set contains loaders for maliciou...

MAL-2025-47449 Malicious code in another-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3fba9cc731c68608bf4548a514b4491220c23775767b250f6c1cc318584a843 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Service SystemD Persistence

This module will create a service on the box, and mark it for auto-restart. We need enough access to write service files and potentially restart services Targets: CentOS 7 Debian = 7, = 15 Ubuntu = 15.04 Verified on Ubuntu 18.04.3 Module Options msf use exploit/linux/persistence/initsystemd msf...

rc.local Persistence

This module will edit /etc/rc.local in order to persist a payload. The payload will be executed on the next reboot. Verified on Ubuntu 18.04.3 Module Options msf use exploit/linux/persistence/rclocal msf exploitrclocal show targets ...targets... msf exploitrclocal set TARGET msf exploitrclocal sh...

Init OpenRC Persistence

This module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write service files and potentially restart services. Verified against alpine 3.21.2 Module Options msf use exploit/linux/persistence/initopenrc msf exploitinitopenrc show targets...

Malicious code in kinyongi-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ea7b4bf7dc393083c0cf1a329515fe98ac756a468ace3d791c4b0f20d2448e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47368 Malicious code in zarabotok-na-obmenakh-bitkoinakh-d7rqlq46s (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47355f63c693d1d5d45df79f7b39eb6971b2643d2413ddf90d090ed6ba38f67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in transform-remove-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34def0802df34551bb9471a5204d7188e0b1d20db136c605b706bd98166df2d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47246 Malicious code in @morphodao/morpho-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb9bd67a4d3649cd1f46a3e877bdffb2ed879805fe1aa9817036dd56b887f414 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @openzeppelin-compact/fungible-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6a498e2883ed809f6b7d0b0fdd09f303aaf958af5a94634d835e001fdc4db78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pumpfun-sdk/bn-converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bcd5e8715873a001eadde3f34011c22ba27a599e02a712fde9f44036b62fb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sensay-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cb7ee6c9001f05dabc23897e95ab73cf8e80b296c65d848d3d31fa9b2b592ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47238 Malicious code in @fastifyv4/fastifyv4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7083057255001380bdd51cad61f09f708b1f711acee9a0f9c83f8ad4a6388201 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...