Malicious code in d5-es6-sass-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3090df994b516cfc30ee58cc5871282f61ebc4e378a73744fb779705e16a1a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Bandook RAT Variant Resurfaces, Targeting Windows Machines

A new variant of remote access trojan called Bandook has been observed being propagated via phishing attacks with an aim to infiltrate Windows machines, underscoring the continuous evolution of the malware. Fortinet FortiGuard Labs, which identified the activity in October 2023, said the malware ...

UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT

The threat actor known as UAC-0050 is leveraging phishing attacks to distribute Remcos RAT using new strategies to evade detection from security software. "The group's weapon of choice is Remcos RAT, a notorious malware for remote surveillance and control, which has been at the forefront of its...

Malicious code in @serenity-web/common-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca192112e75d572b4acfa46a40cbca00653059b1452b396d996396c27648ced Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

Security researchers have detailed a new variant of a dynamic link library DLL search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages...

Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware

By Mike Gentile, Asheer Malhotra and Vitor Ventura. Editors note: This blog post is a public version of a talk presented at LabsCon 2023 on Sept. 22, 2023. You can watch a recording of the talk here. Some of the intelligence presented at LabsCon was later confirmed by an Amnesty International blo...

TRST-M-8 from previous audit still present

Lines of code Vulnerability details Proof of Concept TRST-M-8 from previous audit describes the fact, that when repaying is paused, then pool still continue accruing interests. Usually this is not considered as a medium bug anymore. However, protocol team has stated, that they have fixed...

Malicious code in allianz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3acefcd666d8be4ff038f0b8b5999c4f2921bc275a04c9480e3cfcc95a190fca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paalni (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80fe310fa14b18a156e781ff55555ecf5c96db6a03102615f4a93d8e961db75a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Douglas-042 - Powershell Script To Help Speed ​​Up Threat Hunting Incident Response Processes

DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the meticulous collection of crucial evidence derived from both forensic artifacts and the ephemeral landscape of volatile data. Its fundamental mission revolve...

PT-2024-14633 · Linux +5 · Linux Kernel +5

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the Linux kernel, specifically with the f2fs file system. It needs to add a missing gcing flag on page during block migration to guarantee migrated data is...

DanaBot Stealer: Multistage MaaS Malware Resurfaces

Summary: DanaBot is a covert malware designed for the discreet theft of sensitive data for financial gain. Unlike ransomware, its focus is on prolonged persistence rather than immediate disruption. Functioning as a malware-as-a-service MaaS platform, DanaBot is versatile, targeting individuals,...

Cactus Ransomware Exploits Vulnerabilities in Qlik Sense

Summary: The Cactus ransomware is actively exploiting critical Qlik Sense vulnerabilities, with the ultimate goal of establishing persistence and enabling remote control, infiltrating corporate networks stealthily. This serves as a stark reminder that unpatched Qlik Sense instances are prime...

CVE-2023-40074

CVE-2023-40074 affects Google Android via a flaw in PersistableBundle.java (saveToXml): invalid data can cause local persistent denial of service without user interaction. Impacted component: Android framework (PersistableBundle.java). Exploitation is described as local; no in-the-wild exploitati...

PSA: Fake CVE-2023-45124 Phishing Scam Tricks Users Into Installing Backdoor Plugin

The Wordfence Threat Intelligence Team has recently been informed of a phishing campaign targeting WordPress users. The Phishing email claims to be from the WordPress team and warns of a Remote Code Execution vulnerability on the users site with an identifier of CVE-2023-45124, which is not...

Malicious code in requestlyx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b16c69c74c2cafa07703d192538599de6e5d1ebbf1323b4cd76366e26db58d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in coloureds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3f381cffa410c14f42e50fcebd0f587b105b4756f34b5a05912f38b84fdc798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vivo-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ddc60ba6935a3a4569ba5dec15c6cf00eb68779bc86d09178839c459ffb15de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DynastyPersist - A Linux Persistence Tool!

A Linux persistence tool! A powerful and versatile Linux persistence script designed for various security assessment and testing scenarios. This script provides a collection of features that demonstrate different methods of achieving persistence on a Linux system. Features 1. SSH Key Generation:...

Malicious code in tessa-npm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e612f6e8fb0bbb74366928dddf1b34e91f54e4bef8567591fae02dc94d22461e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...