New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and maintain access to an Apple device even when the victim believes it is offline. The method "tricks the victim into thinking their device's Airplane Mode...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

Malicious code in nayan-te (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06f6ee2ffa57bdfffbdb60952fe84c9fa2131977939491b1427d6e64f16aadf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in progress-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7c85d0514dd6025ca318ffb0b25040d4c1ef626b00125f13d43ea506d3299 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in horaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a180f896e2dd432d2280836c5441fce0ad50a403d3c7f2e6340a91addaabf9b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cloudflare Tunnel increasingly abused by cybercriminals

Cloudflare Tunnel provides you with a secure way to connect your resources to Cloudflare without a publicly routable IP address. Cybercriminals are increasingly using this service to keep their activities from being detected. Cloudflare Tunnel, also known by its executable name, Cloudflared,...

Malicious code in web3tool.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faed7c123bad8fe9028fa029f7e4c108dbecc8242fe2905610b6946c29e11e71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethereum-cryptographyyy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb7593ecb796620e3c4b6e3e5b66e8e7efa0ddd8ce6cfab3c8e0cca35c62ce96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discordd.jss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8ba506117e7c7f49158ad840669844fa4e7893e715370eb8bc3fd032617dd36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2023-1691083477 Fix CVE(s): CVE-2021-25329, CVE-2022-23181, CVE-2020-9484

SECURITY UPDATE: Remote Code Execution via session persistence - debian/patches/CVE-2020-9484.patch: Improve validation of storage location when using FileStore. - CVE-2020-9484 SECURITY UPDATE: Fix for CVE-2020-9484 was incomplete - debian/patches/CVE-2021-25329-pre1.patch: Fix some edge cases...

Malicious code in hsisu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c986ceb6d450b915124305a19037997afedd7936b69467f557d17afd7182d27 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44e2fc216a94eece7f4dff23344c885f24361cb497ae18d6c7dde8ba3c4d39a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fca-tpk05-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68a464386cec91304cf1a2a774e200123d42ae944a6f03bb1b8c272c6d6b85e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ebtd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb50b8a351189eb3838b9913ca61e1c0b0c4269a04f5babe163cbe876380f77f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azuretestpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7deb9b5c64a12562c3e7da95ffdfda5b85dca927880cb96345033abab09d4f08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

STARK#MULE Targets Koreans with U.S. Military-themed Document Lures

An ongoing cyber attack campaign has set its sights on Korean-speaking individuals by employing U.S. Military-themed document lures to trick them into running malware on compromised systems. Cybersecurity firm Securonix is tracking the activity under the name STARKMULE. The scale of the attacks i...

Malicious code in grabathon-v8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c5d3c773c46d98a52b454f0e11ea84a072863fc1133b5012841efcc9739162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-26469 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 3.5.8.3 Kirby versions prior to 3.6.6.3 Kirby versions prior to 3.7.5.2 Kirby versions prior to 3.8.4.1 Kirby versions prior to 3.9.6 Description: The issue affects all Kirby sites with user accounts, unless Kirby's AP...

Decoy Dog: New Breed of Malware Posing Serious Threats to Enterprise Networks

A deeper analysis of a recently discovered malware called Decoy Dog has revealed that it's a significant upgrade over the Pupy RAT, an open-source remote access trojan it's modeled on. "Decoy Dog has a full suite of powerful, previously unknown capabilities – including the ability to move victims...

Malicious code in fca-innova (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae1d312610e319d7fb61e20452f0003de964afa226f8d6db19b7b40bb8f4af4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...