Malicious code in navigator-fingerprint-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5cf3b70412cdf56ecfd84e0cc4a5e40cf0df3251985bc497e368e9dd1894c78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brogan-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 142de0f01ce74f3ba2a163121986af8504eb87ba0f598ca801d4a5144f4809b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hackmebankdkorrrevshell24hagain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5268d91870f7498c6893a2dbd5c8dbbd671d72d86b96a025bbc8d200058b4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v900 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b444ce60e2348e602dc655ad88d7db0e56e3c5f7b2678bfa26154dbab981222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v944 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e986a5513ac5c561457511a502b5f4ed3ca17162eeee6a5409504554abaff175 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v678 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fad5eff255e4aa8537a898867d022aa72241f3cc26872cb77e10c6c3c1b412ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed5dc2f9c9253a03084ea96ef0e33d683f1b50f994645ebf0b1222d459a48316 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internallib_v103 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e3b752512a57c4bf6c07b52c5160818bb4f65ac29c733e7b2e56947a61f36f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in builtin-pages-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3be644f30528e61fadc22a9526bbd5dc5460dedd27a297fe25b70ede89657a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Genymotion Desktop 代码问题漏洞

Genymotion Desktop is an Android emulator from Genymotion. A security vulnerability exists in Genymotion Desktop version 3.2.1, which stems from a missing profapi.dll, and can be exploited by an attacker to use a malicious dll with the same name and gain administrator privileges, as well as execu...

New Linux Cryptomining Malware

Its pretty nasty: The malware was dubbed "Shikitega" for its extensive use of the popular Shikata Ga Nai polymorphic encoder, which allows the malware to "mutate" its code to avoid detection. Shikitega alters its code each time it runs through one of several decoding loops that AT&T said each...

PersistenceSniper - Powershell Script That Can Be Used By Blue Teams, Incident Responders And System Administrators To Hunt Persistences Implanted In Windows Machines

PersistenceSniper is a Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. The script is also available on Powershell Gallery. --- The Why Why writing such a tool, you might ask. Well, for starters, I...

Malicious code in internallib_v216 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 144eaae99291d0024df31c1ab7bdeb913ed704c53fd44a57a52a40df3c21cffd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stealthy Linux Malware Shikitega Deploying Monero Cryptominer

By Deeba Ahmed The stealthy malware leverages security flaws to gain privilege escalation and establish persistence. This is a post from HackRead.com Read the original post: Stealthy Linux Malware Shikitega Deploying Monero Cryptominer...

Privilege Escalation

poetry is vulnerable to privilege escalation. The vulnerability exists because the getsystemenv function of env.py does not properly validate the absolute path in windows operating systems, allowing an attacker to inject and execute malicious code and steal the credentials or persist their access...

Microsoft Warns of Ransomware Attacks by Iranian Phosphorus Hacker Group

Microsoft's threat intelligence division on Wednesday assessed that a subgroup of the Iranian threat actor tracked as Phosphorus is conducting ransomware attacks as a "form of moonlighting" for personal gain. The tech giant, which is monitoring the activity cluster under the moniker DEV-0270 aka...

Malicious code in www-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0115c38278defb9aa6cc167113c9895685e34e978da37c1337e2bb278abf8050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in workbox-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8933e331d7e07ec6d6389f4a473479e2d306032d9d3b394d9243d7268c811270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Metasploit Weekly Wrap-Up

ICPR Certificate Management This week Metasploit has a new ICPR Certificate Management module from Oliver Lyak and our very own Spencer McIntyre, which can be utilized for issuing certificates via Active Directory Certificate Services. It has the capability to issue certificates which is useful i...

MuddyWater targets Israeli organizations by exploiting unpatched log4j vulnerabilities

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MuddyWater, an Iranian threat actor, exploits Log4j two vulnerabilities in SysAid applications to target Israeli organizations. As soon as the attacker gains access to the targeted organization, it...