Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

MAL-2026-14163 Malicious code in axois-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69703c3a809c078834e321ae3777e144413bcef3d17ea7a712d6108f9ca34885 axois-http is a typosquat of axios index.js exports an empty object. Its scripts/postinstall.js unconditionally POSTs a JSON body containing a...

Malicious code in typescirpt-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09d82fa51e42e6766fe0819517e9fb5be633702a0e22cb4da05d8920cb413c53 The package's postinstall script scripts/postinstall.js XOR-decodes obfuscated byte arrays using the key 'stf2026' to reconstruct a download URL and ...

Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update

Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management RMM tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming...

OkoBot: new sophisticated malware framework targets cryptocurrency users

Introduction In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cryptocurrency wallet windows. During the investigation, we reconstructed the complete infection chain, which consisted of four tightly linked stages initiated by the execution of...

Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT

Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan RAT. The list of identified packages, is below - aes-decode-runner-pro 145 downloads postcss-minify-selector 256 downloads postcss-minify-selector-parser 615...

New Malware Campaign Delivers Remcos RAT Through Multi-Stage Windows Attack

Cybersecurity researchers have disclosed details of a new campaign dubbed SHADOWREACTOR that employs an evasive multi-stage attack chain to deliver a commercially available remote administration tool called Remcos RAT and establish persistent, covert remote access. "The infection chain follows a...

Fake Docusign, Gitcode Sites Spread NetSupport RAT via Multi-Stage PowerShell Attack

Threat hunters are alerting to a new campaign that employs deceptive websites to trick unsuspecting users into executing malicious PowerShell scripts on their machines and infect them with the NetSupport RAT malware. The DomainTools Investigations DTI team said it identified "malicious multi-stag...

Gamaredon campaign abuses LNK files to distribute Remcos backdoor

Cisco Talos is actively tracking an ongoing campaign targeting users in Ukraine with malicious LNK files, which run a PowerShell downloader, since at least November 2024. The file names use Russian words related to the movement of troops in Ukraine as a lure. The PowerShell downloader contacts...

New Botnet Malware 'Horabot' Targets Spanish-Speaking Users in Latin America

Spanish-speaking users in Latin America have been at the receiving end of a new botnet malware dubbed Horabot since at least November 2020. "Horabot enables the threat actor to control the victim's Outlook mailbox, exfiltrate contacts' email addresses, and send phishing emails with malicious HTML...

A deep dive into Saint Bot, a new downloader

This post was authored by Hasherezade with contributions from Hossein Jazi and Erika Noerenberg In late March 2021, Malwarebytes analysts discovered a phishing email with an attached zip file containing unfamiliar malware. Contained within the zip file was a PowerShell script masquerading as a li...

Threat Roundup for Jan. 11 to Jan. 18

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 11 and Jan. 18. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

sLoad Banking Trojan Downloader Displays Sophisticated Recon and Targeting

A new PowerShell downloader dubbed sLoad is making the rounds, sporting impressive reconnaissance tactics and a penchant for geofencing, which indicate increasing sophistication when it comes to targeting efforts. First spotted in May 2018, sLoad typically delivers the Ramnit banking trojan but h...

Suspicious Powershell Downloader

Many campaigns are known to use Powershell downloaders. A remote attacker could convince users to manually trigger their execution. This would allow the malicious code to run and infect the target system...