Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

Cybersecurity researchers are calling attention to a new campaign dubbed JSSMUGGLER that has been observed leveraging compromised websites as a distribution vector for a remote access trojan named NetSupport RAT. The attack chain, analyzed by Securonix, involves three main moving parts: An...

APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains

A China-nexus threat actor known as APT24 has been observed using a previously undocumented malware dubbed BADAUDIO to establish persistent remote access to compromised networks as part of a nearly three-year campaign. "While earlier operations relied on broad strategic web compromises to...

MAL-2025-191867 Malicious code in siitoogether (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6fccd687f1acb55e6da0782b08ef14b3e8be5587dee4743a163a106c48390a50 Importing the module starts an RAT-like process capable of execute remote commands, with the C2 through Discord --- Category: MALICIOUS - The campaign has...

Dragon Breath Uses RONINGLOADER to Disable Security Tools and Deploy Gh0st RAT

The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT. The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers...

MAL-2025-191814 Malicious code in perfviewer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea912a2de677fa6d9ea6dbf9a792dace4d927efd46a5cb615ba8548fec4930e8 During installation, code downloads and starts an executable and a DLL library. After starting them, files are removed from the disk. The executable has been...

Malicious code in perfviewer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea912a2de677fa6d9ea6dbf9a792dace4d927efd46a5cb615ba8548fec4930e8 During installation, code downloads and starts an executable and a DLL library. After starting them, files are removed from the disk. The executable has been...

Malicious code in defeated-lavender-rat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85de9281ba5d27e75ea0a077a2a1957518f8fd3cdcee4945eab4b5ccbb558a17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117454

Malicious code in defeated-lavender-rat npm...

Malicious code in lonely_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5940cdc69922c74f8a72b326bc1cb189f38fed155b03dd50554ad9a8a93894ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dying_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59ce2e15bfd78f9987c1c83396d8ecec2e6e3fe163f0dd1ee7fac91ecc8633a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-98079

Malicious code in ideologicalratz3n npm...

Malicious code in previous_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fed1a58f1effb2f6b4d27d46bbd8e0d6f0d52945c7d1b2f3613d672f1a0c3e14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124760 Malicious code in absent_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03fc7830350046d3313cf9275495644d0c4ee39c14a496df150a41a20ad11793 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-95793

Malicious code in petiteratz3n npm...

EUVD-2025-104478

Malicious code in intermediateratz3n npm...

EUVD-2025-106505

Malicious code in awakeratz3n npm...

MAL-2025-120825 Malicious code in intermediate_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46753183cc17b505b57a1eea5e3cfbef4265da9b1a29c3065ca89e7477152e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-87412

Malicious code in zanyratz3n npm...

EUVD-2025-91060

Malicious code in intelligentratz3n npm...

Malicious code in intelligent_rat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265473608b233d80f7aa7340443247a70aa8bc73a2f653f7630c2989c2814d65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...