Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. Despite the fact that they began their activities years ago, this group is generally unknown and, as far as we know, has not been publicly described. We...

Shortfall.sol#placeBid does not limit the bid spread

Lines of code Vulnerability details Impact Shortfall.solplaceBid does not limit the bid spread. The attacker can increase the price by a small amount each time causing the auction to never stop. Proof of Concept Tools Used manual Recommended Mitigation Steps limit the bid spread Assessed type DoS...

Fake ChatGPT Chrome Browser Extension Caught Hijacking Facebook Accounts

Google has stepped in to remove a bogus Chrome browser extension from the official Web Store that masqueraded as OpenAI's ChatGPT service to harvest Facebook session cookies and hijack the accounts. The "ChatGPT For Google" extension, a trojanized version of a legitimate open source browser add-o...

Malicious code in tpstudyed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e23727ae8a6fc41ea3192f6364598d22b82aa7e1f285f40cfc9cb7baedda86a8 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libmineurl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ee5b64de705122b5e4c366fad9b7d00ad56081a9a41e34b18897bdd017782c69 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in controlinfo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx add0337d581c81cb06395f282484be5917044fbe6fb5279a558a46ecaad6cd8b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tkcallendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 091da316c04a67c06230fcacc589735925c578c581ac5e4b53f9559824035fca Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in prmopt-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0ee7ba5aaf4be0952abc2bada752ea586dd24ffc7cd0fe61f5d852f7273f08b2 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in pompt-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1261c75a8d1e3798424e001e837db3aa3146f10d5c703718cc3d3237ea5b4024 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in prgressbar2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a4b129eb541c6ba1a0ccbdc53334cf0fe053213a195e9d367e5b7a53e858fcbe Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in discord-pyy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9869f3d7c02f8a1bd504488383320d5f53673ba85736a29539ae724087554b8e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in requests-toolbel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6dff3acc478e29fb226d2b2a892894caca51e8d4610740924f57f0ce29e1b561 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in wbsocket-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4dcded1c53684bce57c002b2ecaa2fc51c27dbe293f10ab57646a5f9685b7897 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in aihottp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98a22867b0350be05e9b2f1550e61cce611a5e74b5c65c5be1542cdcbd0c2967 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in pyinstallr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f2b04dc5f801036e2b2232284cac00ae9947d9430365a95aec226804aa88d11a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in beaautifulsoup4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6b67a3077288d17085e0b781a1b2ed20206e933e94ed94a93ab84f1afe27f9f0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in crryptofeed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ab28b3e1b30f47acf85d6725cf066084210c527777d43730693bbdcc0ba3ad2c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

The Menace of TrickGate Packer-as-a-Service Spreading Malware Globally

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary TrickGate has bundled several of the most well-known top-distribution malware families, including Trickbot, Maze, Emotet, REvil, CoinMiner, Cobalt Strike, Formbook, Remcos, AgentTesla, and many others...

NeedleDropper malware leverages a memory corruption flaw in Microsoft to disseminate

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new dropper strain dubbed NeedleDropper is used to distribute multiple malware families. The dropper attempts to obfuscate by dumping numerous useless, invalid files and storing critical data within...

Russian Turla Hackers Hijack Decade-Old Malware Infrastructure to Deploy New Backdoors

The Russian cyberespionage group known as Turla has been observed piggybacking on attack infrastructure used by a decade-old malware to deliver its own reconnaissance and backdoor tools to targets in Ukraine. Google-owned Mandiant, which is tracking the operation under the uncategorized cluster...