Malicious code in bad-spy-shell-report-assert (npm)

The package bad-spy-shell-report-assert was found to contain malicious code...

MAL-2025-15329 Malicious code in bad-spy-shell-report-assert (npm)

The package bad-spy-shell-report-assert was found to contain malicious code...

MAL-2025-22254 Malicious code in hash-spy-mock-web-sed (npm)

The package hash-spy-mock-web-sed was found to contain malicious code...

Malicious code in bundle-shell-hash-spy-import (npm)

The package bundle-shell-hash-spy-import was found to contain malicious code...

Malicious code in beta-epsilon-unix-emulate-spy (npm)

The package beta-epsilon-unix-emulate-spy was found to contain malicious code...

Malicious code in hash-spy-mock-web-sed (npm)

The package hash-spy-mock-web-sed was found to contain malicious code...

MAL-2025-28369 Malicious code in optimize-sudo-spy-omega-error (npm)

The package optimize-sudo-spy-omega-error was found to contain malicious code...

MAL-2025-16343 Malicious code in bundle-shell-hash-spy-import (npm)

The package bundle-shell-hash-spy-import was found to contain malicious code...

MAL-2025-15612 Malicious code in beta-epsilon-unix-emulate-spy (npm)

The package beta-epsilon-unix-emulate-spy was found to contain malicious code...

Malicious code in optimize-sudo-spy-omega-error (npm)

The package optimize-sudo-spy-omega-error was found to contain malicious code...

MAL-2025-29316 Malicious code in pipe-float-mu-spy-table (npm)

The package pipe-float-mu-spy-table was found to contain malicious code...

MAL-2025-31294 Malicious code in quick-code-balance-spy-java (npm)

The package quick-code-balance-spy-java was found to contain malicious code...

MAL-2025-33833 Malicious code in spy-promise-pi-decode-cold (npm)

The package spy-promise-pi-decode-cold was found to contain malicious code...

SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play

Update 25.06.2025: Apple removed the malicious app from the App Store. In January 2025, we uncovered the SparkCat spyware campaign, which was aimed at gaining access to victims' crypto wallets. The threat actor distributed apps containing a malicious SDK/framework. This component would wait for a...

CVE-2023-2490

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Fernando Briano UserAgent-Spy plugin = 1.3.1 versions...

CVE-2005-1097

Rebrand P2P Share Spy 2.2 stores the user password in plaintext in the txtPassword value in the registry, which allows local users to gain privileges...

A week in security (April 7 – April 13)

Last week on Malwarebytes Labs: The Pall Mall Pact and why it matters Child predators are lurking on dating apps, warns report Your 23andMe genetic data could be bought by China, senator warns WhatsApp for Windows vulnerable to attacks. Update now! Man accused of using keylogger to spy on...

Trump’s Spy Chief Urged to Declassify Details of Secret Surveillance Program

Tulsi Gabbard, the director of national intelligence, has long held anti-surveillance views. Now she oversees a key surveillance program she once tried to dismantle...

Secret Phone Surveillance Tech Was Likely Deployed at 2024 DNC

Data WIRED collected during the 2024 Democratic National Convention strongly suggests the use of a cell-site simulator, a controversial spy device that intercepts sensitive data from every phone in its range...

The Untold Story of Trump's Failed Attempt to Overthrow Venezuela's President

A successful CIA hack of Venezuela's military payroll system, insider fights for spy agency resources, and messy opposition politics: A WIRED investigation reveals a secret Trump-era attempt to oust autocratic ruler Nicolás Maduro...