Malicious code in esqgameencodereplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a52a247b3876e80074ffdc24a1731191f9a280dcccbba73c0090e5f2aeac4ac2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2868 Malicious code in esqgameencodereplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a52a247b3876e80074ffdc24a1731191f9a280dcccbba73c0090e5f2aeac4ac2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libpipultravirtual (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7fcc0ea3b75f3b40abcfb64156cfe1244cf729c1511a1e325ca450c73a7ee9f4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4330 Malicious code in libpipultravirtual (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7fcc0ea3b75f3b40abcfb64156cfe1244cf729c1511a1e325ca450c73a7ee9f4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts

Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensio...

New Version of ViperSoftX Malware Targets Password Managers and Cryptocurrency Wallets

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary ViperSoftX is an information-stealing malware primarily targeting cryptocurrencies, using sophisticated encryption techniques and monthly changes in command-and-control servers to evade detection. To...

Upgraded Q -> 2 from #882 [1683052810426]

Judge has assessed an item in Issue 882 as 2 risk. The relevant finding follows: Attacker can front-run create to steal tokens sent to predetermined address --- The text was updated successfully, but these errors were encountered: All reactions...

Google Gets Court Order to Take Down CryptBot That Infected Over 670,000 Computers

Google on Wednesday said it obtained a temporary court order in the U.S. to disrupt the distribution of a Windows-based information-stealing malware called CryptBot and "decelerate" its growth. The tech giant's Mike Trinh and Pierre-Marc Bureau said the efforts are part of steps it takes to "not...

MAL-2023-2475 Malicious code in pyautodllxd (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f459717e35091f9518335b31c67eaf3dd9c6033679b4b24572e7f32c8669c8c9 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

New Zaraza Bot Malware Steals Login Credentials from 38 Web Browsers via Telegram

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary A new credential-stealing malware named Zaraza bot uses Telegram as its command and control, targeting 38 web browsers and exfiltrating sensitive data for potential identity theft and financial fraud. To...

Campcodes Advanced Online Voting System SQL Injection Vulnerability (CNVD-2023-29416)

Campcodes Advanced Online Voting System is an online voting system. A SQL injection vulnerability exists in Campcodes Advanced Online Voting System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the parameter id of the file /admin/positionsdelete.php...

New Zaraza Bot Credential-Stealer Sold on Telegram Targeting 38 Web Browsers

A novel credential-stealing malware called Zaraza bot is being offered for sale on Telegram while also using the popular messaging service as a command-and-control C2. "Zaraza bot targets a large number of web browsers and is being actively distributed on a Russian Telegram hacker channel popular...

Crypto-Stealing OpcJacker Malware Targets Users with Fake VPN Service

A piece of new information-stealing malware called OpcJacker has been spotted in the wild since the second half of 2022 as part of a malvertising campaign. "OpcJacker's main functions include keylogging, taking screenshots, stealing sensitive data from browsers, loading additional modules, and...

GHSA-7R35-CHV4-XR3R Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

WstEth slippage and fee stealing

Lines of code Vulnerability details Impact The WstEth derivative contract calculates the maximum slippage for buying WstEth from curve pool by using the current price in the pool at runtime, without considering the price at which the user submitted the transaction to the mempool: uint256 minOut =...

Trojanized TOR Browser Installers Spreading Crypto-Stealing Clipper Malware

Trojanized installers for the TOR anonymity browser are being used to target users in Russia and Eastern Europe with clipper malware designed to siphon cryptocurrencies since September 2022. "Clipboard injectors ... can be silent for years, show no network activity or any other signs of presence...

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

A malicious Python package on the Python Package Index PyPI repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware. The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and...

Malicious Python Package Uses Unicode Trickery to Evade Detection and Steal Data

A malicious Python package on the Python Package Index PyPI repository has been found to use Unicode as a trick to evade detection and deploy an info-stealing malware. The package in question, named onyxproxy, was uploaded to PyPI on March 15, 2023, and comes with capabilities to harvest and...

Mispadu Targets Latin America with MalSpamming

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Mispadu has been linked to various spam campaigns, and it is capable of stealing both monetary and credential information while acting as a backdoor through keystroke and screenshot capture. To receive...

Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware

The NuGet repository is the target of a new "sophisticated and highly-malicious attack" aiming to infect .NET developer systems with cryptocurrency stealer malware. The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down. "The packages...