MAL-2025-191736 Malicious code in fuckyoubitchbro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fbbf1ade5d81c12afb87a44117b27f76d2e4bfa91b578fc50dfb44a8bb79cabe Importing the module downloads and executes widely recognized malware --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

CVE-2023-44124

The vulnerability is to theft of arbitrary files with system privilege in the Screen recording "com.lge.gametools.gamerecorder" app in the "com/lge/gametools/gamerecorder/settings/ProfilePreferenceFragment.java" file. The main problem is that the app launches implicit intents that can be...

Malicious code in discord-thief (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0b4c85a4b5478113229ff17c639c2b736cf81818af47484ac67acc5d1e5bcb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2493 Malicious code in discord-thief (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0b4c85a4b5478113229ff17c639c2b736cf81818af47484ac67acc5d1e5bcb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

What is fileless malware?

Unlike traditional malware, which relies on a file being written to a disk, fileless malware is intended to be memory resident only, ideally leaving no trace after its execution. The malicious payload exists in the computer’s memory, which means nothing is ever written directly to the hard drive...

Twitch Gets Gutted: All Source Code Leaked

An attacker claims to have ransacked Twitch for everything it’s got, including all of its source code and user-payout information. 100621 14:23 UPDATE: Twitch has confirmed the breach. According to Video Games Chronicle VGC, which first reported the assault on the interactive live-streaming...

Microsoft Teams Users Under Attack in 'FakeUpdates' Malware Campaign

Attackers are using ads for fake Microsoft Teams updates to deploy backdoors, which use Cobalt Strike to infect companies’ networks with malware. Microsoft is warning its customers about the so-called “FakeUpdates” campaigns in a non-public security advisory, according to a report in Bleeping...

Taurus Project stealer now spreading via malvertising campaign

For the past several months, Taurus Project—a relatively new stealer that appeared in the spring of 2020—has been distributed via malspam campaigns targeting users in the United States. The macro-laced documents spawn a PowerShell script that invokes certutil to run an autoit script ultimately...

Impost3r - A Linux Password Thief

Impost3r is a tool that aim to steal many kinds of linux passwordsincluding ssh,su,sudo written by C. Attackers can use Impost3r to make a trap to steal the legal user's passwords XD This tool is limited to security research and teaching, and the user bears all legal and related responsibilities...

Adamantium-Thief - Decrypt Chromium Based Browsers Passwords, Cookies, Credit Cards, History, Bookmarks

Get chromium browsers: passwords, credit cards, history, cookies, bookmarks. Chrome 80 is supported! Examples: Getpasswords from browsers: Stealer.exe PASSWORDS Get credit cards from browsers: Stealer.exe CREDITCARDS Get history from browsers: Stealer.exe HISTORY Get bookmarks from browsers:...

Domen toolkit gets back to work with new malvertising campaign

Last year, we documented a new social engineering toolkit we called "Domen" being used in the wild. Threat actors were using this kit to trick visitors into visiting compromised websites and installing malware under the guise of a browser update or missing font. Despite being a robust toolkit, we...

You've Been Served…with Subpoena-Themed Phishing Emails

A phishing campaign claiming to deliver emailed subpoenas is targeting insurance and retail companies. According to researchers, the phishing emails are spoofing the UK Ministry of Justice, aiming to capitalize on scare tactics to convince targets to click on an embedded link to “learn more about...

thief-thecircle.com XSS vulnerability

Open Bug Bounty ID: OBB-681205 Description| Value ---|--- Affected Website:| thief-thecircle.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

An Android App for RFID Card Cloning: Project Walrus

Walrus is an Android app that simplifies using several existing contactless card cloning devices during red team engagements and physical security assessments. It offers a common interface and database for storing cloned cards. Currently, Walrus supports the industry standard Proxmark 3, Chameleo...

Article on the DAO Ethereum Hack

This is good...

Streets of Crime: Car thief 3D - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Streets of Crime: Car thief 3D published at the 'play' market has multiple vulnerabilities...

Police vs Thief 2 - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Police vs Thief 2 published at the 'play' market has multiple vulnerabilities...

Amazing Thief - Dangerous filesystem permissions, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Amazing Thief published at the 'play' market has multiple vulnerabilities...

Blocky Cop Craft Running Thief - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Blocky Cop Craft Running Thief published at the 'play' market has multiple vulnerabilities...

How to Freeze Credit Report To Protect Yourself Against Identity Theft

If your Social Security number gets hacked in any data breaches, including recently hacked T-Mobile, then there's a way to prevent hackers from misusing your identity i.e. identity theft. The solution here is that you can institute a security freeze at each of the three credit bureaus, Equifax,...