EUVD-2025-73180

Malicious code in undergroundwildebeestz3n npm...

Malicious code in underground_snail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e3975665f5ef1da9d7a3c1ae237fec2d5478ff04bd85fa2148f3b220f8fdfe0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-73181

Malicious code in undergroundsnailz3n npm...

EUVD-2025-73183

Malicious code in undergroundmammalz3n npm...

EUVD-2025-51400

Malicious code in underground-black-jellyfish npm...

EUVD-2025-51397

Malicious code in underground-tan-landfowl npm...

EUVD-2025-51396

Malicious code in underground-tomato-giraffe npm...

EUVD-2025-51399

Malicious code in underground-coral-crayfish npm...

EUVD-2025-51401

Malicious code in underground-amethyst-iguana npm...

EUVD-2025-51398

Malicious code in underground-ivory-mongoose npm...

MAL-2025-71252 Malicious code in underground-tan-landfowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8509cc110f018c24a34684c5420f29e8c875ce1fcc86e8e29e43e0abfbf7e5c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-56840

Malicious code in undergroundgazellez3n npm...

Inside Russian Market: Uncovering the Botnet Empire

Eliran Alon contributed to this post. Inside Russian Market: Key insights from Rapid7 threat research The online cybercrime marketplace, Russian Market, has evolved from selling Remote Desktop Protocol RDP access to becoming one of the most active underground hubs for information-stealing malware...

EUVD-2014-6796

Malware in sbrugna...

Inside the Nuclear Bunkers, Mines, and Mountains Being Retrofitted as Data Centers

Companies are going to great lengths to protect the infrastructure that provides the backbone of the world’s digital services—by burying their data deep underground...

Fake Madgicx Plus and SocialMetrics Extensions Are Hijacking Meta Business Accounts

Cybersecurity researchers have disclosed two new campaigns that are serving fake browser extensions using malicious ads and fake websites to steal sensitive data. The malvertising campaign, per Bitdefender, is designed to push fake "Meta Verified" browser extensions named SocialMetrics Pro that...

MAL-2025-18712 Malicious code in down-load-available-zip-now-9963-decemberunderground-v5ico-vdkxyl (npm)

The package down-load-available-zip-now-9963-decemberunderground-v5ico-vdkxyl was found to contain malicious code...

Jailbroken AIs are helping cybercriminals to hone their craft

Cybercriminals are bypassing the guardrails that are supposed to keep AI models from carrying out criminal activities, according to researchers. We've seen the misuse of AI models by cybercriminals growing rapidly over the past several years, shaping a new era of digital threats. Early on,...

The Dark Side of the Web: Towards Understanding Various Data Sources in Cyber Threat Intelligence

Cyber threats have become increasingly prevalent and sophisticated. Prior work has extracted actionable cyber threat intelligence CTI, such as indicators of compromise, tactics, techniques, and procedures TTPs, or threat feeds from various sources: open source data e.g., social networks, internal...

Black Basta: The Fallen Ransomware Gang That Lives On

After a series of setbacks, the notorious Black Basta ransomware gang went underground. Researchers are bracing for its probable return in a new form...