Amadey Exploiting Self-Hosted GitLab to Distribute StealC

Amadey Exploiting Self-Hosted GitLab to Distribute StealC By Rahul Sharma · December 18, 2025 Executive summary Amadey is a malware loader that has been active since 2018, primarily used to distribute second-stage payloads and infostealers. While Amadey has been previously known to distribute...

EUVD-2013-2218

Malware in sbrugna...

XCSSET evolves again: Analyzing the latest updates to XCSSET’s inventory

Microsoft Threat Intelligence has identified yet another XCSSET variant in the wild that introduces further updates and new modules beyond those detailed in our March 2025 blog post. The XCSSET malware is designed to infect Xcode projects, typically used by software developers, and run while an...

Wallet-Transaction-Monitor - This Script Monitors A Bitcoin Wallet Address And Notifies The User When There Are Changes In The Balance Or New Transactions

This script monitors a Bitcoin wallet address and notifies the user when there are changes in the balance or new transactions. It provides real-time updates on incoming and outgoing transactions, along with the corresponding amounts and timestamps. Additionally, it can play a sound notification o...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Design/Logic Flaw

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

Financially Motivated Threat Actor Strikes with New Ransomware and Clipper Malware

A new financially motivated campaign that commenced in December 2022 has seen the unidentified threat actor behind it deploying a novel ransomware strain dubbed MortalKombat and a clipper malware known as Laplas. Cisco Talos said it "observed the actor scanning the internet for victim machines wi...

MAL-2023-2328 Malicious code in tkcalendra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx dd65f2c94fec35121de0dd1448e48824d9236968ead1512d8474404e0d4a1806 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcaalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 954677803cf5ebe654bfd7eedd0a3164de3ac7c292e6f8d0c262c076f8b02728 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalenndar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3657f1c1724719566871bd93abb04097d923bd1485a87e9661f549a00afa9011 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalednar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2751263c8ef9db6ea790ea61f6c7150637a90527d732057cb54706619c31cca7 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 51218378709bfe987aadc08f4c49c00938dd166c52ea0f450de5b7ce9ba1289a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ttkcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fe53354ad712e586c9dd05c583a5f6e31f9c7aa60bda1acb85d395e821d97d0b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcaleendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8ab410b220be583d348a263f180ddcaa0b9794fc3995fdd3fb2ddf55b2235fa9 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkclaendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8482aeec6df4fd5b11c0ccc16cdcb42107ac5c5053c4e26c3222dcf1046c80ac Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalnedar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3278249ca47f04ae413f07499cdbb1ddb9ea1b2728b08f0dffa7259c44478190 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalenda (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 47294bc009264601d8c34f18129e45c68c683e173e598c3de0f5f9d588f67a88 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkclendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx daa307c663b502ed99e9d34dc61a7e3b50c947a5c31617b83d03d80b8bb47d30 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalndar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 97f2fbf0c526a8a5a70f9b66203d24286822ccfb24dfe5cdaf97457544d460af Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkaclendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 77558c43a8d14976fec11eac2bf9b9c3b93bef536b21e6c90c0a41c80754a317 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...