Trojanized npm Packages Deploy AI-Powered RedC2 4.0 Linux Backdoor
Researchers identified 14 malicious npm packages that deploy RedC2 4.0, an AI-assisted Linux backdoor, leveraging open-source supply chain compromise for stealthy persistence.
Category
Malware
39 published analyses.
Hackers Compromise Rust Crate to Deliver Infostealer Malware
Attackers compromised the maintainer account of the Rust crate arrayref to inject malware that executes on developer systems during compilation, risking exposure of sensitive data.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
Clop Gang Uses Custom Web Shell for Targeted Windchill Data Theft
The Clop ransomware group developed a custom Java web shell targeting PTC Windchill and FlexPLM servers, enabling credential decryption, file enumeration, and data theft.
Uncovering MacSync Stealer Infrastructure via Behavioral Pivots
MacSync Stealer evades detection by rapidly rotating domains, but Microsoft identified over 30 related domains by analyzing consistent behavioral patterns to uncover its infrastructure.
AmnesiaStealer macOS Malware Hijacks Browsers via Remote Control
AmnesiaStealer is new macOS malware that hijacks browser sessions through remote control, enabling attackers to steal data interactively.
New Evooo1Bot Linux Botnet Turns Routers into Traffic Relays
Evooo1Bot is a new Mirai-based Linux botnet targeting internet-facing routers to convert them into SOCKS5 traffic relay nodes, expanding attack surfaces.
Akira ransomware disables EDR via Safe Mode, steals data but no encryption
An Akira ransomware affiliate bypassed endpoint detection by rebooting the infected system into Safe Mode with Networking to disable the EDR solution, stealing data without encrypting files.
Hundreds of Fake Chrome VPN Extensions Route Traffic Through Proxy
Over 737 fake VPN and proxy extensions on the Chrome Web Store routed user traffic through SOCKS5 proxies controlled by a single entity, posing serious privacy and security risks.
Malicious LiteLLM Releases Linked to Trivy Hack Expose 2,100+ Orgs
Two malicious LiteLLM packages on PyPI in March contained credential-stealing code that potentially exposed over 2,100 organizations by capturing cloud and system secrets.
DeadLock ransomware uses decentralized infrastructure for extortion
Microsoft Threat Intelligence analyzes DeadLock ransomware, a Rust-based encryptor that employs decentralized victim communication and negotiation infrastructure alongside double extortion tactics.
#StopRansomware: Emerging Gunra Ransomware Threat
Gunra ransomware, a double-extortion RaaS exploiting VPN and RDP vulnerabilities, threatens government and critical infrastructure with data encryption and leaks.
Nearly 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
A campaign distributing nearly 800 malicious npm packages with typo-squatted AI-generated names delivers a powerful RAT and infostealer targeting Windows, Mac, and Linux environments, posing a significant threat to developers and enterprises using npm packages.
Attackers Use Oracle SQL Injection to Compile Khunt Toolkit for SYSTEM Access
An Oracle database SQL injection vulnerability was exploited to compile and run the Khunt post-exploitation toolkit entirely within the database engine, avoiding writing executables to disk.
Inside the Keyv/Cacheable npm Token Worm: Why Not to Revoke Tokens Yet
A compromise affecting the Keyv and Cacheable npm packages is leading to reconsideration of token revocation policies due to an active malware that triggers upon premature token revocation.
ChainDrop Malware Infects 1,300+ npm Packages in Supply-Chain Attack
The ChainDrop malware has compromised over 1,300 npm packages, impacting software supply chain security with billions of downloads monthly.
Greatness PhaaS Adds Device Code Phishing to Bypass MFA and Steal Tokens
The Greatness phishing-as-a-service toolkit now uses device code phishing to exploit OAuth 2.0 Device Authorization Grant, bypassing MFA and hijacking accounts.
DOUBLECUP ClickFix Service Hides Malware in Browser Cache Images
The DOUBLECUP loader uses ClickFix attacks to embed malware within PNG images cached by browsers on Windows and macOS, complicating detection.
INC Ransomware Exploits SonicWall SMA 1000 Vulnerabilities
INC Ransomware is exploiting vulnerabilities in SonicWall SMA 1000 VPN devices, leading to increased attacks and multiple victims listed on its data leak site.
Adform's Ad Script Compromised to Steal Cryptocurrency via Clipboard Hijack
Adform's advertising scripts were compromised in a supply-chain attack that hijacks clipboard cryptocurrency addresses to redirect funds to attackers.
Microsoft Teams Vishing Attacks Deploy Chaos Ransomware in North America
Attackers use vishing via Microsoft Teams to impersonate IT support and deploy Chaos ransomware targeting organizations in North America through social engineering.
SourTrade Malvertising Uses Browser to Assemble Malware Executable
A malvertising campaign named SourTrade targets retail traders by using browsers and a legitimate Bun runtime to assemble Windows malware executables, evading traditional detection methods.
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
CERT-UA has identified a campaign where a fake Notepad++ plugin delivers MATCHBOIL.V2 malware, linked to the Russia-aligned UAC-0099 threat group targeting Windows systems.
Fake Claude app promoted via Bing ads spreads SectopRAT malware
A malvertising campaign on Bing promotes a fake Claude desktop app from a legitimate domain to deliver SectopRAT malware, posing a threat to affected systems.
FakeGit Campaign Uses 7,600 GitHub Repos to Spread SmartLoader Malware
Nearly 7,600 malicious GitHub repositories were discovered distributing the SmartLoader malware, leveraging cloned projects and fake profiles to deceive users.
NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
The NadMesh Go botnet targets exposed AI services to harvest over 3,800 unique AWS keys, threatening cloud and Kubernetes environments.
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Seven malicious npm packages in the Vite ecosystem use a four-tier blockchain-based command-and-control infrastructure to deploy RAT malware, expanding the ChainVeil supply chain threat.
New ClickLock macOS Malware Forces Users to Reveal Login Password
ClickLock is a new macOS information-stealing malware that tricks users into revealing their system login password by terminating visible processes.
New OkoBot framework deploys 20 payloads targeting crypto and data theft
The OkoBot malware framework deploys more than 20 payloads aimed at stealing cryptocurrency wallet seed phrases, credentials, and sensitive data, posing a notable threat to individuals and enterprises.
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Researchers revealed TuxBot v3 Evolution, an IoT botnet framework apparently developed with help from a large language model, highlighting emerging AI-assisted malware creation risks.
Nearly 300 Fake GitHub Repos Distribute Infostealer Malware
A threat actor created almost 300 counterfeit GitHub repositories impersonating legitimate software projects to deliver infostealer malware, posing a significant supply chain threat.
Hackers Backdoor Jscrambler npm Package with Infostealer Malware
A malicious version of the Jscrambler npm package containing infostealer malware was published and downloaded nearly 1,500 times, posing risks to developers and users of this client-side security tool.
Compromised jscrambler npm Release Installs Rust Infostealer
The jscrambler npm package version 8.14.0 was compromised to install a Rust-based infostealer via a preinstall hook, impacting Windows, macOS, and Linux environments.
Exposed Server Reveals WP-SHELLSTORM Backdoor Targeting 1.4M WordPress Sites
A hacker group's exposed server revealed tools, logs, and a target list of over 1.4 million WordPress sites, exposing a large-scale WordPress backdoor campaign.
Injective SDK on npm infected with cryptocurrency wallet stealer
Hackers compromised the Injective Labs SDK GitHub repository to publish a malicious npm package that steals cryptocurrency wallet private keys and seed phrases. This malware poses a direct threat to developers and users managing crypto assets.
Microsoft Uncovers GigaWiper Backdoor Combining Disk Wiping and Spyware
Microsoft has analyzed a new Windows backdoor called GigaWiper that merges three destructive tools: full disk wiping, Windows drive overwriting, and fake ransomware that scrambles files without saving keys. This modular malware gives operators multiple ways to disrupt or destroy infected machines.
New Ghost Phishing Wave Evades Traditional Email Security
A new EvilTokens campaign uses ghost phishing to bypass traditional email security by hiding malicious pages until decrypted inside a victim’s browser. This poses high risk to businesses using Microsoft 365 and handling sensitive data.
Fake IT Support Calls on Microsoft Teams Spread EtherRAT Malware
Threat actors are impersonating IT support via Microsoft Teams voice calls to trick employees into installing EtherRAT malware, compromising corporate networks. This tactic enables attackers to gain initial access and conduct further intrusion.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Attackers compromised ShapedPlugin's build pipeline to inject backdoor code into Pro plugins via official update channels. This supply chain attack puts thousands of WordPress sites at risk of remote exploitation.