11 casos · pág. 1/1
Symantec's Threat Hunter Team reports that new versions of the Aoki infostealer now target credential and session files used by AI coding assistants. Earlier versions focused on browser, cryptocurrency wallet and password manager data. Aoki is a relatively new and sparsely documented stealer, first observed earlier in 2026, and its AI-rel…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …
In September 2026, researchers reported an attack that began inside a live AI coding assistant session at a software company. The attacker gained control of a developer's session, and the assistant recommended a PyPI package that looked normal. The developer installed it, and a hidden infostealer took source code, repository secrets and h…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
A vendor-sponsored analysis by Exaforce (published on bleepingcomputer.com) says attackers are enumerating or exfiltrating data within about 15 minutes of gaining access. It describes three patterns: stolen developer GitHub OAuth tokens, ClickFix lures that impersonate Claude Code install instructions to deliver a macOS stealer, and help …
On 19 October 2026 an attacker used a hijacked GitHub account of an OVHcloud contributor to overwrite the download archives of five existing OVHcloud CLI releases (v0.11.0 to v0.15.0) with a build designed to steal secrets from the disk of any machine that ran it (thehackernews.com, bleepingcomputer.com). The files were live for about 94 …
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a remote code execution backdoor. All wheels (Linux, macOS, Windows) drop three extra fil…
