/
data_types_exposed:session_cookies × criticity:high × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …

MALFEX software development cryptocurrency
thehackernews.com · high

Fake Web3 'Apex Accelerator' (REF8801) uses malicious npm packages to deploy stealers, CloudSyncD backdoor and hijack AI agent traffic

Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…

REF8801 cryptocurrency technology