4 casos · pág. 1/1
SafeDep research shows that Cursor's Import VS Code Configuration step copies only the publisher.extensionname of each installed extension and drops the version. Cursor then installs whatever version Open VSX (run by the Eclipse Foundation) calls latest, through its proxy marketplace.cursorapi.com. In SafeDep's test, three extensions pinn…
Forescout Research - Vedere Labs disclosed ROMULUS, a ClickFix delivery platform that uses bogus landing pages with ClickFix-style lures to trick users into running malicious commands that infect their own machines. It is used to distribute malware such as Legion Loader (also tracked as Satacom downloader, CurlyGate and RobotDropper). For…
FortiGuard Labs analyzed a TrickBot variant that carries command-and-control (C2) traffic over DNS tunneling, embedding encoded data in DNS queries and responses, instead of the HTTP used by earlier variants. The malware persists through Windows Task Scheduler, stores its configuration in NTFS Alternate Data Streams, and hinders analysis …
Darktrace researchers documented a new campaign distributing CikaBika Bot, a Rust-based remote access trojan controlled entirely through Discord. The infection chain starts with a disk image named PropositionProjet.img, which contains a French-language decoy PDF and a Windows shortcut disguised as a Word document. A Nim loader extracts th…
