29 casos · pág. 1/2
F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cybe…
FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses a…
In late August 2026, Sekoia's TDR team observed an attacker compromise an unauthenticated Flowise honeypot (emulating v2.2.8). The attacker harvested stored credentials, tried to plant a malicious chatflow with a callback to 154.217.251.226, and used prompt injection to turn the LLM agent into an offensive analysis assistant. The activity…
On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfi…
SafeDep reports a growing npm campaign in which forks of Baileys, the WhatsApp Web library for Node.js, abuse the installer's authenticated WhatsApp session to silently follow attacker-controlled channels. Confirmed malicious packages total 82 Baileys-based package names (375 versions) and 15 libsignal-node impersonators (38 versions), ou…
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
Two beta versions in the @joyfill npm scope, published on July 28, 2026, carried the same blockchain C2 loader seen in the earlier astro.config.mjs attack, which the article ties to the PolinRider campaign. The attacker published through the legitimate scope (a form-builder SDK with three maintainers) under the beta dist-tag. The maliciou…
F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…
Kaspersky found the first documented Android malware targeting automotive head units, discovered in June 2026. It is a multi-stage downloader whose ultimate purpose is ad fraud and a residential proxy botnet. It spread through the built-in updater (TWCore, package com.tw.core) of DoFun head unit firmware, which installs APKs pushed over a…
Cisco Talos disclosed an APT spear-phishing and quishing campaign, tracked as UAT-11985, that targets individuals affiliated with Taiwan research organizations. First seen in mid-2026, it uses fake event invitations to lead victims to an adversary-in-the-middle (AitM) phishing framework that harvests Google account credentials and MFA cod…
SafeDep analyzed sckit (the "supplychain.local worm"), a previously unreported cross-platform Go implant framework found on September 23, 2026 in the compromised MemTensor packages @memtensor/email protected (npm) and email protected (PyPI). It harvests credentials from developer machines and CI jobs, takes signed tasks from a C2 server, …
F5 Labs, using Efflux sensor telemetry, analyzed December 2025 exploitation of React2Shell (CVE-2025-55182), a CVSS 10.0 unsafe deserialization RCE in React Server Components. It was disclosed on 3 December 2025 and rose to second place among the most exploited CVEs, behind only CVE-2017-9841. Within days of disclosure, actors moved from …
A supply chain campaign tracked as UNC7017 hijacked the update infrastructure of AOMEI Technology between April and July 2026 to distribute the CROSSROAD downloader and the SHINYROAD backdoor through AOMEI Backupper and AnyViewer update workflows. The attackers tampered with server configurations only briefly, then restored legitimate con…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
Between May and July 2026, attackers tracked by Google Threat Intelligence Group (GTIG) as UNC7017 altered files on AOMEI's own update servers for windows of 5 to 10 minutes. Any copy of AOMEI Backupper that checked for updates during a window downloaded and ran a backdoor. GTIG, Mandiant and ManageEngine's Threat Analysis Lab disclosed t…
Toy Ghouls (aka Bearlyfy, Laboo.boo, Feral Wolf), a financially motivated group targeting Russian organizations since 2025, was observed in early July 2026 using a custom backdoor for the first time. Kaspersky GERT identified two versions, mqtt-bird-agent 0.1.0 (C2 over the public HiveMQ MQTT broker) and matrix-bird-agent 0.1.0 (C2 over a…
On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…
ESET documented the evolution of MATCHBOIL, a custom C downloader used by the Russia-aligned cyberespionage group UAC-0099. Samples span April 2024 to April 2026, although CERT-UA first documented the malware in August 2025. Each iteration became more sophisticated, with new obfuscation, sandbox checks and persistence methods. All victims…
The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-so…
