14 casos · pág. 1/1
An actor using the handle Madrex is advertising a malware service called Spectator Loader in a Russian-language post. The post describes it as a private resident loader built for long-term persistence, resistance to blocking and evasion of modern security products. All capabilities are actor claims from the advertisement and have not been…
FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses a…
Palo Alto Networks Unit 42 reviews the current OAuth attack landscape. Attackers are shifting from stealing passwords to stealing OAuth access and refresh tokens, which bypass MFA, survive password resets and give durable access. Unit 42 groups OAuth-based phishing into three categories: account hijacking, permission hijacking and malicio…
FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its l…
ESET documented the evolution of MATCHBOIL, a custom C downloader used by the Russia-aligned cyberespionage group UAC-0099. Samples span April 2024 to April 2026, although CERT-UA first documented the malware in August 2025. Each iteration became more sophisticated, with new obfuscation, sandbox checks and persistence methods. All victims…
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents.org, so trackers relyin…
SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
Unit 42 attributes with high confidence to an Iranian state-aligned actor, tracked as CL-STA-1178, a campaign called Blinder Tunnel. In March 2026 it targeted an individual in Iraq's critical infrastructure sector, after infrastructure staging that began as early as November 2025. The actor impersonated the Dubai Airports IT department an…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Kaspersky researchers report that the APT group Mirage Kitten has moved from native C/C++/Go malware to Node.js and JavaScript implants, NodeRabbit and PollCat. Both are cross-platform RATs delivered through spear-phishing by fake recruiters on LinkedIn and other job platforms, using trojanized coding-challenge archives hosted on Amazon S…
Between 19 and 22 October 2026, an operator published 15 npm packages whose names end in testmetest, carrying a Miasma-family self-propagating worm. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. Safe…
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
