/
ttps_attack:T1539 × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

PolinRider loader uses Ethereum transactions as C2 resolver in 35 GitHub repositories, including a pull request to oxc

SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…

technology software development
safedep.io · high

MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …

MALFEX software development cryptocurrency