16 casos · pág. 1/1
Huntress announced Attack Reduction, a new capability in Huntress Managed ESPM (Early Access) that disables the "Windows key + R" shortcut for users who never use the Run dialog, aiming to break the most common ClickFix attack chain. The post opens with an attempted fake-CAPTCHA lure that targeted a Huntress employee on a spoofed airport …
Kaspersky reports a Lazarus Group operation dubbed FlashHole, targeting South Korean organizations since July 2025 with a complex, mostly in-memory infection chain. The attackers use the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism for C2 communications, so that subsequent payloads are delivered encrypted and are…
FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C…
Unknown attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, and distributed malicious version 1.107.0 through PyPI and Docker registries (Docker Hub and GHCR). The package carries an infostealer targeting cloud and AI credentials and a RAT that can execute arbitrary code. PyPI quarantined…
The widely used LiteLLM Python package was compromised in a software supply chain attack. Malicious version 1.107.0 was published via PyPI wheels and Docker images, delivering a credential stealer and a backdoor, per reports from SafeDep, Socket, StepSecurity and Upwind. LiteLLM says the release was pushed through three engineers' GitHub …
Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud.com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS paylo…
This SentinelOne weekly roundup (Week 39, 2026) covers one law enforcement success and two active threat campaigns. A US court sentenced Armenian national Karen Serobovich Vardanyan ("Maneeken"/"Karl Lagerfeld"), an initial access specialist for Ryuk ransomware, to two years in prison and over $1.2 million in restitution. SentinelLABS ide…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHu…
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
A ClickFix malvertising campaign uses sponsored Google results for "amazon business" to lure victims to a fake Amazon login page on Google Sites and then to a fake CAPTCHA. The CAPTCHA pastejacks a command into the clipboard that the victim is told to run in the Windows Run box. The command abuses the legacy finger.exe utility to fetch a …
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect and Prisma Access disclosed in May 2026, according to ReliaQuest. Because access arrives through the victim's own VPN, it can resemble legitimate remote work and go unnoticed until credential theft, lateral movement, …
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
Elastic Security Labs is tracking REF8801, a campaign in which a fake Web3 venture capital accelerator, Apex Accelerator (Apex Foundation), targets cryptocurrency startups and founders with malicious npm packages. The packages, @apexacc/cli and @apexacc/audit, pose as an AI advisor and an MCP-based security scanner, with offers of free Cl…
The LiteLLM release 1.107.0 (a widely used open source LLM proxy) was trojanized on PyPI on 21 October 2026 and carries a credential stealer plus a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) drop three extra files in site-packages, two of which run whenever any Python process starts, even one that never impor…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
