Security Affairs Malware Newsletter Round 121: Android spyware, Lazarus Operation FlashHole, malicious Cursor extension, Magento skimmer
The Security Affairs Malware Newsletter Round 121 is a weekly roundup of malware research and reporting. It links to articles but gives no technical detail of its own. Headline items include uCreator, a virtualization-based Android spyware platform aimed at messaging apps such as WeChat and Telegram, and a Magento CMS block loader from deepveindrilling.com reported to affect 953 stores. Other items cover Operation FlashHole, attributed to Lazarus, and a malicious version (2.1.313) of the Anthropic.claude-code extension in the Cursor Extension Marketplace. The list also includes a Trezor warning about a suspected crypto-theft implant in a hardware wallet, the return of the Load/Mine Hugging Face malware campaign after a takedown, and abuse of signed ChatGPT and Claude binaries. Several academic papers on malware detection and classification are listed as well.
Detalhes técnicos
- uCreator: Android spyware platform using virtualization, targeting WeChat, Telegram and other messaging apps.
- deepveindrilling.com: Magento block loader affecting 953 stores.
- Cursor Extension Marketplace: malicious Anthropic.claude-code version 2.1.313.
- Load/Mine: Hugging Face malware campaign that resurfaced after takedown.
- The article gives no IOCs, CVEs or ATT&CK mappings; the linked sources would need to be consulted for details.
Linha do tempo
-
Security Affairs Malware Newsletter Round 121: Android spyware, Lazarus Operation FlashHole, malicious Cursor extension, Magento skimmer
ler a análise desta fonte ocultar
The Security Affairs Malware Newsletter Round 121 is a weekly roundup of malware research and reporting. It links to articles but gives no technical detail of its own. Headline items include uCreator, a virtualization-based Android spyware platform aimed at messaging apps such as WeChat and Telegram, and a Magento CMS block loader from deepveindrilling.com reported to affect 953 stores. Other items cover Operation FlashHole, attributed to Lazarus, and a malicious version (2.1.313) of the Anthropic.claude-code extension in the Cursor Extension Marketplace. The list also includes a Trezor warning about a suspected crypto-theft implant in a hardware wallet, the return of the Load/Mine Hugging Face malware campaign after a takedown, and abuse of signed ChatGPT and Claude binaries. Several academic papers on malware detection and classification are listed as well.
Technical Details
- uCreator: Android spyware platform using virtualization, targeting WeChat, Telegram and other messaging apps.
- deepveindrilling.com: Magento block loader affecting 953 stores.
- Cursor Extension Marketplace: malicious Anthropic.claude-code version 2.1.313.
- Load/Mine: Hugging Face malware campaign that resurfaced after takedown.
- The article gives no IOCs, CVEs or ATT&CK mappings; the linked sources would need to be consulted for details.