Flooding Dropper Used 846 npm Components as Cross-Platform Loaders
An automated npm campaign uses hundreds of disposable packages to launch detached native malware, with DNS TXT records as a fallback delivery channel.
Read article →threats
Threat actors, malware campaigns, phishing, exploitation, and incident activity.
Failed WordPress Login Input Reaches Conditional Server Code Execution
WordPress 7.0.3 fixes a pre-auth login-page XSS that can turn administrator interaction with a malicious site into PHP execution.
Read article →
Remus Malware Stores Command Server Addresses in Ethereum Contracts
Remus uses an Ethereum smart contract to resolve changing command infrastructure before stealing browser sessions, credentials, and wallet data.
Read article →
BINDCLOAK Duplicates Windows Tokens to Run Modules as Another User
BINDCLOAK collects Windows user and process tokens, duplicates them, and starts modular malware components inside more privileged security contexts.
Read article →
Researchers Forge WSUS Updates Through Standalone Microsoft SQL Server
SpecterOps shows how relayed WSUS machine-account access can forge targeted updates and bypass payload signature checks when SUSDB runs on a separate SQL Server.
Read article →
CISA Confirms Exploitation of TeamCity's Unauthenticated RCE
CISA confirms exploitation of a TeamCity flaw that lets an unauthenticated network attacker run commands as the server process, putting secrets and build integrity at risk.
Read article →
18 npm Packages Hid a RAT Across a Benign-Looking Dependency Chain
A targeted npm cluster split its downloader across ordinary-looking modules, then escaped Node.js vm isolation to install a cross-platform RAT on developer systems using Alibaba tools.
Read article →
Malicious RTSP Server Reaches Code Execution on TP-Link TL-WR940N v6
TP-Link TL-WR940N hardware revision 6 can let an unauthenticated attacker turn a LAN client's outbound RTSP session into code execution inside the router kernel.
Read article →
BTMOB Is No Longer One Android Malware Service
Flare found that BTMOB's official operation now sits among resellers, source-code buyers, private servers, and offers of uncertain authenticity, weakening infrastructure-only detection.
Read article →
DOUBLECUP Hides a ClickFix Payload in the Browser Cache
The service preloads a payload-bearing PNG, copies a browser-specific command, and keys the final in-memory stage to the victim's public IP address.
Read article →
Keyv's Signed npm Releases Carried a Credential-Stealing Worm
A compromised maintainer account published Keyv-family packages with valid provenance, an install-time credential stealer, and code that could poison more npm releases.
Read article →
Gitea Org Rendering Exposes Local Files Before Server Execution
Gitea 1.22.1 through 1.27.0 can let an anonymous request read files as the service account, expose the internal token, and plant a Git hook that executes during a clone.
Read article →
INC Exploitation Makes SMA 1000 Hotfixes an Incident Triage Trigger
INC ransomware activity requires SMA 1000 operators to investigate logs and configuration as well as apply the hotfix.
Read article →Showing 118–130 of 156