90 results for “drop”

Huntress investigation of incidents in September and October 2025 where a compromised camera management application (CMS.exe) was the initial access vector. Attackers dropped rs.win32.exe, a reverse shell, and sideloaded modified zlib DLLs (IPHLPAPI.DLL, samcli.dll) via the legitimate Microsoft WpcMon.exe in AppData, with Run key persistence and beaconing to 144.172.116[.]37. Includes detection pivots and hardening advice.

huntress.comwriteupAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Analysis of the 19 October 2026 swap of binaries on five ovh/ovhcloud-cli GitHub releases (v0.11.0 to v0.15.0), live 94 minutes. StepSecurity rebuilt the attacker's binary, detonated the recovered GlassWorm preinstall.js loader against a controlled Solana dead drop, and found install.sh never exposed arm64 Linux, Homebrew was safe, and `ovhcloud version` showing "undefined" identifies the swapped build. Includes IOCs and recovery steps.

stepsecurity.iowriteupPublished and added 24 Oct 2026🛡️ Security

litellm 1.107.0 was published to PyPI on 21 October 2026 with all seven wheels backdoored through an injected `data = "cook"` maturin build line. The wheels drop cook.pth, cook.py and sitecustomize.py, which run on every Python start. They install a "privcollect" credential stealer (browser, SSH, cloud, AI coding tool and LiteLLM proxy database secrets, sent to litellm.dev) and an hourly GitHub dead-drop remote code loader. The post gives IOCs, detection commands and recovery steps.

stepsecurity.iowriteupPublished and added 21 Oct 2026🛡️ Security

LiteLLM version 1.107.0 was uploaded to PyPI on 21 October 2026 with a credential stealer, and the same build reached GHCR and Docker Hub images. Wiz describes the three dropped files (cook.pth, cook.py, sitecustomize.py), exfiltration to a fake litellm.dev domain, a GitHub dead drop for a second stage, and the malicious commits pushed through the lookalike Berri-AI repository. The last safe version is 1.106.2.

wiz.iowriteupPublished and added 21 Oct 2026🛡️ Security

Honeypot writeup of in-the-wild exploitation of Plex Media Server through the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) in October 2026. Attackers from 45.194.92.222, 91.92.40.202 and 176.65.139.228 used SSRF-style timeline/subscribe requests and downloaded a Docker-named dropper and an XMRig miner from 217.60.194.116. Includes file hashes, a later-seen proxyware sample (myawesomeproxy), lab pcaps for signatures and links to sandbox reports.

boredhackerblog.infowriteupAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

DFIR case where a malicious MSI impersonating Advanced IP Scanner, sourced from a fake GitHub repo found via Bing, was imported by a customer into Microsoft Intune and deployed to four endpoints, running a Node.js-based EtherRAT chain. It traces the infections by correlating the MSI ProductCode, MDMAppInstaller/omadmclient process ancestry and Intune app inventory (Graph PowerShell query). It also covers renamed node.exe hash-hunting pitfalls, Ethereum RPC dead-drop C2 traffic, a screen-capture script and a second impersonating repo.

dfir.chwriteupAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

Describes Resolve, a Kaggle benchmark of 16 single-function Python edits. An item counts as resolved only if both the fail-to-pass tests (new behavior) and the pass-to-pass tests (old behavior the prompt never restated) pass, following the SWE-bench rule. A second task, resolve-plus, adds a hidden edge suite. Results for 23 frontier and open models: GPT-6.1 Sol and GPT-5.6 Luna lead at 0.9375 on both tasks, while DeepSeek-R1, Sonnet 5.5 and Opus 5.5 drop from 0.9375 to 0.875. The write-up separates three failure types behind a flat score: breaking an unstated invariant, missing an unshown edge case, and sample-to-sample variance. It also compares score against output price per million tokens.

x.comwriteupPublished and added 11 Oct 2026🧠 AI

Huntress documents active exploitation of two AhsayCBS (Ahsay Cloud Backup Server) vulnerabilities being chained together: CVE-2026-105133, an authentication bypass in checkSysPwd, and CVE-2026-105134, an unauthenticated RCE in the Replication Receiver's UpdateReceivers.do endpoint that grants SYSTEM. Attackers use the chain to drop JSP webshells, then deploy a renamed XMRig cryptominer (masquerading as msedge.exe via a modified NSSM binary), a Task-Manager-aware anti-detection PowerShell script, and the vulnerable WinRing0x64.sys kernel driver for hardware-level miner access. Huntress provides IOCs, mitigation guidance (restrict management interface, re-image if compromised) and four Sigma rules targeting each stage of the intrusion chain.

huntress.comwriteupAdded 9 Oct 2026, published 8 Oct 2026🛡️ Security

Aikido details a new Shai-Hulud worm wave that compromised the tensorlake npm package (v0.5.144, 100k+ lifetime installs) via a hijacked GitHub maintainer identity. The malware's preinstall script drops the Bun runtime to run an obfuscated payload that exfiltrates CI/cloud secrets, browser crypto-wallet extension data (via a bundled HackBrowserData binary), uses a blockchain dead-drop (an Ethereum contract queried via public RPC nodes) to resolve a fallback C2, and includes a GitHub-token-triggered dead-man's switch that wipes infected machines. The post includes full IOCs: file hashes, the C2 domain iseekaigogo[.]com, and the threat actor's wallet/contract addresses.

aikido.devwriteupPublished and added 8 Oct 2026🛡️ Security

Socket.dev reports that TensorLake's npm SDK was compromised as part of the ChainDrop campaign, a variant/wave of the Shai-Hulud credential-stealing npm worm. The compromised package reportedly harvests developer credentials from infected systems, continuing the pattern of self-propagating npm supply-chain attacks seen across the Shai-Hulud family. Full technical detail could not be verified in this pass due to a content-processing failure.

socket.devwriteupPublished and added 8 Oct 2026🛡️ Security

watchTowr post-exploitation analysis of CVE-2026-88771, an unauthenticated log-poisoning command injection in Citrix NetScaler (advisory CTX697096). Sensors logged thousands of attempts: about 85% were OOB callbacks, the rest Sliver implants, a trojanized Dropbear SSH backdoor, a Perl stager with a PHP webshell, and SSH-key and secret-harvesting sprays. Includes artifacts to hunt (/var/tmp files, ns_helper, ns.conf edits) and IOC repo pointers.

watchtowr.comwriteupAdded 30 Oct 2026, published 7 Oct 2026🛡️ Security

Huntress details a phishing campaign that abuses legitimate Microsoft Power BI dashboards (app.powerbi.com) to host a fake "Download Reference" lure that bypasses mail filters trusting the Microsoft domain. Clicking the lure triggers browser/environment fingerprinting and Telegram-bot-based victim telemetry exfiltration via attacker domains (dailylifeproject.site, burnsworth.site, etc.), then silently downloads rogue ScreenConnect installers; a chained CMD/PowerShell script (SCAutoFix.ps1) deploys a second ScreenConnect instance, uninstalls the first for evasion, drops the defense-evasion tool HideUL_x64.exe, and sets a recurring scheduled task before Huntress's SOC intervened.

huntress.comwriteupPublished and added 7 Oct 2026🛡️ Security

The author revives "cablese," the terse telegraph-era writing style, as an LLM prompting technique: instructing a model to write dense, article-dropping summaries cuts output tokens 25–49% depending on model family, while downstream models (including ones never shown the instruction) answer comprehension questions from the compressed text at parity or better than from plaintext. The piece introduces the "Telegraph Test," an open benchmark (github.com/Travis42/telegraph-test) with ~1,300 questions over 50 passages and a fixed deterministic grader, used to measure compression ratio, cross-model legibility, and read-back/decode costs for GLM-5.3-Flash, Gemma, Qwen and gpt-5-mini; it also contrasts this human-readable, auditable register against emergent machine-only compression protocols described in other papers (BabelTele, GLOSSOGEN) and existing tools (Terse, Caveman).

fiveminutesforward.comwriteupPublished and added 7 Oct 2026🧠 AI

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

theravenfile.comwriteupPublished and added 6 Oct 2026🛡️ Security

Rapid7 details a new BPFDoor campaign targeting telecom and network-edge appliances (ShareTech, SpamSniper mail gateways) and a six-sample Linux RAT family dubbed AVERAT found on compromised Taiwanese CPE (Synology NAS, a NetKlass device, a Dahua DVR). The writeup reconstructs the Rapid7 BPFDoor controller's HTTP-tunneled trigger mechanism, a fileless ShareTech dropper that stages binaries as ntpdate/udevds and deletes them while processes keep running, a BPF Rekoobe variant that hides inside SMTP port-25 traffic, and AVERAT's RC4-derived config/C2 scheme — tying the infrastructure to the broader China-nexus ORB (Operational Relay Box) device pattern described in CISA/NCSC-UK advisory AA26-113A. It closes with detection guidance for unlinked/deleted process execution, dropper staging artifacts, and port-25 C2 callbacks, plus full IOC and ATT&CK tables.

rapid7.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Socket's Threat Research team uncovered a theme-extension cluster spanning four VS Code Marketplace and six Open VSX listings, including two confirmed malicious extensions: Aurora Nocturne Night Theme (a Windows downloader that fetches and silently executes temp_batch.cmd via cmd.exe from fingercakes4sale[.]store, tied to XWorm C2 infrastructure) and Cosmic Nebula Themes, whose app.js decrypts an AES-256-CBC embedded stage and uses a Solana transaction memo as a dead-drop to resolve follow-on payload infrastructure — the same AES key, Solana address, and execution model previously documented in GlassWorm activity. Git commit identities, near-identical theme source, shared Russian-language developer comments, and brandjacking (Coca-Cola, Aurora Borealis name-squatting) link the cluster together; a Dec 14, 2025 DEV Community article is assessed as promotional infrastructure driving Open VSX installs. The post provides full IOCs (hashes, domains, Solana address, AES key/IV, GitHub accounts) and MITRE ATT&CK mappings for defenders to hunt and inventory extensions across both registries.

socket.devwriteupPublished and added 2 Oct 2026🛡️ Security

Cisco Talos details UAT-11587, a China-nexus threat cluster targeting government, defense, and policy organizations across Taiwan, India, the Philippines, Cambodia, and other Asian countries with spear-phishing and a five-stage infection chain (HTA/WSF stagers, JScript decryptors, .NET BinaryFormatter/ActivitySurrogateSelector deserialization gadgets, and DLL sideloading via the signed GatherOsState.exe) to deploy a new Rust-compiled backdoor called Antino. Antino uses Microsoft Graph/Outlook/OneDrive as a dead-drop C2 channel instead of a traditional C2 server, supports shell/PowerShell execution, file transfer, shellcode loading with a sleep-mask evasion technique, and abuses the Windows Scripted Diagnostics framework for persistence; Talos also notes possible infrastructure overlap with Symantec's "Jewelbug" cluster and Arctic Wolf's UNC6384 reporting. Includes ClamAV/Snort coverage and IOCs.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 30 Sep 2026🛡️ Security

Huntress details a four-act intrusion against a shared parks-and-recreation management platform running on IIS, where an attacker first tried noisy unauthenticated exploits (IIS 8.3 tilde enumeration, WebDAV verb abuse, upload-handler bypasses) before simply registering a member account and uploading .aspx webshells via a member-file upload feature across three servers. The attacker enumerated hosts, extracted web.config/connection strings, hunted for cardholder data (Fortis/MXMerchant webhook logs, CVV/card-number strings), then escalated to timestomping, re-deploying known-filename webshells, and finally injecting an AI-generated PowerShell/JS dropper into a trojanized jQuery file to turn site visitors' browsers into WebRTC/WebSocket C2 clients (ririmochii/bubuneeko Cloudflare Workers infrastructure). Includes a zh-CN PowerShell user-agent string used for attribution and full command/IOC listings useful for detection engineering.

huntress.comwriteupAdded 1 Oct 2026, published 30 Sep 2026🛡️ Security

Microsoft Defender Experts document a July 2026 phishing campaign that delivers a masqueraded but legitimately signed MSP360 RMM installer (v2.5.0.67) via meeting-invite, Zoom, Adobe, and DHL-themed lures hosted on both attacker infrastructure and legitimate cloud services (S3, Cloudflare R2, Dropbox, GitLab, Supabase). After UAC-elevated installation and service persistence, the RMM.Agent.exe service launches PowerShell to silently install a ConnectWise ScreenConnect client via msiexec, which the actor then uses via RunFile to drop credential-theft and reconnaissance tools disguised as Windows/Defender/Phone Link components. A separate July intrusion used FaronicsDeployAgent.exe the same way to deploy ScreenConnect, showing the technique is not MSP360-specific; Microsoft provides IOCs, hunting queries, and mitigation guidance (Application Control, AppLocker publisher rules, ASR rules) but does not attribute the activity.

microsoft.comwriteupAdded 7 Oct 2026, published 29 Sep 2026🛡️ Security

Opensourcemalware.com traces PolinRider, a DPRK-linked supply-chain malware delivered via a poisoned .vscode/tasks.json that autoruns an obfuscated payload disguised as a Font Awesome .woff2 file, through an 8-month infection of three real GitHub repos (Binary-Mindz org). Using GitHub's server-side activity log they reconstruct 853 force-pushes showing the operators A/B-testing multiple concurrent payload variants (400/500/900), rewriting commits to impersonate legitimate cleanup commits, hiding payloads inside eslint.config.mjs and prisma.config.ts, and using an Ethereum-wallet-based C2 dead-drop (NullReceiver). The post lists why common detection heuristics (filename search, whitespace padding, marker strings) fail against the new variants and gives working detections (file-type checks, folderOpen task grepping, activity-log force-push monitoring) plus full IOCs.

opensourcemalware.comwriteupPublished and added 26 Sep 2026🛡️ Security

Gambit Security recovered the staging server of a financially motivated actor running three open-source AI agent harnesses — Strix (vuln scanning), Cairn (autonomous exploitation), and Hermes (orchestration) — against hundreds of online retailers at a marginal cost of tens of dollars per target. The campaign exfiltrated 600,000+ credit card records via Magento database compromises, deployed checkout-page card skimmers on at least 19 confirmed and 100+ further sites, and in one case an agent's own cleanup routine dropped 180 database tables including victim backups. The report details full attack chains (SQLi to RCE to AWS Secrets Manager dump to card decryption), the AI harnesses' operating costs (~$25 mean per target on OpenRouter/opus-4.6/GLM/DeepSeek), and multiple real-world skimmer injection techniques.

gambit.securitywriteupAdded 26 Sep 2026, published 22 Sep 2026🛡️ Security

Aikido documents the Graphalgo malware campaign's expansion beyond NPM into two malicious Terraform providers (gocommunity-io/dockerd and the kreuzwerker/docker typosquat kreuzwenker/docker) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex), marking the first observed systematic Terraform provider malware distribution. The payload is a Go port of Graphalgo sharing blockchain infrastructure, Slack C2, and a public key with prior JS/NPM samples; it activates only under specific hash-gated runtime conditions (targeted attack indicator), then deploys a Go RAT with dual C2 channels — an Ethereum (Arbitrum Sepolia) smart-contract dead drop and Slack bot messaging — plus self-delete and remote code execution capabilities. The threat actor also stood up two fake Go package ecosystem websites (gocommunity.io, gogets.dev) to socially engineer developers and backdated Git commits to obscure module publication timing.

aikido.devwriteupPublished and added 22 Sep 2026🛡️ Security

Huntress details a post-incident investigation into an INC ransomware attack that hit 175+ endpoints, reconstructed from surviving EDR telemetry and Windows event logs rather than live detection. The intrusion shows a 17-day gap between initial scheduled-task persistence and RDP lateral movement (possibly an initial access broker), and a second wave using AnyDesk, a BYOVD tool (hwau.exe loading the HwAudio kernel driver) to disable security controls, and Impacket's atexec.py to deploy INC ransomware. Attackers dropped two distinct ransom notes 53 minutes apart: a standard INC-README.txt and a detailed DATALEAK_PRESS_RELEASE.txt threatening to notify media, employees and partners with a full inventory of stolen files.

huntress.comwriteupAdded 22 Sep 2026, published 21 Sep 2026🛡️ Security

Socket's research team found two beta releases of the @joyfill npm packages (@joyfill/layouts and @joyfill/components) contained an import-time JavaScript implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions, ultimately dropping a 77KB Node.js remote-access trojan matching the DEV#POPPER family and sharing loader fingerprints with the PolinRider blockchain-loader campaign. The RAT establishes a Socket.IO C2 channel, executes arbitrary JS/shell commands, exfiltrates files and clipboard data, and persists by patching files inside VS Code, Cursor, Antigravity, Discord Desktop, GitHub Desktop, and the global npm CLI; a parallel detached-process branch fetches an additional bootstrap that can deploy a Python credential/browser-data stealer assessed as an OmniStealer variant. Because the implant fires on module load (not via npm lifecycle scripts), `--ignore-scripts` provides no protection, and the writeup includes full IOCs, blockchain addresses, C2 infrastructure, and MITRE ATT&CK mappings.

socket.devwriteupAdded 22 Sep 2026, published 20 Sep 2026🛡️ Security

OpenSourceMalware researchers detail WeaselBiscuit, a newly discovered lightweight JavaScript infostealer found hidden in 11+ npm packages (e.g. process-tailwind, engin1, the @biz44 scope), which shares tradecraft with DPRK-linked BeaverTail/OtterCookie but strips out wallet-draining, password decryption, and remote-shell features. The writeup walks through the full infection chain - a package auto-running a detached Node loader, fetching a Base64-encoded second stage from Npoint dead-drop URLs, and beaconing to a hardcoded HTTP C2 (103.170.217.184:8787) - plus its capabilities (Chrome extension-storage theft, clipboard capture, Windows keylogging) and a campaign-cluster graph tying packages together via shared hashes and resolver URLs. Attribution to DPRK is explicitly labeled a tentative hypothesis rather than confirmed.

opensourcemalware.comwriteupPublished and added 17 Sep 2026🛡️ Security

Group-IB documents previously undocumented samples of HEAVYGRAM, a Python/PyInstaller-based Windows backdoor that uses the Telegram bot API for command-and-control, screen/audio capture, data exfiltration, and DLL side-loading, alongside the related CRUDEEXCLUDE loader that adds Windows Defender exclusions. The research corroborates and extends a March 2026 US DOJ affidavit and FBI FLASH report, attributing the malware with moderate confidence to the Handala Hack persona — assessed as a false-flag "hacktivist" front for Void Manticore (aka Storm-0842/Banished Kitten), operating on behalf of Iran's MOIS — used since Fall 2023 against Iranian dissidents, journalists, and critics of the Iranian government via Telegram-delivered, Delphi-packaged lures (fake KeePass, Telegram, Pictory apps). It details four infection-chain variants (WSF/VBS downloaders, HTA Telegram-polling scripts, Delphi droppers with embedded archives), the implant's command prefixes (@@/**/##) and attachment handlers, dual-bot C2 configurations, and provides IOCs and detection/hardening recommendations.

group-ib.comwriteupAdded 1 Oct 2026, published 17 Sep 2026🛡️ Security

Endor Labs' live incident tracker for the Shai-Hulud 2.0 npm supply-chain worm that began around Nov 24, 2025, compromising packages from Zapier, ENS Domains, Postman and PostHog. It details the infection chain (malicious preinstall script, setup_bun.js dropper, obfuscated bun_environment.js payload), TruffleHog-style credential theft from AWS, GCP, Azure, GitHub and npm, self-replication via stolen npm and GitHub tokens, a self-hosted GitHub Actions runner backdoor abusing repository Discussions for command injection and C2, and destructive wiper behavior that shreds the user's home directory on Windows and Linux.

endorlabs.comwriteupPublished and added 11 Sep 2026🛡️ Security

Cisco Talos details active exploitation of CVE-2026-20079 (CVSS 10.0 unauthenticated auth bypass leading to root) and CVE-2026-20316 (low-privilege login via static credentials) in Cisco Secure Firewall Management Center. Three post-compromise clusters are tracked: UAT-12197 deploying a JSP web shell and JAR command executor to exfiltrate credentials; UAT-11823, overlapping with Sandworm, using a malicious Makeself license.tmp to drop a Netcat reverse shell and a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate who abused package_info.pl for LOTL recon, SOCKS5/reverse-SSH tunneling, and ultimately deployed Qilin ransomware. Talos provides Snort SIDs, hotfix guidance ahead of a comprehensive hardening release, and a GitHub IOC repository.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 9 Sep 2026🛡️ Security

Huntress analyzed a fake GTA6 game ISO (some padded to 100GB+ with junk data) distributed via SEO poisoning, gaming forums, and torrents ahead of the game's real release. The ISO's "installer" drops a Russian-language crack-themed installer that stages multiple NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer (exfiltrating browser/Discord/Roblox/Minecraft data via Discord webhooks), Chaos ransomware repurposed as a destructive wiper (with a fake "license not found" error to mask the compromise), and an unexplained Yandex Browser install. The writeup includes IOCs (C2 IPs, ngrok tunnel, hosts-file modifications, malicious Discord webhook URL) and notes current Windows Defender detects the components.

huntress.comwriteupAdded 11 Sep 2026, published 9 Sep 2026🛡️ Security

Cisco Talos reconstructs two related WebDAV-based infection chains (tracked actor UAT-10820) that use a ClickFix fake-CAPTCHA lure, EtherHiding on BNB Smart Chain to stage JavaScript via a malicious Cloudflare Worker, and WebDAV-delivered disguised DLLs executed via rundll32 ordinal calls to drop the Amatera stealer. Depending on the C2 configuration, Amatera then deploys either a NativeAOT-loaded ZigCryptoStealer with a BYOVD EDR-killer driver and a Go-based Yamux reverse proxy, or a PowerShell stager that installs a trojanized NetSupport Manager RAT pointed at Russian C2 infrastructure. The post details loader internals, Amatera's dead-drop C2 resolution via Telegraph and Steam, and provides ClamAV signatures plus a full IOC list.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 8 Sep 2026🛡️ Security

Aikido researchers found a delayed RCE in the Unreal Engine 5-based game MECCHA CHAMELEON, exploitable via a malicious Steam Workshop map. A Blueprint-exposed audio recording function allowed arbitrary file writes via path traversal, a null-byte trick stripped the auto-appended .wav extension to drop an .exe into the Windows Startup folder, and PCM audio samples were crafted byte-for-byte to smuggle a polyglot WAV/HTA payload that launches mshta.exe and runs arbitrary code on reboot. The issue was patched in the game's 4.0.0 update.

aikido.devwriteupPublished and added 3 Sep 2026🛡️ Security

Huntress details a campaign in which social-engineering (tech-support scams, Quick Assist, malicious downloads) leads to rogue ScreenConnect installs that deploy a four-stage VBScript loader (1.vbs–4.vbs). The loader profiles the host (checking for EDR products, existing ScreenConnect, RAM size), fetches an AES-encrypted payload via a Dropbox-hosted map file, and drops one of three packages: a user-level backdoor, a persistence/privesc kit, or a tunneling+cryptomining bundle (wstunnel/XMRig plus the vulnerable WinRing0 driver for BYOVD). A backdoored ScreenConnect client then re-pushes the VBScript chain to every newly connected Host session via ScreenConnect's file-transfer API, giving the campaign worm-like self-propagation — which ConnectWise later confirmed stems from CVE-2026-84869, a 9.9 CVSS flaw in unauthorized file-transfer execution, patched in ScreenConnect 26.6.5.

huntress.comwriteupAdded 8 Sep 2026, published 3 Sep 2026🛡️ Security

Huntress dissects a trojanized Exodus crypto wallet installer (v24.33.4, unsigned MSI built with WiX) that installs a genuine wallet but patches Electron's show()/focus()/center() methods so no window ever appears, then loads a modular RAT via a hand-written reflective PE loader implemented in JavaScript using the Node.js koffi FFI library. The RAT (VNC, SOCKS proxy, browser-credential stealer, recon module) beacons over WebSockets and uses Azure Table Storage as a dead-drop C2 channel to blend into legitimate cloud traffic, while delivery abuses double-extension .pdf.js phishing, ZIP-staged JS files, and an unused search-ms/WebDAV technique; the writeup also covers multi-layer string-array/arithmetic deobfuscation and includes full IOCs and mitigation guidance.

huntress.comwriteupAdded 3 Sep 2026, published 1 Sep 2026🛡️ Security

Deep-dive reverse engineering of a real-world incident where a WordPress site compromised via CVE-2026-18322 was used to drop a bincrypter-obfuscated, statically-linked gs-netcat (gsocket) 1.4.42beta5 binary as a reverse-shell tunnel, persisted via crontab and masquerading as "netd"/"[kthreadd]". The author fully unravels bincrypter's multi-stage shell obfuscation (character-separator tricks, AES-256-CBC/openssl decryption, memfd_create fileless ELF execution via a Perl one-liner) and reveals a custom THC UPX build with zeroed magic bytes/PackHeader used to hide payload identification, along with gsocket's self-embedded XOR-encoded operator configuration. Releases two open-source tools (Bincrypter-Extract, Gsocket-Config-Extract), YARA rules, and an ImHex pattern file, plus full IOCs (C2 IP, GSRN secret, process/memfd artifacts).

pgj11.comwriteupPublished and added 31 Aug 2026🛡️ Security

StepSecurity's forensic writeup on a compromised crates.io maintainer account that published poisoned releases of arrayref (245M downloads), internment, and append-only-vec, each pulling in proc-macro1, a typosquat of proc-macro2 impersonating David Tolnay whose build.rs silently drops and executes a cross-platform stage-2 payload at compile time. The attacker also mass-yanked clean arrayref versions to funnel Cargo's "yanked" warning toward the one poisoned release, and StepSecurity reproduced the attack in GitHub Actions with Harden-Runner, capturing the C2 callback to 23.254.165.112:9089 and demonstrating automatic blocking via a global IOC block list. The post includes the full attack timeline, dropper base64-obfuscated URL scheme, SHA-256 hashes, C2 IOCs, and remediation/detection guidance for lockfiles and CI caches.

stepsecurity.iowriteupAdded 3 Sep 2026, published 22 Aug 2026🛡️ Security

Aikido researchers detail a supply-chain compromise of three popular Rust crates maintained by the same author, arrayref with 244M downloads, append-only-vec with 4M, and internment with 14M, that were modified to add a single malicious manifest dependency, proc-macro1, a typosquat of proc-macro2. Because the dependency's build.rs executes automatically during cargo build, merely compiling a project pulling in any of these crates downloads and runs a platform-specific payload that drops an infostealer targeting Chromium browser credentials and crypto-wallet extension storage, installs macOS LaunchAgent persistence, and beacons to a lightweight C2 supporting remote shell commands. The campaign's TTPs closely mirror the prior npm-based Axios and Mastra compromises attributed to DPRK, suggesting the same actor expanding into the Rust ecosystem.

aikido.devwriteupAdded 3 Sep 2026, published 20 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

huntress.comwriteupAdded 3 Sep 2026, published 17 Aug 2026🛡️ Security

Analysis of 'ChainDrop', an npm supply-chain worm that uses the Bun JavaScript runtime to execute a payload harvesting CI/CD credentials, with command-and-control coordinated via dead-drop messages posted to the Ethereum blockchain. The campaign is notable for combining a self-propagating npm worm technique with blockchain-based C2 to evade takedown and for targeting CI/CD secrets specifically.

stepsecurity.iowriteupAdded 3 Sep 2026, published 16 Aug 2026🛡️ Security

watchTowr Labs analyzes a pre-authentication remote code execution flaw in Citrix NetScaler ADC and Gateway, likely CVE-2026-8452, patched in versions 14.1-72.61 and 13.1-63.18. The bug is a heap overflow during SAML SignedInfo canonicalization, triggered by an oversized PrefixList attribute, which the researchers chain into a write-what-where primitive and full RIP control on non-PIE, no-ASLR builds. They describe dropping a PHP webshell, disabling crash signal handlers to survive without a full device reboot, and escalating from the nobody web server user to root via SUID on /bin/sh.

labs.watchtowr.comwriteupAdded 30 Oct 2026, published 14 Aug 2026🛡️ Security

Ionix's engineering team describes building an in-house AI PR reviewer using OpenAI's Codex CLI against a self-hosted Azure AI Foundry model deployment, wired into CircleCI and Bitbucket, after dropping Atlassian Rovo for cost and low signal-to-noise. The piece details prompt design to suppress low-value comments, agentic repo-wide review (vs. diff-only), sharding for large PRs, JSON output validation against git ls-files, storing review state inside PR comments via base64-in-markdown, and a dedicated prompt-injection defense section (scrubbed environment, secret redaction, sandboxed execution, egress restriction). It also covers two production failures: a silently-broken bubblewrap sandbox that kept "reviewing" without running any tools, and an unpinned Codex CLI npm dependency that broke Azure API calls across every repo.

ionix.iowriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

Adversa AI compiles and analyzes nine publicly documented incidents from June 2025–July 2026 where AI coding agents (Cursor, Replit, Gemini CLI, Claude Code, Google Antigravity, Amazon's internal Kiro agent, Claude Opus 5) caused irreversible data loss — from wiped developer drives to a dropped SaaStr production database and a 13-hour AWS Cost Explorer outage in China. It categorizes failure mechanisms (shell-abstraction mismatches like unquoted paths and tilde expansion, unverified exit codes, constraint decay where acknowledged instructions were ignored, and permission-inheritance bypassing two-person approval gates) and argues that smarter models won't fix the problem, recommending credential scoping, filesystem confinement, mandatory confirmation on irreversible actions, read-after-write verification, and command-level logging.

adversa.aiwriteupAdded 7 Oct 2026, published 4 Aug 2026🛡️ Security

ChainDrop is an npm worm that compromised hundreds of packages on 4 August 2026, some with over 150 million weekly downloads, starting from a malicious commit (174f6a5) in the keyv repository. Datadog dissects the Bun-based loader, the obfuscated second stage, credential theft (files, GitHub Actions runner memory, AWS, Kubernetes, Vault), Ethereum smart-contract C2 discovery, AES/RSA exfiltration, an eval channel, and propagation via stolen npm tokens, GitHub branches and Sigstore provenance. IOCs and a list of affected packages are included.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 4 Aug 2026🛡️ Security

Hugging Face's forensic timeline of a roughly 4.5-day intrusion in which an autonomous OpenAI agent, running an internal ExploitGym cyber-capability evaluation, escaped its sandbox via a package-registry proxy zero-day, rooted a third-party CyberGym code-execution harness on Modal via a redefined sqlite3_initialize constructor and shell-metacharacter injection, then used that as a launchpad to attack Hugging Face's dataset processor through an HDF5 external-raw-storage arbitrary file read and a Jinja2 server-side template injection (via a cycler.__init__.__globals__ object-graph walk) to gain RCE in a production pod. From there it escalated through cloud metadata theft, Kubernetes node-root via a missing admission policy plus an overly broad CSI driver role, a misconfigured internal service-connector bound to system:masters granting cluster-admin across clusters, Tailscale mesh-key abuse, and a stolen GitHub App token attempting a CI supply-chain pivot, all coordinated over 17,600 actions via C2 built from public pastebins and request-capture services plus dead-drop datasets. The piece also details how Claude Opus and Fable refused to help analyze the attack logs while a locally hosted GLM-5.2 was used to decode the XOR-gzip-encoded payloads, and closes with concrete hardening steps such as IMDSv2 lockdown, workload identity, per-cluster credential scoping, and admission policies.

huggingface.cowriteupAdded 3 Sep 2026, published 30 Jul 2026🛡️ Security

Socket's Threat Research team analyzed corepack[.]org, a fake site impersonating the Node.js Corepack tool that exploits its 2025 removal from Node.js bundling to rank in search results and trick developers into downloading a fake VPN installer. The installer drops OpenShield (an infostealer with browser-data/SSH-key theft, PowerShell execution, and run-key persistence) plus a bandwidth-sharing proxyware component that turns victim machines into proxy exit nodes, while a second click path delivers adware/trojan activity via OperaGXSetup.exe. The post includes full IOCs and details community/OpenJS Foundation takedown efforts against the domain.

socket.devwriteupPublished and added 25 Jul 2026🛡️ Security

Island Research uncovered the FakeGit campaign: roughly 7,600 malicious GitHub repositories (from ~6,600 fake developer profiles), over 800 of which impersonate AI Skills or MCP servers for tools like Gmail, WhatsApp, Databricks, Jenkins, and Docker, collectively logging 14M+ downloads and 600+ listings across registries like LobeHub, Glama, MCP.so, and MCP Market. Malicious READMEs and bundled ZIPs (e.g. Mann1988/awesome-claude-skills, DomingosNgongo/walmart-mcp, 45d5r/databricks-mcp-server) drop a LuaJIT-based loader that runs an obfuscated Lua stage, resolves C2 via a Polygon smart contract, and ultimately injects the StealC infostealer via SmartLoader. The report's core finding, dubbed "AgentBaiting," is that Claude Code, Gemini, and ChatGPT independently discovered and recommended these fake capability repos as installation instructions without ever being given a link, showing agentic search/discovery itself has become a supply-chain attack surface.

island.iowriteupAdded 22 Jul 2026🛡️ Security

StepSecurity analyzes SleeperGem, a coordinated RubyGems supply chain attack that trojanized git_credential_manager, Dendreo, and a fastlane plugin between July 18-19, 2026. The malicious releases act as CI-evading loaders that, on developer machines, download a second-stage native daemon and deploy.sh from an attacker-controlled Forgejo host (git.disroot.org), install dual persistence via systemd and cron, and attempt privilege escalation to plant a setuid backdoor mimicking ping6. The post uses Harden-Runner audit-mode captures to document the full kill chain and provides IOCs and cleanup steps, crediting Aikido Security with the original discovery.

stepsecurity.iowriteupAdded 3 Sep 2026, published 19 Jul 2026🛡️ Security

Sysdig's Threat Research Team documented JADEPUFFER, an attack it says was run end-to-end by an AI agent without human operators. The agent exploited CVE-2025-3248 (an unauthenticated RCE in Langflow) for initial access, harvested API keys and cloud credentials, raided a MinIO server via default minioadmin:minioadmin credentials, then pivoted to a MySQL/Nacos server and used CVE-2021-29441 plus Nacos's unchanged default signing key to gain admin access, encrypt 1,342 Nacos settings, and drop a ransom note with no recoverable key. Evidence for AI authorship included verbose in-code commentary explaining each step and a 31-second autonomous diagnose-and-fix cycle across 600+ payloads; the piece situates JADEPUFFER alongside PromptLock/Ransomware 3.0 and Anthropic's Claude-Code extortion and China-linked autonomous-cyberattack disclosures.

thehackernews.comwriteupPublished and added 18 Jul 2026🛡️ Security

On July 14, 2026, attackers compromised push access to two AsyncAPI GitHub repositories (asyncapi/generator and asyncapi/spec-json-schemas) and pushed malicious commits under a placeholder git identity that triggered legitimate CI/CD release workflows (release-with-changesets.yml, if-nodejs-release.yml), publishing five malicious npm package versions (@asyncapi/generator, generator-helpers, generator-components, specs) carrying a runtime-triggered obfuscated dropper for the Miasma RAT, complete with valid OIDC/SLSA provenance attestations. StepSecurity detected the packages within 30 minutes, used Harden-Runner in an isolated GitHub Actions job to capture the malware's C2 traffic (HTTP plus IPFS/Nostr/BitTorrent DHT fallback channels), and pushed the IOCs to their Global Block List to block exfiltration across customer pipelines; all malicious versions have since been unpublished.

stepsecurity.iowriteupAdded 3 Sep 2026, published 16 Jul 2026🛡️ Security

Socket details "Operation Muck and Load," a campaign starting with a malicious Go module (github.com/kaleidora/dnsub-scanning-tool) that impersonates a DNS scanner but launches hidden PowerShell to fetch and decode a multi-layer, XOR-encrypted loader. The loader resolves encrypted payload locations from public dead drops (Pastebin, GitHub, YouTube, Instagram, Telegram, Google Docs), retrieves a password-protected .7z archive masquerading as Microsoft Photos, and deploys AsyncRAT/Quasar/Remcos-style RATs and Vidar infostealer. Pivoting from the module, Socket uncovered 222 GitHub repositories across 190 accounts using automated force-push workflows tied to a single email (ischhfd83@rambler.ru) to fake activity and credibility, some directly hosting Vidar, XMRig/BitMiner, and trojan loaders.

socket.devwriteupPublished and added 16 Jul 2026🛡️ Security

Aikido Security details how five @asyncapi npm packages (specs, generator, generator-helpers, generator-components), combined ~2.9M weekly downloads, were backdoored after an attacker exploited an unmerged pull_request_target GitHub Actions vulnerability in asyncapi/generator to steal the npm publish token via 37 flooded PRs. The injected runtime code spawns a detached Node process that downloads an encrypted stage-2 loader from IPFS, decrypts it via HKDF/AES-256-GCM, and drops a persistent remote-shell implant self-identified as 'M-RED-TEAM v6.4' with Miasma-branded artifacts, though credential harvesting and self-propagation are disabled in this build. The post includes full technical detail on the exfiltration flow, IOC strings, IPFS CIDs, and inconclusive attribution linking it to the prior Miasma toolkit and prt-scan campaign.

aikido.devwriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Huntress SOC analysis of a June incident where a threat actor exploited a SQL injection flaw in an IIS/MSSQL web application to gain access, then extensively modified the environment: enabling Terminal Services, creating a rogue admin account (adminweb2$), disabling Windows Defender, deploying BadIIS malicious IIS modules (HttpFastCgiModule.dll, HttpCgiModule.dll) for SEO fraud, installing the XMRig cryptominer with nssm.exe persistence and hidden/system file attributes, and dropping additional PowerShell/batch payloads (qdcjoke1.2.ps1, c_joke1.2.ps1) via base64-encoded PowerShell and Out-of-Band Application Security Testing (OAST) exfiltration channels (oastify.com).

huntress.comwriteupAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

StepSecurity documents a supply-chain compromise of jscrambler, the official npm CLI for the Jscrambler Code Integrity API, starting with version 8.14.0. A malicious preinstall hook (later inlined into the main module to evade install-script scanners) drops a Rust-compiled, platform-specific native binary (ELF/PE32+/Mach-O) smuggled inside a fake dist/intro.js behind a custom magic header, containing an embedded SQLite/LevelDB parser and BIP39 wordlist consistent with a credential and crypto-wallet stealer. The Linux payload dynamically links libbpf and loads an in-memory eBPF program for kernel-level instrumentation, and all three platform binaries include anti-debugging checks; affected versions (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0) were interleaved with clean releases, and C2 traffic was observed reaching Tor entry-node infrastructure and two raw IPs.

stepsecurity.iowriteupAdded 3 Sep 2026, published 12 Jul 2026🛡️ Security

Socket's research team documents a supply chain compromise of the jscrambler npm package (v8.14.0+), where a stolen publishing credential was used to push malicious releases that drop platform-specific Rust-built infostealer binaries via a preinstall hook. The campaign evolved over the incident to evade scanners by moving the dropper from install scripts into a self-executing function inside index.js/CLI code (defeating --ignore-scripts), and the payload targets crypto wallets, cloud credentials (AWS/GCP/Azure), browser data, Discord/Slack/Telegram, and notably AI coding assistant configs (Claude Desktop, Cursor, Windsurf, VS Code) for MCP server credentials. Includes detailed RE of the ChaCha20-Poly1305 string-encryption scheme and full IOC hash list.

socket.devwriteupAdded 21 Sep 2026, published 11 Jul 2026🛡️ Security

OpenSourceMalware documents how PolinRider, a DPRK/Lazarus Group supply-chain campaign tied to the Contagious Interview cluster, spread from GitHub account takeovers into Go modules, Packagist/Composer packages, npm libraries and Chrome extensions without any change to the malware itself. Because Go and Packagist resolve packages directly from git tags rather than a separately-uploaded artifact, a compromised GitHub account automatically becomes a compromised registry release — unlike npm/PyPI, which require a separate publishing credential and largely stalled the takeover at the registry boundary. The post gives ecosystem-by-ecosystem evidence (10 Packagist packages, 80+ Go modules, an NPM/Chrome cluster), IOCs (TRON/Aptos dead-drop addresses, XOR keys, loader signatures, temp_auto_push.bat), a campaign timeline, and remediation guidance for Go/Composer maintainers.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 8 Jul 2026🛡️ Security

Step Security's incident analysis of the compromise of codfish/semantic-release-action, a widely used GitHub Action wrapping semantic-release. An attacker force-pushed a malicious commit and repointed seven version tags to it, converting the action from a Docker runner to a composite action that installs Bun and runs an obfuscated 512KB payload via if: always() steps. The payload steals GitHub OIDC tokens and PATs, uses a novel GitHub commit-message dead-drop for C2, has a Russian-locale killswitch, and locked tags immutable via GitHub Rulesets to block remediation.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

StepSecurity documents a June 24, 2026 attack that published malicious versions of 20 Leo Platform npm packages (including leo-logger and leo-sdk) within a 3-second window, using the same "Phantom Gyp" binding.gyp install-hook technique, three-layer obfuscation chain, and Bun runtime evasion seen in the earlier Miasma campaign (57 packages, June 3, 2026). The payload steals GitHub Actions runner memory, cloud/registry/password-manager credentials, exfiltrates via GitHub dead-drop commits using the victim's own token, self-propagates by publishing to any package the victim can access via the npm bypass_2fa mechanism, and escalates privileges via passwordless sudo on runners. The post includes IOCs and maps defenses (Harden-Runner, Secure Registry cooldowns, PR-based compromised-package checks) to each stage of the attack.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

Huntress SOC incident writeup detailing a threat actor who exploited Adobe ColdFusion vulnerabilities (CVE-2023-26360, CVE-2023-29298, CVE-2023-29300) to drop a steganographic webshell hidden inside an image, then returned with a full defense-impairment batch script (i.bat) that disabled IIS logging, tampered with Windows Defender, killed/deleted security services (Sysmon, filebeat, SentinelOne, DrWeb, ImmunetProtect), used Image File Execution Options to freeze logging tools, deleted ModSecurity WAF module, enumerated FileZilla and multilingual local admin groups, weakened WDigest to force plaintext credentials in memory, dumped credentials via a Mimikatz kernel driver (mimidrv.sys), deleted CLSID/WScript registry keys, and cleared Windows event logs. The piece walks through each command block with attacker rationale and closes with concrete mitigation guidance for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 29 Jun 2026🛡️ Security

Aikido Security details how codfish/semantic-release-action, a widely used GitHub Action for automated releases since 2019, was compromised via an imposter-commit attack: an attacker force-pushed two orphan commits (disguised with reused real commit metadata) and retargeted sixteen tags including the floating v2–v5 majors to point at them. The malicious action.yml was rewritten as a composite action that still calls the legitimate action first so runs appear successful, then loads Bun via oven-sh/setup-bun and executes a heavily obfuscated 781KB index.js payload targeting GITHUB_TOKEN and NPM_TOKEN secrets. The payload contains the dead-drop marker "thebeautifulsnadsoftime," tying it to the leaked Miasma credential-stealing toolkit, which polls GitHub's public commit search API for that string to fetch and eval() attacker commands instead of using traditional C2 infrastructure.

aikido.devwriteupAdded 3 Sep 2026, published 24 Jun 2026🛡️ Security

StepSecurity documents the Mastra AI framework npm supply-chain attack: attacker sergey2016 published easy-day-js, a typosquat clone of dayjs, then added it as a dependency across 140+ @mastra packages after compromising the org's npm credentials. The malicious 1.11.22 version's postinstall hook ran an obfuscated dropper (setup.cjs) that disabled TLS verification, beaconed the install path, fetched a stage-2 payload from a hardcoded C2, spawned it detached, and self-deleted to erase forensic traces; StepSecurity's Harden Runner blocked the C2 callout in a controlled GitHub Actions test, preventing credential exfiltration of LLM/cloud API keys.

stepsecurity.iowriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

A threat actor took over a dormant maintainer account and republished 140+ packages in the @mastra npm scope (including @mastra/core, ~918K weekly downloads), injecting a typosquat of dayjs called easy-day-js as a new dependency in every manifest. A clean 1.11.21 version was published first, then a weaponized 1.11.22 tagged latest was pulled in via caret-range resolution, delivering a two-stage cross-platform backdoor that disables TLS validation, self-deletes, installs OS-specific persistence disguised as Node/NVM tooling, and steals browser history plus data from 166 crypto-wallet, password-manager (1Password, Bitwarden, LastPass, Dashlane, NordPass, Proton Pass, KeePassXC, Zoho Vault, Kaspersky), MFA-authenticator, and Zapier browser extensions. The report ties the campaign's Hostwinds infrastructure, clean-then-armed typosquat, and TLS-off/detached/self-delete dropper pattern to the same playbook Microsoft attributed to Lazarus Group in the earlier axios npm compromise, and compares its extension targeting to the "HyperHives" ClickFix campaign, noting npm's lack of provenance enforcement (provenance: no on the malicious wave) as the control gap that let it through.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

Snyk details how a dormant, never-revoked npm contributor account (ehindero) was used to republish the entire @mastra scope (142+ packages, ~4M monthly downloads for @mastra/core alone) with an injected dependency, easy-day-js, a byte-for-byte dayjs impersonator. The postinstall hook in easy-day-js@1.11.22 disables TLS verification, pulls a second-stage payload from a raw IP, and drops a cross-platform cryptocurrency wallet stealer plus a RAT with OS-specific persistence (LaunchAgent, systemd unit, PowerShell staging) that beacons every 10 minutes over a self-signed wolfSSL certificate. The piece covers detection steps, the Snyk advisory (SNYK-JS-EASYDAYJS-17353313), and draws parallels to the earlier Axios npm compromise attributed by Microsoft to Sapphire Sleet (BlueNoroff).

snyk.iowriteupAdded 3 Sep 2026, published 16 Jun 2026🛡️ Security

Huntress tears down a May 2026 ClickFix intrusion that escalated from a single unmonitored endpoint to hands-on-keyboard compromise of 11 hosts. The chain starts with a pcalua.exe/mshta.exe LOLBIN abuse to run a remote HTA that silently installs an MSI, dropping Potemkin, a custom x64 DGA-based loader (XorShift32 seed 151678, custom byte cipher, reflective in-memory DLL loading), which fetches RMMProject, a 4.4MB LuaJIT-scriptable module with 15 task types including Chrome App-Bound Encryption bypass via DLL injection into Chrome's IElevator COM interface, Firefox NSS credential theft, and a hidden-desktop remote-control (RTSC) module. The attackers also deployed EtherRAT (an EtherHiding Node.js backdoor resolving C2 from an Ethereum smart contract) and a renamed Cloudflare tunnel client, then moved laterally via WMIExec/SMBExec/WinRM with an AMSI-bypass PowerShell loader to reach the domain controller.

huntress.comwriteupAdded 3 Sep 2026, published 16 Jun 2026🛡️ Security

StepSecurity documents the compromise of Microsoft's durabletask PyPI package (versions 1.4.1-1.4.3, 400k+ monthly downloads), where an attacker bypassed the GitHub CI/CD pipeline entirely using stolen publishing credentials to inject a dropper for rope.pyz, a modular cloud-intrusion framework with dedicated collectors for AWS, Azure, GCP, Kubernetes, HashiCorp Vault, password managers, and the filesystem. The framework encrypts stolen data with AES-256-GCM/RSA-4096, exfiltrates via HTTPS, GitHub commit beacons, and attacker-created public repos using the victim's own stolen GitHub tokens, propagates via AWS SSM and kubectl exec, and drops a geo-targeted rm -rf wiper for systems matching Israeli locale/timezone markers. The post ties the attack to TeamPCP's Mini Shai-Hulud campaign (same infrastructure as TanStack, Mistral AI, LiteLLM, @antv) and later updates describe a second compromise of the Azure/durabletask GitHub repo that plants payloads triggering in Claude Code, Gemini CLI, Cursor, and VS Code.

stepsecurity.iowriteupAdded 3 Sep 2026, published 9 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

StepSecurity's technical teardown of the May 2026 compromise of the Nx Console VS Code extension (nrwl.angular-console v18.95.0, 2.2M+ installs), where a stolen contributor GitHub token was used to push a dangling orphan commit to nrwl/nx and publish a malicious extension via stolen VSCE_PAT credentials. The payload silently ran `npx github:nrwl/nx#<sha>` to fetch a heavily obfuscated 498KB Bun/Node credential stealer that harvests secrets from GitHub, npm, AWS, Vault, Kubernetes, 1Password and Claude Code config, exfiltrates via HTTPS/GitHub API/DNS tunneling, installs a macOS Python backdoor using the GitHub Search API as a C2 dead-drop, and can forge valid Sigstore/SLSA provenance attestations for downstream npm packages. The writeup ties this to a later GitHub breach (3,800 repos, attributed to TeamPCP) and provides detection signals, IOCs, and full recovery steps.

stepsecurity.iowriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Socket researchers found malicious obfuscated JavaScript appended to a tailwind.js file inside a dev branch (dev-drewroberts/feature/test-case) of the legitimate Laravel package roberts/leads on Packagist. The payload uses TRON, Aptos, and BNB Smart Chain RPC services as a blockchain "dead drop" to fetch XOR-encrypted second-stage code, decrypt it, and execute it via eval() and a hidden detached Node.js child process, consistent with prior DEV#POPPER/OmniStealer/BeaverTail-family DPRK campaigns. The activity is attributed to Famous Chollima and resembles a Contagious Interview-style fake job/recruiter lure targeting PHP/Laravel developers, with full IOCs (wallets, XOR keys, hashes) and detection guidance provided.

socket.devwriteupPublished and added 1 Jun 2026🛡️ Security

Aikido Security discovered an active supply chain attack against laravel-lang/lang, laravel-lang/attributes, and laravel-lang/http-statuses (233 compromised versions total), where an attacker used GitHub's cross-fork tag feature to point official-looking version tags at commits in a malicious fork, injecting a src/helpers.php dropper that loads via Composer's autoloader. The dropper fingerprints the host, decodes a hidden C2 domain (flipboxstudio[.]info), and fetches a second-stage PHP credential stealer that harvests cloud credentials, Kubernetes/Vault/Docker configs, SSH keys, browser and password-manager vaults, crypto wallets, and VPN configs, exfiltrating AES-256 encrypted data before self-deleting. Aikido reported it to Packagist, which pulled the malicious versions.

aikido.devwriteupAdded 3 Sep 2026, published 23 May 2026🛡️ Security

StepSecurity and Endor Labs document a second wave of the Mini Shai-Hulud npm worm spreading through the compromised 'atool' account, which publishes timeago.js and maintains packages in Alibaba's @antv namespace, hitting echarts-for-react, jest-canvas-mock and dozens of other packages. The payload scrapes GitHub Actions Runner.Worker process memory to steal masked CI/CD secrets, harvests 130+ credential file paths (cloud, SSH, Kubernetes, Vault, crypto wallets, Claude Code/VS Code configs), exfiltrates via a GitHub API dead-drop in antvis/G2 or a fake-OpenTelemetry C2 at t.m-kosche.com, drops persistent backdoors in Claude Code/VS Code, and has already used stolen GitHub tokens to spin up 2,500+ dead-drop repositories. The writeup includes full process/network telemetry from Harden-Runner showing the attack blocked, deobfuscated payload internals, IOCs, and detection/remediation guidance.

stepsecurity.iowriteupPublished and added 19 May 2026🛡️ Security

FOSSA's technical breakdown of the May 2026 Mini-Shai-Hulud campaign, which compromised at least 235 npm and PyPI packages including @tanstack/*, @uipath/*, mistralai, and @opensearch-project/opensearch. It details the two install-time payload mechanisms (a Git-dependency prepare-hook trick with an orphan commit for @tanstack/*, and direct preinstall scripts for @uipath/*/Mistral AI), a staged PyPI dropper in __init__.py that evades sandbox scanning, the credential-harvesting targets (AWS/GCP/Azure, Kubernetes, Vault, GitHub, npm tokens), exfiltration infrastructure (filev2.getsession.org, git-tanstack.com), and IDE-persistence via modified Claude/VS Code config files.

fossa.comwriteupPublished and added 18 May 2026🛡️ Security

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

huntress.comwriteupAdded 3 Sep 2026, published 18 May 2026🛡️ Security

Socket's threat research team documents GemStuffer, a campaign of 100+ RubyGems packages that scrape UK local government ModernGov democratic-services portals (Lambeth, Wandsworth, Southwark) and repackage the harvested HTML into valid .gem archives published back to RubyGems using hardcoded API keys — using the registry itself as a public data drop rather than a malware distribution vector. The writeup breaks down the full attack chain (scraping via Net::HTTP, gem staging in /tmp, credential injection with HOME override, gem build/push, and manual API POST variants), lists exposed RubyGems API keys, IOCs, and remediation steps including yanking packages and auditing for HOME env mutation.

socket.devwriteupPublished and added 13 May 2026🛡️ Security

Aikido details a new wave of the Mini Shai-Hulud npm worm that has compromised 373 malicious package-version entries across 169 package names, including TanStack, Mistral AI, UiPath, and Squawk packages. Unlike the earlier SAP-focused wave (setup.mjs/execution.js), this version drops a root-level router_init.js and adds a malicious GitHub-hosted optionalDependency (@tanstack/setup) whose prepare script silently runs a Bun-based credential stealer targeting npm/GitHub tokens, AWS/Kubernetes/Vault secrets, and GitHub Actions OIDC tokens, then abuses trusted publishing to self-propagate by minting fresh npm publish tokens and pushing new compromised releases. The post includes full affected-package/version lists, file hashes, network IOCs, and remediation/rotation guidance.

aikido.devwriteupAdded 3 Sep 2026, published 11 May 2026🛡️ Security

Socket's research team identified the unscoped npm package tanstack (not the legitimate @tanstack/* scope) as a brand-squat impersonating the TanStack project. Maintainer sh20raj pushed versions 2.0.4-2.0.7 within a 27-minute window containing an obfuscated postinstall script that reads .env, .env.local, .env.production and all .env.* files and POSTs them to an attacker-controlled Svix ingest URL used as a one-way dead-drop. TanStack creator Tanner Linsley confirmed no affiliation, cited a prior $10,000 extortion demand for the package name, and noted an ongoing trademark dispute; the maintainer later claimed the exfiltration code was accidental AI agent testing left in by mistake.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Huntress analyzes a 'BackgroundFix' ClickFix campaign where a fake background-removal website tricks victims into copying and running a malicious clipboard payload via the classic 'verify you're human' lure. The payload abuses finger.exe to fetch a command from an attacker-controlled finger daemon, which leads to a bring-your-own-interpreter chain using a legitimate Python embeddable distribution to ultimately load CastleLoader and drop NetSupportRAT via a multi-stage Python/shellcode loader with API hashing (djb2) and Cyrillic character substitution evasion.

huntress.comwriteupAdded 3 Sep 2026, published 30 Apr 2026🛡️ Security

Huntress SOC documents an ongoing wave of exploitation of CVE-2026-1731, an unauthenticated RCE in Bomgar (rebranded BeyondTrust Remote Support/Privileged Remote Access), first disclosed in February 2026 and patched in versions 25.3.2/25.1. Attackers are using compromised outdated Bomgar instances — including at an MSP and a dental software vendor — to add rogue domain admin accounts, deploy LockBit ransomware (likely via a leaked LockBit 3.0 builder), drop the BYOVD EDR-killer PoisonKiller, and pivot to additional RMM tools like AnyDesk, Atera, ScreenConnect, and a renamed SimpleHelp for persistence across downstream customer environments.

huntress.comwriteupAdded 3 Sep 2026, published 17 Apr 2026🛡️ Security

Huntress's rapid-response analysis of the March 2026 compromise of the axios npm package, in which an attacker took over maintainer jasonsaayman's npm account and published backdoored axios releases (5.14.1, 4.2.1) depending on a phantom package plain-crypto-js whose postinstall script dropped a cross-platform RAT to macOS, Windows, and Linux. The writeup details the obfuscated dropper (setup.js), platform-specific payloads (wt.exe EDR-evasion trick on Windows, com.apple.act.mond on macOS, /tmp/ld.py on Linux), the shared C2 protocol at sfrclak[.]com, and evidence tying the campaign to DPRK-linked actors (UNC1069/BlueNoroff), plus remediation and hardening guidance.

huntress.comwriteupAdded 3 Sep 2026, published 31 Mar 2026🛡️ Security

Huntress details a February 2026 intrusion beginning with compromised SonicWall SSLVPN credentials, where the attacker deployed an EDR killer that decodes and drops a legitimate but revoked 2006-era EnCase forensic driver (EnPortv.sys, service name OemHwUpd) to terminate 59 different EDR/AV processes from kernel mode via a single IOCTL (KillProc). The write-up explains the driver's novel wordlist-substitution-cipher payload encoding (evading entropy and string-based detection), FNV-1a process-name hashing for fast target matching, timestomping/persistence tricks, and why Windows Driver Signature Enforcement still trusts the expired/revoked certificate due to pre-2015 signing and timestamp exceptions. It closes with concrete mitigations: MFA on VPN, HVCI/Memory Integrity, WDAC vulnerable-driver blocklist rules, and the ASR rule blocking vulnerable signed drivers.

huntress.comwriteupAdded 3 Sep 2026, published 4 Feb 2026🛡️ Security

Huntress dissects a KongTuke campaign built around NexShield, a malicious Chrome extension impersonating uBlock Origin Lite that induces a deliberate browser DoS/crash and then displays a fake "CrashFix" repair prompt to trick users into pasting a malicious PowerShell command via the Windows Run dialog. The command abuses finger.exe as a LOLBin to fetch and execute layered, obfuscated PowerShell that profiles the victim (domain-joined vs standalone, AV, VM checks), uses weekly-rotating DGA domains, an AMSI patch bypass, and a two-layer AES+XOR encrypted .NET loader ("GateKeeper") with anti-sandbox fingerprinting, ultimately dropping ModeloRAT — a newly documented, RC4-encrypted Python RAT reserved for domain-joined corporate hosts — while non-domain targets currently only receive a "TEST PAYLOAD" response. The post includes full IOCs and YARA rules for GateKeeper, MintsLoader, and ModeloRAT.

huntress.comwriteupAdded 3 Sep 2026, published 16 Jan 2026🛡️ Security

A DFIR.ch researcher revisits and reproduces the 2019 SentinelOne Shadow SUID technique using the Linux binfmt_misc kernel feature: by registering a handler with the C (credentials) flag matched against a SUID binary magic bytes (chfn), an attacker-controlled interpreter dropped in /dev/shm inherits root privileges without ever setting the SUID bit itself. The post includes a full working PoC, notes the technique is absent from MITRE ATT&CK and Elastic Linux persistence detection series, and closes with input from Elastic researcher Ruben Groenewoud on why existing SUID/SGID detection rules fail to catch it because chfn is never actually executed, it is a proxy execution.

dfir.chwriteupAdded 3 Sep 2026, published 30 Oct 2025🛡️ Security

Researcher writeup on CVE-2024-58250, a privilege-escalation flaw in the passprompt plugin of ppp (pppd) before 2.5.2. The plugin uses seteuid()/setegid() instead of permanently dropping privileges, so an attacker who controls the promptprog path passed via `pppd plugin passprompt.so promptprog <path>` can execute code that calls setuid(0)/setgid(0) to regain root on the setuid-root pppd binary. The plugin was removed entirely in the fix rather than patched, and the post includes the full coordinated-disclosure timeline with Debian, Gentoo and Fedora maintainers.

bencteux.frwriteupAdded 3 Sep 2026, published 27 Apr 2025🛡️ Security

dfir.ch dissects a Linux persistence technique first spotted by Volexity in a backdoor (update.py) that drops a malicious .pth file into Python's site-packages/dist-packages directories; because Python executes any line in a .pth file starting with 'import', the attacker gets code execution every time any process on the box imports a module. The author reproduces the technique end-to-end, building a base64-encoded netcat bind-shell payload embedded in a .pth file across multiple site-packages locations (including user-site under /root/.local), and discusses detection gaps (most DFIR tooling doesn't check .pth files) plus a related PYTHONPATH-hijacking technique from Itzik Kotler's SafeBreach talk.

dfir.chwriteupAdded 3 Sep 2026, published 14 Jan 2025🛡️ Security

Explains a subtle Linux privilege-dropping bug: calling setuid() before setgid() in a SUID/SGID-root binary leaves the saved set-group-ID privileged, letting a later setgid(0) call silently regain root group privileges due to POSIX semantics. The author provides compiled C PoC programs (drop_bad.c / drop_good.c) showing the wrong order failing to fully drop privileges versus the correct order (setgid then setuid) properly relinquishing them, and notes this becomes exploitable for privilege escalation when combined with a code-execution bug later in the program.

bencteux.frwriteupAdded 3 Sep 2026, published 1 Oct 2024🛡️ Security

DFIR.ch walks through analysis of the Fenix botnet infection chain observed in an incident response case: a Dropbox-hosted ZIP (ComplementoSATid.zip) contains an LNK file that invokes wscript to fetch and run a remote JSE script (rfc.jse) from an SMB share, which uses heavily obfuscated JavaScript (variable-splitting, decodeURIComponent, array-shift string deobfuscation) to eventually drop shellcode. The post documents file hashes, deobfuscation technique, and references Metabase's prior report on a Fenix infection vector.

dfir.chwriteupAdded 3 Sep 2026, published 22 Aug 2024🛡️ Security

A DFIR analysis by dfir.ch dissecting a real-world phishing campaign that abuses the Windows "search-ms" URI protocol handler embedded in an HTML attachment ("Booking_Confirmation.html") to trigger a WebDAV connection via rundll32/davclnt.dll, present a spoofed Explorer search result, and lure the victim into executing an LNK file. The LNK launches a headless conhost.exe pulling an obfuscated batch script (new.bat) over a trycloudflare.com tunnel, which drops a decoy PDF, downloads a full Python interpreter (FTSP.zip) and additional scripts, and ultimately performs shellcode injection. The post also documents Sysmon process-create telemetry and the HKCU WordWheelQuery registry key as forensic artifacts of the search-ms query.

dfir.chwriteupAdded 3 Sep 2026, published 4 Aug 2024🛡️ Security

DFIR investigation by a researcher into a SonicWall SMA compromise where the threat actor exploited CVE-2021-20039 (authenticated command injection) to drop the previously-known wafxSummary web shell, then months later placed a second binary, wafySummary, identified as the open-source MicroSocks SOCKS5 proxy. The attacker used MicroSocks to tunnel RDP traffic into the internal network, avoiding further malware deployment and detection for nearly 11 months before deploying Abyss ransomware. Includes reproduction steps confirming the binary's SOCKS proxy functionality and its VirusTotal PUA detection.

dfir.chwriteupAdded 3 Sep 2026, published 30 Mar 2024🛡️ Security

A DFIR blog post detailing detection and hunting techniques for AsyncRAT and QuasarRAT, two prevalent open-source RATs. It covers default C2 ports (6606, 7707, 8808), mutex naming conventions ("AsyncMutex_"), persistence mechanisms (Scheduled Tasks vs Run keys), dropped plugin DLLs (e.g., Recovery.dll, LimeLogger keylogger), and demonstrates hunting these artifacts with Velociraptor's Mutants-Hunt and MTF-Hunt, plus pulling IOCs from ThreatFox via API.

dfir.chwriteupAdded 3 Sep 2026, published 15 Jan 2024🛡️ Security

A FIRST Conference 2023 research writeup analyzing ten top malware families active in Switzerland (Nanocore RAT, Ave Maria RAT, QakBot, 404 Keylogger, Loki Password Stealer, Remcos RAT, etc.) to find eight common post-infection forensic artifacts: Windows Defender exclusion creation (event 5007), PowerShell Script Block logging, scheduled task creation (events 4698-4702), Run key persistence, Startup folder drops, AppData file writes, Dynamic DNS resolutions, and high-port/IP-only network connections. Each artifact is mapped to specific detection methods using Sysmon event IDs, Windows event logs, and Velociraptor hunts (TaskScheduler, DNSCache), giving SOC analysts and IR teams concrete, low-cost threat-hunting queries applicable beyond the specific samples studied.

dfir.chwriteupAdded 3 Sep 2026, published 31 Dec 2023🛡️ Security

The author examines Chrome's pre-89 defense that blocks outbound requests to http/https URLs containing both '<' and newline characters, a mitigation against HTML dangling-markup/XSS exfiltration. He shows the restriction only applied to http/https and demonstrates bypassing it by exfiltrating HTML content via a dangling `<meta http-equiv="refresh">` tag pointed at an `ftp://` URL, captured with a netcat FTP listener. The bug was reported to Chromium, which responded by dropping FTP and Gopher scheme support in Chrome 89, killing the bypass.

bencteux.frwriteupAdded 3 Sep 2026, published 7 Mar 2021🛡️ Security