Malware

ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code.

The attack chain begins with a single line of Python code executed via an unauthenticated Langflow API endpoint.

The "Google Notes" extension, identified by McAfee researchers, operates by requesting broad permissions, including access to all websites, browsing history, and the clipboard, which are unusual for a note-taking application.

The Ousaban campaign begins with a phishing PDF disguised as a corrupted file, prompting users to click an "Update" button.

This activity is part of a large, multi-language campaign that distributes malicious installer archives hosted on spoofed websites, according to a recent report by The Hacker News.

RustDuck targets a variety of IoT devices, including routers, cameras, and Android set-top boxes, as well as exposed servers running software like ThinkPHP and Jenkins.

The TaskWeaver loader delivers Djinn Stealer, which targets dev credentials and AI tokens.

The StegoAd campaign employed steganography to hide malicious JavaScript within image and font files, making the extensions appear legitimate and functional.