Malware

Attacks commenced with the delivery of artifacts masquerading as legitimate apps.

Malicious actors established repositories purporting to be a Telegram Bitcoin wallet bot.

Suspected Chinese-speaking threat actors distributed malicious emails with a ZIP archive.

Attacks commenced with the execution of seemingly harmless files that install an evasive library.

SecurityWeek reports that North Korean hackers have leveraged fraudulent job offers to compromise freelance software developers with malicious payloads as part of the DeceptiveDevelopment attack campaign, which has been underway since early last year.

Security researchers confirmed the malware’s nature after analyzing samples that mimicked popular apps such as WhatsApp as well as cellphone provider customer support tools.

First of the free tools is a comprehensive Semgrep and Opengrep ruleset that could be used in continuous integration and continuous deployment pipelines, which has yielded 94.3% and 88.4% accuracy in identifying nefarious code in PyPI and NPM packages, respectively.