Malware

Thirty-six malicious npm packages masquerading as Strapi CMS plugins have been spreading multiple payloads enabling Redis and PostgreSQL abuse, reverse shell injections, credential harvesting, and persistent implant deployment, according to The Hacker News.

The malware, identified by cybersecurity firm Kaspersky, has appeared in apps on both iOS and Android platforms, primarily targeting cryptocurrency users in Asia.

The ChatGPT Ad Blocker extension employed a DOM cloning technique to copy and filter conversations, focusing on text longer than 150 characters.

Infosecurity Magazine reports that Windows users across South Korea have been subjected to attacks involving illicit LNK files that trigger multi-stage compromise.

Threat operation REF1695 has been harnessing counterfeit installers to facilitate multiple attack campaigns delivering remote access trojans and cryptocurrency mining malware since November 2023, reports The Hacker News.

The campaign targeted approximately 1 million users across various sectors, including government, healthcare, education, and finance.

Discovered by Varonis Threat Labs, Storm infostealer operates as a malicious subscription service, targeting multiple browsers like Chrome, Edge, Firefox, and Waterfox.

Researchers at Zscaler's ThreatLabz discovered a GitHub repository disguised as a leaked TypeScript source code for Anthropic's Claude Code CLI.