Malware

BleepingComputer reports that two dozen new VSCode packages on the Microsoft Visual Studio Marketplace and OpenVSX including prettier-vsc.vsce-prettier, clangdcode.clangd-vsce, flutcode.flutter-extension, bphpburn.icons-vscode, and yamlcode.yaml-vscode-extension have facilitated the distribution of the Glassworm malware in a third wave of attacks following the containment of initial infections.

Hybrid cryptocurrency mixing service Cryptomixer, which facilitated laundering of illicit proceeds from ransomware attacks and other criminal activities, has been dismantled by Swiss and German police as part of Operation Olympia between Nov. 24 and 28, reports BleepingComputer.

Threat operation Tomiris has harnessed more sophisticated techniques to stealthily compromise Russian and Central Asian government officials and diplomats since early this year, according to GBHackers News.

Total Android device hijacking sought by novel Albiriox malware Newly emergent Albiriox malware-as-a-service believed to have been managed by Russian-speaking threat actors has been targeting mobile banking and cryptocurrency apps, as well as facilitating total Android device takeovers, GBHackers News reports.

South Korean cryptocurrency exchange Upbit was noted by its operator Dunamu to have had $30 million worth of assets stolen from its Solana wallet on Nov. 27 due to a security weakness that enabled private key inferencing, Cybernews reports.

Security Affairs reports that almost 2 million individuals were confirmed to have had their information stolen following the Qilin ransomware attack against major Japanese brewery firm Asahi Group Holdings in September.

Infosecurity Magazine reports that the North Korea-linked FlexibleFerret macOS malware had its attack chain revamped to enable increased stealth and long-term persistence in targeted systems as part of a Contagious Interview campaign.

The RelayNFC malware, described as lightweight and evasive, utilizes a Hermes-compiled payload with a JavaScript engine to stealthily capture and relay card data to attackers.