In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2491 articles
Hunt.io details malicious Axios npm releases that installed cross-platform RATs through an obfuscated dropper, and attributes the campaign to TA444/BlueNoroff based on malware and infrastructure overlaps.
Infoblox and Confiant analyzed Keitaro abuse across DNS, email and ad telemetry, finding large-scale domain registration, conditional routing, cloaking and cookie collisions. They also detail cracked licenses and Keitaro’s response to abuse reports.
A hijacked axios maintainer account published versions 1.14.1 and 0.30.4 that pulled in plain-crypto-js, whose install script deployed a cross-platform RAT. Datadog traced the chain, C2 behavior and payload bugs; npm removed the packages and revoked tokens.
Researchers report that attackers compromised an Axios maintainer’s npm account and published two releases with a malicious post-install dependency that deploys OS-specific RATs. Downstream impact is unknown; users are advised to pin clean versions and rotate exposed…
The article reports that attackers used a hijacked Axios npm maintainer account to publish versions 1.14.1 and 0.30.4 with a phantom dependency that deployed cross-platform RAT payloads; the releases were removed and remediation is advised.
An analysis describes how attackers allegedly used compromised axios maintainer accounts to publish versions with a malicious dependency. Its postinstall script delivered platform-specific RATs; npm removed the versions and revoked tokens.
Researchers describe an active campaign attributed with medium-high confidence to DPRK-linked actors, compromising 400+ GitHub repositories through malicious VS Code tasks. Payloads steal credentials and maintain access, using blockchain C2 and newly deployed endpoints.
Analysis of a file disguised as an MP3 found an obfuscated PowerShell loader delivering a stealer and PureHVNC RAT. The author assesses TeamPCP attribution as low confidence, citing no shared infrastructure or tooling.
A compromised axios maintainer account published two malicious npm versions that installed a dropper and platform-specific RATs. The releases were removed within hours; teams are urged to check for execution and rotate exposed credentials.
The analysis details ResokerRAT’s Telegram-based command channel and its capabilities, including screenshot capture, file downloads, registry-based persistence, attempted privilege escalation, and anti-analysis measures.
Huntress reports attackers compromised the axios npm maintainer account and published malicious releases that installed a cross-platform RAT. At least 135 monitored endpoints contacted C2 infrastructure; affected systems should be rebuilt and credentials rotated.
StepSecurity reported that two compromised Axios npm releases installed a malicious dependency whose postinstall script deployed a RAT on macOS, Windows, and Linux. The article recommends downgrading, checking for compromise, and rotating credentials.
Trend Micro reports that a hijacked Axios maintainer account published two malicious npm releases that added a phantom dependency. Its postinstall hook deployed a cross-platform RAT and attempted to erase evidence; npm removed the compromised versions.
A technical analysis of Xloader versions 8.1 onward details harder-to-automate code obfuscation, layered encryption and decoy C2 servers, plus how the malware steals credentials and receives commands to run or download payloads.
Wiz reports that credentials stolen in TeamPCP supply chain attacks were used to explore cloud environments, execute code through GitHub workflows and AWS ECS, and exfiltrate repository and cloud data.
Blackpoint says it found RoadK1ll, a Node.js implant that uses an outbound WebSocket tunnel to relay TCP traffic and help operators pivot from a compromised host to internal systems.
Sekoia analyzes EvilTokens, a phishing-as-a-service kit that uses Microsoft device-code flows to steal tokens and enable account access, reconnaissance, and BEC. The report details its backend, campaigns, and tracking methods.
Researchers detail DeepLoad’s ClickFix delivery, credential theft, APC injection, USB spread and WMI reinfection. The article also describes Kiss Loader’s chain to Venom RAT; the scale of those attacks is unknown.
Check Point Research demonstrated that DNS tunneling could bypass ChatGPT’s code-execution runtime isolation to exfiltrate conversation data and enable a remote shell. OpenAI confirmed the issue and deployed a fix on February 20, 2026.
ReliaQuest describes DeepLoad, a ClickFix-delivered campaign using an obfuscated PowerShell loader, in-memory APC injection, credential theft, USB spread and WMI persistence that triggered reinfection after cleanup.
StepSecurity analyzed malicious axios versions 1.14.1 and 0.30.4, which added plain-crypto-js to launch a cross-platform RAT dropper. Runtime testing captured C2 contact and manifest replacement; npm removed the releases.
Malicious Telnyx Python SDK versions 4.87.1 and 4.87.2 used WAV steganography to deliver credential-stealing payloads on Linux/macOS and Windows. PyPI quarantined the packages after about 6.5 hours; affected users should downgrade to 4.87.0 and treat importing systems
A technical report says TeamPCP uploaded malicious telnyx Python SDK versions 4.87.1 and 4.87.2 to PyPI. The packages triggered credential theft and persistent payloads across Windows, Linux, macOS, and Kubernetes environments before PyPI quarantined them.
Malwarebytes describes Infinity Stealer, a macOS infostealer delivered through a fake Cloudflare CAPTCHA and a Nuitka-built loader. It can collect credentials, Keychain entries, wallets, screenshots and developer secrets, then exfiltrate data over HTTP.
