Malware

Editorial illustration of an npm package emitting nested loader boxes toward a node cluster, marking compromised @asyncapi packages delivering a botnet loader.

Supply Chain Attack

Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader

Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.

Editorial illustration of many package boxes merging into a wave bending a server, representing 148 malicious npm packages building a browser DDoS botnet.

Supply Chain Attack

148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet

A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.

Malware

“CrashStealer” macOS Malware Reportedly Uses a Notarized Dropper to Pass Gatekeeper

A macOS notarization-abuse malware disclosure — defender review for Mac-issuing organizations this week.

Flat white line-art of an open package box linked to a document card — jscrambler 8.14.0 npm release compromise.

Supply Chain Attack

jscrambler 8.14.0 npm Release Compromised to Drop a Rust Infostealer at Install

Another JavaScript-ecosystem SDK compromise — defender inventory work continues this week.

Flat white line-art of a shield beside a monitoring screen — Microsoft research on the GigaWiper espionage-and-destructive malware family.

Threat Intelligence

Microsoft Details "GigaWiper," a Malware Family Combining Espionage and Destructive Capabilities

A new destructive-plus-espionage malware family lands on defenders' desks — detection-engineering review this week.

phishing

Microsoft and Trend Micro Document Blockchain-Abuse Phishing Against EU and Asia Hospitality

Two vendor-documented hospitality-sector phishing campaigns land the same week — sector-advisory work for hotel-industry defenders this week.

Flat white line-art of two malware boxes wired into a central hub with a power-disconnect switch — Operation Endgame Amadey and StealC disruption.

Cybercrime

Microsoft and Europol Disrupt Amadey and StealC Infrastructure in Operation Endgame Phase

Operation Endgame's latest phase takes out Amadey and StealC's shared infrastructure, with Europol and Microsoft reporting 326 servers actioned, 142 domains seized, and roughly 27 million stolen credentials recovered.

Flat white line-art of a large magnifier over a document beside a simple alert card — North Korean-linked NarwhalRAT research disclosure.

Nation-State Cyber Threats

Researchers Detail a North Korean-Linked Campaign Using the NarwhalRAT Family

Another published-research disclosure for defenders to review for indicator relevance: researchers at Genians named NarwhalRAT, a remote access trojan they attribute to a North Korean-linked cluster, and published indicators worth checking against your own telemetry.

Flat white line-art of a key in a server with a hidden duplicate key behind it — decade-long Linux PAM authentication backdoor.

Nation-State Cyber Threats

Chinese APT Backdoors Linux PAM Login Software for Nearly a Decade

One backdoored authentication module, one isolated network, ten years of undetected access — a reminder that critical authentication primitives are a forever-target.

Flat white line-art of a compass needle turning to point back at a single building — OceanLotus domestic targeting.

Nation-State Cyber Threats

ESET Publishes OceanLotus (APT32) Research Update — Domestic Targeting in Vietnam

ESET's research update reframes OceanLotus — the targeting is now inward.

Flat white line-art of an opened archive folder spilling a single document — WinRAR flaw exploited against Ukraine.

Nation-State Cyber Threats

WinRAR Flaw Exploited by Russia-Aligned Groups Against Ukrainian Organizations

Consumer compression software remains a reliable initial-access vector in the Russia-Ukraine cyber theater.

Flat white line-art of a sealed toolbox opening above a row of code repositories — Miasma toolkit open-sourced on GitHub.

Supply Chain Attack

Miasma Supply-Chain Worm Open-Sourced on GitHub

Miasma's open-sourcing turns the previous day's Microsoft-repo incident into the first instance of a much broader supply-chain threat any actor can now reproduce.

See all