Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

[Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey MaaS Campaign Exploiting Repository Trust, and Supply Chain Attack Vectors

Source: https://ncse.info/github-malware-protection-supply-chain-crisis/

The reported security threat centers around a multifaceted crisis involving GitHub, where approximately 39 million secrets have been leaked, coupled with an active malware campaign leveraging the Amadey MaaS (Malware-as-a-Service) infrastructure. This campaign exploits the inherent trust placed in GitHub repositories to propagate malicious payloads, thereby facilitating supply chain attacks. The leaked secrets likely include sensitive credentials, API keys, tokens, and other confidential data inadvertently exposed in public or private repositories. Such exposure enables attackers to infiltrate systems, escalate privileges, and deploy malware. The Amadey MaaS campaign capitalizes on this by embedding malicious code within trusted repositories or dependencies, which unsuspecting developers or organizations may integrate into their software supply chains. This attack vector is particularly insidious because it exploits the trust model of software development ecosystems, where dependencies and code from GitHub are widely used without exhaustive vetting. The supply chain attack vector increases the risk of widespread compromise, as infected code can propagate through multiple organizations and projects. Although the severity is currently rated as low and no known exploits are reported in the wild, the scale of leaked secrets and the potential for exploitation through supply chain mechanisms present a significant latent risk. The minimal discussion and low Reddit score suggest early-stage awareness, but the presence of newsworthy keywords and an established source indicate the situation warrants close monitoring and proactive defense measures.

Detailed information about [Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey MaaS Campaign Exploiting Repository Trust, and Supply Chain Attack Vecto

[Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey MaaS Campaign Exploiting Repository Trust, and Supply Chain Attack Vectors - Live Threat Intelligence - Threat Radar | OffSeq.com

[Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey MaaS Campaign Exploiting Repository Trust, and Supply Chain Attack Vectors

Reddit Discussion: [Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey MaaS Campaign Exploiting Repository Trust, and Supply Chain Attack Vectors

A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands.

CVE-2025-26855 is a SQL injection vulnerability identified in the Articles Calendar extension versions 1.0.0 through 1.0.1.0007 for the Joomla content management system. This vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker to inject arbitrary SQL code into the backend database queries executed by the extension. Exploitation of this flaw could enable an attacker to manipulate the database, potentially leading to unauthorized data disclosure, data modification, or even complete compromise of the underlying database server. The vulnerability affects the Articles Calendar extension, which is used to display and manage calendar-based article content within Joomla websites. Since Joomla is a widely used CMS, especially among small to medium-sized enterprises and public sector websites in Europe, the presence of this vulnerability in a popular extension poses a significant risk. The lack of an available patch at the time of publication increases the urgency for organizations to implement mitigations. No known exploits are currently reported in the wild, but the nature of SQL injection vulnerabilities makes them attractive targets for attackers due to the potential for high-impact exploitation. The vulnerability does not require authentication or user interaction, increasing its risk profile. Given the technical details, attackers can craft malicious input that is improperly sanitized by the extension, leading to execution of arbitrary SQL commands on the backend database.

Detailed information about CVE-2025-26855: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Calendar extension

CVE-2025-26855: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Calendar extension for Joomla - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-26855: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Calendar extension for Joomla

A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands.

CVE-2025-26854 is a SQL injection vulnerability identified in the Articles Good Search extension versions 1.0.0 through 1.2.4.0011 for the Joomla content management system. This vulnerability arises due to improper neutralization of special elements used in SQL commands (CWE-89), allowing an attacker to inject arbitrary SQL code into database queries executed by the extension. Exploitation of this flaw could enable attackers to manipulate backend database queries, potentially leading to unauthorized data access, data modification, or deletion. Since the vulnerability exists in a Joomla extension, it affects websites using this specific plugin for article search functionality. The absence of a CVSS score indicates that the vulnerability has been recently published and not yet fully assessed. No known exploits are currently reported in the wild, but the nature of SQL injection vulnerabilities makes them highly attractive targets for attackers. The vulnerability does not require authentication or user interaction, increasing its risk profile. The technical root cause is the failure to properly sanitize or parameterize user-supplied input before incorporating it into SQL statements, which is a common and critical security oversight in web applications. Given Joomla's widespread use in Europe for various organizational websites, this vulnerability poses a significant risk to confidentiality, integrity, and availability of affected systems.

Detailed information about CVE-2025-26854: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Good Search extens

CVE-2025-26854: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Good Search extension for Joomla - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-26854: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomcar.net Articles Good Search extension for Joomla

This report details an ongoing campaign by a threat actor operating during Chinese time zone hours, targeting Chinese-speaking individuals and entities globally. Since June 2023, the actor has created over 2,800 domains for malware delivery, primarily targeting Windows systems through fake application download sites and update prompts. The actor has made operational changes, including anti-automation measures, reduced site tracker services, increased server distribution, and more discreet registration details. The campaign uses fake login pages, marketing apps, and cryptocurrency-related apps to distribute malware. The actor's motivations appear to be financially driven, potentially including credential theft, financial theft, and access brokering. The report emphasizes the importance of user awareness, enhanced security measures, and multi-layered defense strategies to counter this persistent threat.

The reported threat describes an ongoing malware delivery campaign attributed to a threat actor known as SilverFox, operating primarily during Chinese time zone hours and targeting Chinese-speaking individuals and entities worldwide. Since June 2023, this actor has registered over 2,800 domains designed to distribute malware, focusing on Windows platforms. The campaign employs social engineering tactics such as fake application download sites, fraudulent update prompts, fake login pages, and the distribution of malicious marketing and cryptocurrency-related applications. Operational security improvements by the actor include anti-automation techniques to evade detection, reduced use of site tracking services to limit exposure, increased distribution of command and control servers, and more discreet domain registration details to hinder attribution and takedown efforts. The malware delivery methods leverage common attack techniques including phishing (T1566.002), masquerading (T1036.005, T1036.004), credential access (T1078), code injection (T1055), and persistence mechanisms (T1547.001). The actor’s motivations appear financially driven, aiming to steal credentials, conduct financial theft, and broker access to compromised systems. The campaign’s scale and sophistication indicate a persistent threat that requires multi-layered defense strategies, including user education to recognize phishing and fake update prompts, enhanced endpoint protection, network monitoring for suspicious domain activity, and proactive threat intelligence sharing. The absence of known exploits in the wild suggests the campaign relies heavily on social engineering rather than zero-day vulnerabilities, but the broad targeting and operational improvements increase its potential impact.

Detailed information about Chinese Malware Delivery Domains: Part III. Get real-time updates, technical details, and mitigation strategies.

Chinese Malware Delivery Domains: Part III - Live Threat Intelligence - Threat Radar | OffSeq.com

Chinese Malware Delivery Domains: Part III

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plugin' function in all versions up to, and including, 4.7.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability is difficult to exploit due to timing requirements and environmental factors.

CVE-2025-7438 is a high-severity vulnerability identified in the MasterStudy LMS Pro plugin for WordPress, developed by StylemixThemes. This vulnerability arises from insufficient validation of file types in the 'install_and_activate_plugin' function, allowing authenticated users with Subscriber-level privileges or higher to upload arbitrary files to the server hosting the affected WordPress site. The core issue is classified under CWE-434, which pertains to unrestricted upload of files with dangerous types. Exploiting this vulnerability could enable an attacker to upload malicious files, potentially leading to remote code execution (RCE) on the server. However, exploitation is noted to be challenging due to timing constraints and environmental dependencies, which may limit the ease and frequency of successful attacks. The vulnerability affects all versions up to and including 4.7.9 of the plugin. The CVSS v3.1 base score is 7.5, reflecting high severity, with vector metrics indicating network attack vector (AV:N), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). No known exploits are currently reported in the wild, and no official patches have been released at the time of this report.

Detailed information about CVE-2025-7438: CWE-434 Unrestricted Upload of File with Dangerous Type in StylemixThemes MasterStudy LMS Pro affecting StylemixThemes

CVE-2025-7438: CWE-434 Unrestricted Upload of File with Dangerous Type in StylemixThemes MasterStudy LMS Pro - Live Threat Intelligence - Threat Radar | OffSeq.com

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

[Analysis] GitHub's Security Crisis 39M Secret Leaks, Amadey...

CVE-2025-26855: CWE-89: Improper Neutralization of Special E...

CVE-2025-26854: CWE-89: Improper Neutralization of Special E...

Chinese Malware Delivery Domains: Part III

CVE-2025-7438: CWE-434 Unrestricted Upload of File with Dang...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility