Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data

Source: https://thehackernews.com/2025/06/malicious-pypi-package-masquerades-as.html

A malicious package has been discovered on the Python Package Index (PyPI) masquerading as the legitimate 'Chimera' module. This malicious package is designed to stealthily exfiltrate sensitive data from compromised systems, specifically targeting AWS credentials, Continuous Integration/Continuous Deployment (CI/CD) pipeline secrets, and macOS system information. By impersonating a trusted module, the attacker increases the likelihood of the package being installed by developers or automated systems relying on PyPI for dependencies. Once installed, the package executes code that harvests environment variables, configuration files, and potentially other stored secrets related to cloud infrastructure and development workflows. The focus on AWS credentials and CI/CD secrets indicates an intent to gain persistent access to cloud resources and development environments, which could lead to further compromise or data breaches. The targeting of macOS data suggests the attacker is also interested in information specific to Apple environments, possibly to facilitate lateral movement or reconnaissance. Although no known exploits have been reported in the wild yet, the high severity rating and recent discovery underscore the urgency for organizations to audit their Python dependencies and monitor for suspicious package installations. The threat leverages the trust model inherent in open-source package repositories, exploiting the difficulty in distinguishing legitimate packages from malicious imitations, especially when attackers use similar names or branding. This attack vector is particularly dangerous because it can bypass traditional perimeter defenses by exploiting developer workflows and automated build systems.

Detailed information about Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data. Get real-time updates, technical details, a

Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data - Live Threat Intelligence - Threat Radar | OffSeq.com

Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data

Reddit Discussion: Malicious PyPI Package Masquerades as Chimera Module to Steal AWS, CI/CD, and macOS Data

Microsoft Excel Use After Free - Local Code Execution

The threat concerns a Use After Free (UAF) vulnerability in Microsoft Excel, identified as CVE-2025-27751. This vulnerability affects Microsoft Excel 2016 and Microsoft Office Online Server with update KB5002699. The exploit leverages a memory management flaw where Excel improperly handles memory, leading to a use-after-free condition. An attacker can craft a malicious DOCX file containing embedded exploit code that, when opened by a user in Excel, triggers the vulnerability. This results in local code execution on the victim's Windows machine. The exploit is delivered via common vectors such as email attachments or streaming servers, relying on social engineering to convince users to open the malicious document. Once executed, the attacker can run arbitrary code with the privileges of the user, potentially leading to full system compromise, installation of malware, or other malicious activities. The exploit code is available publicly and is written in Perl, indicating that the attack can be automated or integrated into larger attack frameworks. Although the published severity is marked as medium, the exploit author describes the vulnerability as high-critical, highlighting the potential for severe impact. The vulnerability requires local execution, meaning the attacker must convince the user to open the malicious file, but no authentication is needed beyond user interaction. No official patches or mitigations are listed in the provided data, and no known exploits in the wild have been reported yet. The exploit code sample provided is a VBA macro stub, demonstrating how an attacker might embed malicious commands to execute arbitrary programs on the victim's machine.

Exploit code for Microsoft Excel Use After Free - Local Code Execution

Detailed information about Microsoft Excel Use After Free - Local Code Execution. Get real-time updates, technical details, and mitigation strategies.

Microsoft Excel Use After Free - Local Code Execution - Live Threat Intelligence - Threat Radar | OffSeq.com

Original Source

Raw Exploit Code

AirKeyboard iOS App 1.0.5 - Remote Input Injection

The AirKeyboard iOS application version 1.0.5 contains a critical security vulnerability that allows remote input injection via an exposed WebSocket server. Specifically, the app listens on port 8888 for WebSocket connections and accepts arbitrary input injection messages from any client without requiring authentication or pairing. This design flaw enables an attacker on the same network or with network access to the device to send keystroke commands directly to the victim's iOS device in real-time. The exploit demonstrated uses Python to connect to the WebSocket server and send JSON-formatted keystroke payloads, which the app processes as legitimate input. This results in full remote control over the device's input, allowing an attacker to type arbitrary text or commands without any user interaction or consent. The vulnerability impacts confidentiality, integrity, and availability since an attacker could inject malicious commands, manipulate data, or disrupt device operations. The exploit code leverages the 'websocket' Python library to establish the connection and send payloads, demonstrating ease of exploitation. The lack of authentication or pairing mechanisms is a significant security oversight, making the attack surface broad for any attacker with network access to the device. Although the app is iOS-based, the vulnerability is not mitigated by iOS security features due to the app's own exposed interface. No patches or updates are currently linked, and no known exploits in the wild have been reported yet. The exploit code is publicly available, increasing the risk of exploitation by less skilled attackers.

Exploit code for AirKeyboard iOS App 1.0.5 - Remote Input Injection

Detailed information about AirKeyboard iOS App 1.0.5 - Remote Input Injection. Get real-time updates, technical details, and mitigation strategies.

AirKeyboard iOS App 1.0.5 - Remote Input Injection - Live Threat Intelligence - Threat Radar | OffSeq.com

Hackers Leak Data of 10,000 VirtualMacOSX Customers in Alleged Breach

Source: https://hackread.com/hackers-leak-virtualmacosx-customers-data-breach/

The reported security threat involves a data breach affecting VirtualMacOSX, a service provider offering virtualized macOS environments to customers. According to publicly available information sourced from a Reddit InfoSec News post and linked to a report on hackread.com, hackers have leaked data belonging to approximately 10,000 customers of VirtualMacOSX. While specific technical details about the breach vector, exploited vulnerabilities, or the nature of the leaked data have not been disclosed, the incident is categorized as a high-severity breach. The lack of detailed technical indicators or patch information suggests that the breach may have resulted from unauthorized access to customer databases or backend infrastructure, potentially exposing sensitive customer information such as personal identification data, account credentials, or usage logs. The breach's public disclosure on a social media platform with minimal discussion indicates that the incident is recent and possibly still under investigation. The absence of known exploits in the wild implies that the breach was likely targeted or opportunistic rather than part of a widespread automated attack campaign. Given the nature of VirtualMacOSX's service—providing virtualized macOS environments—the exposed data could include credentials that might allow attackers to access virtual machines or related cloud services, increasing the risk of further compromise or lateral movement within affected organizations. The breach highlights the risks associated with cloud-based virtualization services, especially those catering to niche platforms like macOS, where customer trust and data confidentiality are critical.

Detailed information about Hackers Leak Data of 10,000 VirtualMacOSX Customers in Alleged Breach. Get real-time updates, technical details, and mitigation strat

Hackers Leak Data of 10,000 VirtualMacOSX Customers in Alleged Breach - Live Threat Intelligence - Threat Radar | OffSeq.com

Hackers Leak Data of 10,000 VirtualMacOSX Customers in Alleged Breach

Reddit Discussion: Hackers Leak Data of 10,000 VirtualMacOSX Customers in Alleged Breach

Windows File Explorer Windows 10 Pro x64 - TAR Extraction

This security threat involves an exploit targeting Windows File Explorer on Windows 10 Pro x64 systems, specifically related to the extraction of TAR archive files. The exploit leverages the way Windows File Explorer handles .library-ms files, which are XML-based library description files used by Windows to define virtual folders aggregating content from multiple locations. The provided exploit code, written in Python, automates the creation of a malicious .library-ms file that references a network location via a UNC path (\\<IP_ADDRESS>\IT). This .library-ms file is then packaged into a TAR archive named "exploit.tar". When a user extracts or opens this TAR archive using Windows File Explorer, the system processes the .library-ms file, causing it to attempt to access the specified remote network share. This behavior can be exploited to trigger unintended network connections, potentially allowing an attacker to perform remote code execution or to exfiltrate data by leveraging Windows' handling of library files and network shares. The exploit requires user interaction to extract or open the TAR file, and it targets Windows 10 Pro x64 systems, although no specific affected versions are listed. No patches or mitigations are currently referenced, and there are no known exploits in the wild at the time of publication. The exploit code is straightforward, demonstrating how to generate the malicious .library-ms file and package it into a TAR archive, highlighting the simplicity of crafting such an attack vector.

Exploit code for Windows File Explorer Windows 10 Pro x64 - TAR Extraction

Detailed information about Windows File Explorer Windows 10 Pro x64 - TAR Extraction. Get real-time updates, technical details, and mitigation strategies.

Windows File Explorer Windows 10 Pro x64 - TAR Extraction - Live Threat Intelligence - Threat Radar | OffSeq.com

This article explores the security implications of serverless authentication across major cloud platforms. It details how attackers target serverless functions to exploit vulnerabilities arising from insecure code and misconfigurations. The mechanics of serverless authentication are explained for AWS Lambda, Google Cloud Functions, and Azure Functions. The article outlines potential attack vectors for token exfiltration, including SSRF and RCE, and provides simulations demonstrating how tokens can be extracted and misused. Detection strategies are discussed, focusing on identifying serverless identities and anomalous behavior. Prevention measures are suggested, emphasizing the principle of least privilege and robust input validation. The article concludes by stressing the importance of understanding serverless credential mechanics and implementing proactive security measures to protect cloud environments.

This threat campaign focuses on the exploitation of serverless authentication mechanisms across major cloud platforms, specifically AWS Lambda, Google Cloud Functions, and Azure Functions. Serverless computing allows organizations to run code without managing servers, relying on cloud providers to handle infrastructure. Authentication in these environments typically involves tokens or credentials that grant access to cloud resources. Attackers exploit vulnerabilities arising from insecure code practices and misconfigurations within serverless functions to exfiltrate these tokens. Key attack vectors include Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE), which enable adversaries to manipulate serverless functions to access sensitive tokens. These tokens, once extracted, can be misused to escalate privileges, move laterally within cloud environments, or access sensitive data and services. The campaign highlights the mechanics of serverless authentication, demonstrating how tokens are generated, stored, and used by serverless identities. Detection strategies focus on identifying anomalous behavior associated with serverless identities, such as unusual invocation patterns or token usage. Prevention recommendations emphasize the principle of least privilege, ensuring serverless functions have only the minimum permissions necessary, and robust input validation to prevent injection attacks that could lead to SSRF or RCE. The campaign underscores the critical need for organizations to understand serverless credential mechanics and implement proactive security controls to safeguard their cloud environments.

Detailed information about Serverless Tokens in the Cloud: Exploitation and Detections. Get real-time updates, technical details, and mitigation strategies.

Serverless Tokens in the Cloud: Exploitation and Detections - Live Threat Intelligence - Threat Radar | OffSeq.com

Serverless Tokens in the Cloud: Exploitation and Detections

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This issue affects etracker: from 0.0.0 before 3.1.0.

CVE-2025-48920 is a Cross-Site Scripting (XSS) vulnerability identified in the Drupal etracker module, affecting versions prior to 3.1.0 (notably from version 0.0.0 before 3.1.0). The vulnerability arises due to improper neutralization of input during web page generation, classified under CWE-79. This means that user-supplied input is not correctly sanitized or encoded before being embedded into web pages, allowing an attacker to inject malicious scripts. When a victim accesses a compromised page, the injected script can execute in the context of the victim's browser, potentially leading to session hijacking, credential theft, unauthorized actions on behalf of the user, or redirection to malicious sites. The etracker module is used within Drupal to integrate web analytics and tracking functionalities, which often involves processing user input or query parameters. The lack of a patch or fix at the time of publication indicates that the vulnerability remains unmitigated. No known exploits are currently reported in the wild, but the nature of XSS vulnerabilities makes them attractive targets for attackers due to their relative ease of exploitation and potential impact on user trust and data confidentiality. The vulnerability does not require authentication or complex user interaction beyond visiting a crafted URL or page. Since Drupal is a widely used content management system (CMS) in Europe, especially among public sector and enterprise websites, the exposure risk is significant wherever the etracker module is deployed without updates.

Detailed information about CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker affect

CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48920: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal etracker

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).This issue affects Simple Klaro: from 0.0.0 before 1.10.0.

CVE-2025-48919 is a Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting the Drupal Simple Klaro module versions prior to 1.10.0, specifically from version 0.0.0 up to but not including 1.10.0. Simple Klaro is a Drupal module used to integrate the Klaro consent management platform, which manages user consent for cookies and tracking technologies on websites. The vulnerability arises due to improper neutralization of input during web page generation, meaning that user-supplied input is not correctly sanitized or encoded before being included in the HTML output. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. When exploited, the malicious script executes in the context of the victim's browser, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The vulnerability does not require authentication or user interaction beyond visiting a crafted URL or page containing the malicious payload. Although no known exploits are currently reported in the wild, the nature of XSS vulnerabilities makes them attractive for attackers due to ease of exploitation and potential for widespread impact. The absence of a CVSS score indicates that the vulnerability is newly disclosed and has not yet undergone formal severity assessment. The vulnerability affects all Drupal sites using Simple Klaro versions before 1.10.0, which may include a broad range of public-facing websites, especially those in Europe where Drupal is widely adopted for government, educational, and commercial websites. Since Simple Klaro handles consent management, exploitation could also undermine compliance with privacy regulations by manipulating consent dialogs or stealing sensitive user data. No patches or fixes are currently linked, so immediate mitigation requires manual intervention or disabling the module until an update is available.

Detailed information about CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro af

CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48919: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal Simple Klaro

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cross-Site Scripting (XSS).This issue affects EU Cookie Compliance (GDPR Compliance): from 0.0.0 before 1.26.0.

CVE-2025-48917 is a Cross-Site Scripting (XSS) vulnerability classified under CWE-79, affecting the Drupal EU Cookie Compliance (GDPR Compliance) module. This module is designed to help websites comply with the European Union's GDPR regulations by managing cookie consent banners and related functionalities. The vulnerability arises due to improper neutralization of input during web page generation, meaning that user-supplied data is not adequately sanitized or escaped before being rendered in the HTML output. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. When exploited, these scripts can execute in the context of the victim's browser, potentially leading to session hijacking, credential theft, defacement, or redirection to malicious sites. The affected versions include all releases prior to 1.26.0, with the vulnerability present from version 0.0.0 up to but not including 1.26.0. As of the publication date (June 13, 2025), no known exploits have been reported in the wild, and no official patches or updates have been linked in the provided data. The vulnerability is specifically tied to the EU Cookie Compliance module, a widely used component in Drupal-based websites that operate within or target the European market to meet GDPR requirements. The lack of a CVSS score indicates that the severity has not yet been formally assessed, but the nature of XSS vulnerabilities and their potential impact is well understood in cybersecurity communities.

Detailed information about CVE-2025-48917: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal EU Cookie Compl

CVE-2025-48917: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal EU Cookie Compliance (GDPR Compliance) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48917: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Drupal EU Cookie Compliance (GDPR Compliance)

Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVE-2025-27689 is a high-severity vulnerability affecting Dell iDRAC Tools versions prior to 11.3.0.0. The vulnerability is classified under CWE-284, indicating improper access control. Specifically, this flaw allows a low-privileged attacker with local access to the affected system to escalate their privileges. The Dell Integrated Dell Remote Access Controller (iDRAC) Tools are used for remote management of Dell servers, providing administrators with capabilities such as hardware monitoring, firmware updates, and system configuration. The vulnerability arises because the access control mechanisms within iDRAC Tools do not adequately restrict certain privileged operations, enabling an attacker who already has some level of local access to bypass restrictions and gain elevated privileges. According to the CVSS v3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the attack requires local access (AV:L), has low attack complexity (AC:L), requires low privileges (PR:L), and no user interaction (UI:N). The scope is unchanged (S:U), but the impact on confidentiality, integrity, and availability is high (C:H/I:H/A:H), meaning an attacker could fully compromise the system, access sensitive data, modify system configurations, or disrupt availability. No known exploits are currently reported in the wild, and no patches are linked yet, indicating that this is a newly disclosed vulnerability. The lack of a patch means affected organizations must rely on mitigation and monitoring until an official fix is released. Given the critical role of iDRAC in server management, exploitation could allow attackers to gain control over server hardware management functions, potentially leading to full system compromise or persistent footholds in enterprise environments.

Detailed information about CVE-2025-27689: CWE-284: Improper Access Control in Dell iDRAC Tools affecting Dell iDRAC Tools. Get real-time updates, technical det

Title	Severity	Type	Source	Date

Threats Affecting Ireland

Filter Threats

Threats Affecting Ireland