This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-06-10, categorized as malware-related network activity. It originates from the CIRCL OSINT Feed and is classified as a medium-risk observation based on available threat intelligence. No specific affected software versions or exploitation details are provided. There is no patch or remediation available, and no known exploits in the wild have been reported.
A supply chain compromise involving the Miasma malware affected 73 Microsoft GitHub repositories after initially compromising a Red Hat employee's GitHub account. The malware planted a payload runner directly into multiple public repositories, which executes automatically when cloned and opened in certain AI development tools. The compromised repositories include critical Microsoft projects such as Azure Functions Host and components across multiple programming languages. Red Hat confirmed the compromise originated from unauthorized commits in their GitHub organization and has removed affected package versions from npm. No customer action is currently required as Red Hat's deployment process prevents the malicious code from reaching production environments. The investigation is ongoing.
This entry references a Reddit post linking to a YouTube video titled 'Building A Malware Lab From Scratch Part 2! ' which discusses setting up a malware analysis lab environment. The content is educational and shares personal learnings about lab setup using OpenTofu. There is no indication of an active malware threat, vulnerability, or exploit. No affected software versions or patch information is provided. The post is informational and does not describe a security vulnerability or active threat.
This threat concerns malware abusing the npm native addon build tool node-gyp to execute malicious code. The detection approach involves analyzing binding.gyp files for suspicious shell execution patterns, undeclared build configurations, and suspicious dependencies. Additional detection criteria include C/C++ pattern matching and validation of prebuilt binaries. A detection tool, npm-scan v1.2.1, has been released to identify such abuses with reported 100% validation on known malicious samples. There is no indication of active exploitation in the wild or affected npm package versions. The threat was discussed in a Reddit post with minimal discussion and no external vendor advisory or patch information.
A Reddit post in the r/Malware subreddit highlights suspicious behavior related to the MEmu Android emulator. The post notes that a Microsoft Edge browser policy allowing local network access is installed and linked to a domain owned by MEmu's parent company, Shanghai Maiwei Software Technology Co. , Ltd. The concern is why this policy is present, as it permits sites to make network requests to local devices and endpoints. No direct evidence of exploitation or malware is provided, and no official vendor advisory or patch information is available.
A malvertising campaign is leveraging ChatGPT and OpenAI branding to deceive users into downloading malware. The campaign was reported via a Reddit post linking to an external analysis by Evalian. There are no specific affected software versions or technical exploit details provided. The campaign is categorized as phishing and malware distribution. No known exploits in the wild or patch information is available. The threat appears to be recent but has minimal discussion and no direct indicators shared.
A Reddit post on the r/Malware subreddit references a new malware threat described as a VMware antidetect ransomware, spyware, and trojan. The post links to an external site (antidetect.cloud) and includes a warning not to download the software. There is minimal technical detail or discussion available, and no confirmed exploits in the wild have been reported. No affected software versions or patch information is provided. The threat is assessed as medium severity based on the nature of the malware types mentioned.
This threat is a scam and likely malware or trojan disguised as a 'Path Of Exile 2 builder' distributed via a Reddit post. The malware reportedly hijacks user sessions on Discord, YouTube, and Facebook, attempting to send direct messages on Discord using IP proxies. The malicious payload is contained within a zip file with an executable, which if run, infects the system. There is no official patch or vendor advisory available. The threat is currently not known to be exploited in the wild beyond the Reddit report.
GoDaddy researchers discovered malware on approximately 1,980 WordPress sites that use the Steam gaming platform's community profile comments as a covert command-and-control (C2) channel. The malware encodes instructions using invisible Unicode characters embedded in seemingly innocuous ASCII art comments on Steam profiles. These instructions direct infected WordPress sites to load malicious JavaScript mimicking legitimate libraries and install a persistent backdoor. The backdoor listens for specific authentication cookies and can receive and execute base64-encoded PHP code to modify plugin and theme files, enabling attackers to maintain persistence even after partial cleanup. Initial infection vectors are unconfirmed but likely include stolen credentials or vulnerable plugins. Detection involves monitoring outbound connections to Steam URLs, suspicious script references, and specific cookie names in POST requests. Remediation requires full removal of all malicious components or restoration from a clean backup predating the infection.
A user on Reddit's r/Malware subreddit reported discovering a new malware sample linked to a FiveM low PC graphics pack download. The user uploaded the suspected file to VirusTotal, where it received a detection score of 10 out of 65 antivirus engines. The user performed additional offline and online scans with Windows Defender and observed no immediate signs of compromise. The report is based on a single VirusTotal submission and minimal discussion, with no confirmed exploits or widespread impact noted.
This entry references a Reddit post linking to a video about building a malware analysis lab from scratch. The content appears to be educational and shares personal learnings on setting up such a lab. There is no indication of an active malware threat, vulnerability, or exploit associated with this post. No affected software versions or patch information is provided. The post is informational and does not describe a specific security threat or vulnerability.