A sophisticated SEO poisoning campaign targets users searching for DeepSeek AI tools by leveraging malicious lookalike domains in top search results. The attack involves a multi-stage infection chain beginning with weaponized MSI files disguised as legitimate software, followed by shellcode execution and DLL side-loading via legitimate Cyglaunch software, and ends with deployment of the Kong RAT malware. The final payload includes keylogger capabilities and persistence through registry modifications. The campaign is attributed to a Chinese threat actor with links to previous attacks on Chinese developer tools.
Seven months after initial disclosure, the Coruna iOS exploit framework continues to evolve, now deploying two distinct chains based on device operating system version. Targets running iOS 17.2.1 or earlier receive the legacy Coruna framework, while later builds receive DarkSword-derived chains. Analysis identified 608 domains delivering Coruna-family code, with 93 sites mapping to 21 distinct tracking collectors. Distribution spans dating portals, AI-companion platforms, cryptocurrency promotions, media streaming services, and compromised legitimate sites. The attack requires no user interaction beyond loading a webpage, operating through hidden iframes that deploy browser exploits leading to native code execution. Recovered modules include kernel memory manipulation, code-signing enforcement changes, process memory access, encrypted command-and-control communication, and cleanup routines. One delivery vector involves compromised npm packages, enabling legitimate websites to serve exploits through their o...
This investigation reveals a tech-support scam leveraging legitimate remote-access software UltraViewer and bulk-mailing software UltraMailer. A QuickBooks phishing campaign uses over 350 lookalike domains and tracking domains to direct victims to scammers attempting credential theft. UltraMailer is abused as a spamming tool with no abuse-reporting mechanism and is promoted on criminal forums. Trojanized installers containing authentic UltraViewer and UltraMailer copies, including one with njRAT malware, were found. The campaign briefly switched to another mailing service but resumed using UltraMailer after suspension. There is no evidence of developer involvement, but the findings highlight widespread criminal misuse of legitimate applications.
The Aurora ransomware group has been active since April 2026, targeting multiple organizations globally with a Linux ransomware variant tailored for ESXi environments. This ransomware uses ChaCha20 encryption combined with RSA-4096 key wrapping. A notable feature of their operations is the abuse of Cursor Agent alongside Claude Sonnet AI to assist in exploitation activities such as privilege enumeration, network scanning, NTLM relay attacks, and certificate attacks. The group imposes operational restrictions to avoid detection and disruption, including prohibiting DCSync, account lockouts, and adding new computer objects to domains. A separate cluster of Aurora activity involves SQL Server lateral movement, GodPotato escalation, and S3-based data exfiltration. The threat affects organizations in multiple countries including the United States, Argentina, Austria, Germany, Israel, and Spain.
The npm package @chatunitycenter/baileys contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, trusted computer are strongly advised.
The npm package '789bet-vip-login' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '789bet-vip-online-login' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential full control by an attacker, removal may not eliminate all malicious components. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package '789bet-vip' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by attackers.
The npm package '789bet-login-th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package '789bet-entrance' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '789bet-slot' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious components, as attackers may have established persistent control.
The m98vip npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The npm package 'm98th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The m98bet npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, secure machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The npm package '789bet' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious software introduced by its installation.
The npm package @pcb-dp/qa-commons contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, secure computer.
The npm package @jasperquinn/postcss-motion-helpers contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, uncompromised machine. Removing the package alone may not eliminate the malicious presence, as the attacker may have established persistent control.
The black-spindle-2 npm package contains malicious code in its postinstall script. This script executes automatically upon installation and makes an HTTP request to an anonymous ngrok-free.app URL, embedding shell command substitution. This behavior can confirm installation on the host and potentially exfiltrate environment or host data. The package's main code is an empty stub, indicating the postinstall script is the primary malicious component.
The poc-revshell package version 0.1.0 on PyPI contains a reverse-shell backdoor that activates both during installation and import. It opens a TCP connection to localhost on port 4444, providing an interactive shell to any local listener. This backdoor runs with the installing user's privileges and is confined to local attackers on the same host.
The npm package 'cjlowuxbnexkhgpzq' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.
