The npm package 'itsa-react-checkbox' version 16.0.5 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removal of the package alone may not eliminate all malicious software introduced by it.
The npm package 'mock-transactions-sdk' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a separate, uncompromised machine.
The npm package 'transaction-info-generate-sdk' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.
The npm package 'black-spindle' version 999.0.0 has been identified as malicious by the OpenSSF Package Analysis project. It exhibits malicious behavior by communicating with a domain linked to malicious activity and executing commands associated with harmful actions. This package poses a security risk to users who install or use it.
Artem Stryzhak, a Ukrainian national, was sentenced to 70 months in US prison for his role as an affiliate in the Nefilim and Hive ransomware operations. He conducted ransomware attacks against multiple organizations, including US businesses and healthcare providers, causing over $100 million in losses. Stryzhak operated between June and October 2021, extorting ransoms and providing decryption keys to some victims. The Nefilim ransomware administrator remains at large with a US State Department reward for information leading to his arrest.
The n0n ransomware operation is an AI-assisted extortion campaign revealed in 2026 through an exposed staging server. It targets organizations globally using credential stuffing attacks against FortiGate SSL-VPN devices, exposed cloud keys, and compromised management portals. The operation combines data exfiltration with destructive actions such as encryption and backup deletion. The attacker uses an AI coding agent with numerous models to generate attack scripts, enhancing human-directed operations. At least 23 victims across 14 countries were identified initially, with 93 victims listed by October 2026 and ransom demands totaling $283.7 million. No software vulnerabilities were exploited; all compromises relied on weak or stolen credentials.
On September 6, 2026, an unidentified operator exfiltrated approximately 68.8 GiB of database backups from a Philippine government agency responsible for overseas employment and migrant workers. The stolen data included 27 SQL Server backups related to case management systems such as POEA and OFW variants. The operator inadvertently exposed their staging infrastructure through an open HTTP directory on a VPS in Singapore, revealing tools including a rebranded GodPotato privilege escalation tool (Wrqsnx), PowerShell stagers, and the Impacket toolkit. The attack leveraged DCOM and RPC mechanisms to gain SYSTEM-level access without exploiting known vulnerabilities. Certificate analysis linked the compromised infrastructure to the Philippine Overseas Employment Administration portal farm. Initial access methods and command-and-control channels remain unknown, though the tooling was deployed on agency portal hosts.
Since July 2025, a financially motivated threat actor named CyberDakait has conducted a sophisticated Android malware campaign targeting India's financial services sector. The campaign uses seven distinct Android trojan families distributed via smishing and vishing, impersonating bank representatives to trick victims into installing malicious APKs. These trojans steal banking credentials, credit card details, and intercept SMS messages including OTPs through overlay attacks. Additionally, the malware performs cryptojacking using XMRig. The malicious apps are hosted on GitHub to appear legitimate, with initial droppers delivering the main payload and mining modules. At least 17,960 devices have been compromised with 7.6 million intercepted SMS messages reported.
The npm package @zmtcdn/components version 9999.0.0 is a malicious dependency-confusion package. Its postinstall script collects system information including hostname, username, platform, working directory, and environment variable names, then sends this data to an external logging service. This reconnaissance can expose sensitive environment variables such as CI or secret tokens, potentially leading to credential theft. The package was published by the npm account kill_shs, which also published a similar malicious package @zmtcdn/ui.
MR ROBOT is a sophisticated Android Malware-as-a-Service operation targeting Indian bank customers. It operates on a subscription model allowing cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The malware uses a multi-stage dropper to deploy banking trojans that intercept SMS and OTPs, silently enable call forwarding to bypass two-factor authentication, and overlay phishing screens to steal sensitive financial and identity information. One affiliate compromised 153 devices and intercepted over 5,400 SMS messages. The operation includes a Telegram bot storefront offering about 36 fake apps impersonating banks and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.
In September 2026, infostealer malware was predominantly distributed via SEO poisoning, masquerading as illegal software like cracks and keygens. Distribution platforms included Mediafire, AWS S3, Mega, and Cloudflare Storage. Executable files made up 90.8% of samples, with 9.2% using DLL side-loading techniques involving legitimate DLLs such as python37.dll and POWRPROF.dll. A new Rust-based infostealer named Lzveil was identified, which downloads configuration from command and control servers and employs modified Base64 decryption, XOR encryption, and LZNT1 compression. Email campaigns spread DarkCloud and AgentTesla infostealers, impersonating construction and logistics firms. These malware variants steal credentials, browser data, cryptocurrency wallets, and system information, with stolen data often sold on dark web markets or used in secondary attacks.
The npm packages @zmtcdn/ui versions 9999.0.0 and 9999.0.7 are malicious dependency-confusion packages that execute a postinstall script sending system environment details to an external server without user consent. The postinstall script collects hostname, username, platform, working directory, environment variable names, and a timestamp, then sends this data to https://www.hinny.shop/api. These packages were published by a suspicious npm account and have no legitimate functional purpose for this data transmission.
The npm package identity-two-factor@999.0.0 is a malicious dependency-confusion package targeting Coinbase. It contains no functional code but executes a postinstall script that collects system metadata and exfiltrates it to a third-party webhook URL. This unsolicited data exfiltration occurs automatically upon installation without user authorization.
The npm package spectral-net-probe contains malicious code in versions 1.0.1, 1.0.4, and 1.0.10. These versions execute code during installation or loading that contacts remote servers to exfiltrate local files specified by the attacker. This behavior constitutes a supply-chain attack leveraging npm package distribution to steal arbitrary files from users' systems.
Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.
Qilin, also known as Agenda, is a Russian-speaking ransomware-as-a-service operation active since 2022 and highly prolific by 2025 with over 1,000 victims. It uses a flexible platform enabling affiliates to customize attacks targeting local files, network shares, and virtual machine infrastructure, including ESXi hosts. Initial access is commonly gained via phishing, stolen credentials, vulnerable internet-facing systems, and remote management tools. The group employs a double-extortion model, encrypting data and threatening to publish stolen information on their blog and WikiLeaksV2 platform. Notable incidents include the 2024 Synnovis attack impacting UK healthcare services. Qilin is linked to other threat groups and has spawned derivative operations, some maintaining affiliate status while operating independent leak sites.
The glyphmatrix-fixture npm package versions 1.0.0 and 1.0.1 contain malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone may not eliminate the malicious software, as the attacker may have gained full control of the system.
The trajmetrics package version 0.5.3 on PyPI contains malicious code that scans the entire system to exfiltrate selected file types. When used as instructed in its README, it runs a background process that continuously monitors and exfiltrates files as they change, indicating clear malicious intent as an infostealer.
The npm package 'csec-form-validatorr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The ccsseecc-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
