The PyPI package 'driftwavets' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Instead, it downloads and executes remote malicious code, continuing a known coin-mining campaign. This package is designed to execute remote code without embedding the URL directly in the package.
The PyPI package 'novalithtts' version 0.1.0 is part of a malicious campaign falsely advertising itself as an 'audio-analysis profiles' loader. Instead of providing legitimate functionality, it downloads and executes remote malicious scripts, likely continuing a coin-mining campaign. There is no embedded URL in the package, indicating remote code execution is triggered externally. This package poses a direct threat by executing unauthorized code on affected systems.
The PyPI package 'voltswannts' version 0.1.0 is identified as malicious software that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute a remote malicious script, continuing a known coin-mining campaign. This package poses a direct threat by executing unauthorized remote code.
The PyPI package 'glassbeakasr' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Its true purpose is to download and execute remote malicious scripts, likely continuing a previous coin-mining campaign. There is no embedded URL in the package itself, indicating remote code execution is triggered dynamically. This package is identified as malicious software with intent similar to infostealers.
The emberlytts package on PyPI is part of a malicious campaign that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute remote malicious code. This package is linked to a known coin-mining campaign and is considered to have clear malicious intent.
The quasitonnts package on PyPI falsely advertises itself as an 'audio-analysis profiles' loader but is designed to download and execute remote malicious code. This behavior is linked to a broader malicious campaign involving coin-mining activities. The package version 0.1.0 is affected. There is no CVSS score available for this threat.
The ukraine69 package on PyPI contains malicious code that executes during import. This code attempts to escape sandbox environments, locate Telegram bot session files, and trigger malicious account deletions. The campaign associated with this package is identified as malicious with destructive actions and attempts to cover tracks.
Discover-Tech, an Israeli advertising company, operated as a covert channel for Candiru spyware, enabling zero-click infections via malicious ads. These ads allowed threat actors to fingerprint, track, and de-anonymize millions of devices worldwide, including targeted attacks on Al Jazeera. The operation, named AdFection, exploited the online advertising ecosystem to deliver spyware without user interaction. Major platforms like Google and IAB Europe have removed Discover-Tech from their ad vendor registries and blocked its access to ad exchanges. Citizen Lab recommends blocking targeted ads at the gateway as the primary defense until industry-wide mitigations are effective.
The npm package @beloved-lenora/opencode-orchestrator contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
The npm package '@beloved-lenora/opencode-btw' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to secrets and keys stored on the affected system. Removal of the package does not guarantee complete eradication of the malicious software, as the attacker may have established persistent control.
The npm package @beloved-lenora/opencode-goal contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete system compromise, requiring immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-stats contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may lead to unauthorized access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it. Immediate rotation of all secrets and keys from a separate, uncompromised device is strongly recommended.
The npm package @beloved-lenora/opencode-todo contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-shared-rpc contains malicious code that fully compromises any computer on which it is installed or running. Immediate removal of the package is advised, but full remediation requires rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by an attacker.
The npm package @beloved-lenora/opencode-shell-guard contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is required, and the package should be removed. However, removal does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
Candiru spyware was delivered to devices at Al Jazeera Media Network through zero-click attacks using targeted online advertisements. These malicious ads executed code upon rendering without requiring user interaction, a technique termed AdFection by Citizen Lab researchers. The attacks targeted at least 45 devices between 2024 and 2025 and involved infrastructure linked to the Israeli spyware vendor Candiru. The advertising operation placed billions of bids and appeared across tens of thousands of apps and websites, potentially exposing millions of users to malicious domains. Major advertising companies have taken action to remove offending accounts and block malicious domains following disclosure.
The pyyi package on PyPI is a malicious package that impersonates the Python interpreter and executes remote code supplied by a command-and-control server. It registers console commands named after Python executables (e.g., python3.7) that shadow legitimate interpreters and send system information to an obfuscated server. The package fetches, decodes, decompresses, and executes arbitrary Python code in memory without any integrity checks. It also includes a fake Python REPL that captures single-token inputs as passwords and sends them to the attacker. This combination enables remote code execution and credential theft on affected systems.
YuanKong RAT is a multi-tenant Android remote access trojan that embeds operator identifiers in each build and uses a two-key XOR scheme to unpack payloads. It steals credentials via screen capture, accessibility abuse, and overlay attacks, and escalates privileges by pairing with the device's ADB daemon. Communication occurs over WebSocket with shared command-and-control domains. Analysis of samples revealed multiple distinct operator accounts and payloads.
QuartzLine, also known as CLOUDHAZE, is malware disguised as a legitimate Windows PDF viewer that contains a backdoor. It has been distributed via malicious advertising campaigns, leveraging AWS S3 buckets for hosting. The malware establishes persistence through scheduled tasks and communicates with command-and-control servers. It operates with user-level privileges, allowing attackers to execute arbitrary Windows commands and deploy additional malware such as the Caira and IronBark remote access trojans. Early activity includes theft of Chrome browser data within one week of infection. The malware is signed with a now-revoked legitimate EV code-signing certificate, appearing as paperline.exe and fielddesk.exe.
The npm package @xatancchii/natabaileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Simply removing the package does not guarantee removal of all malicious software introduced by it.