The npm package 'dransay' version 99.0.0 contains a malicious preinstall script that performs network requests to a third-party collaborator domain during installation. This behavior leaks the installer's IP address, DNS resolver IP, hostname data, and timestamp to an external server. The package appears to be a dependency-confusion proof-of-concept but executes non-consensual outbound network communication.
The npm package '@dransay/address-validation' version 99.0.0 contains a preinstall script that performs a DNS lookup and HTTPS GET request to a known malicious collaborator domain during installation. This behavior is consistent with a dependency confusion probe designed to reveal the installer's IP address and package name to an external operator. No sensitive environment data or filesystem contents are accessed, and no additional code is fetched or executed. The package is flagged as malicious due to its communication with a domain associated with malicious activity.
Threat actors are distributing legitimate Remote Monitoring and Management (RMM) tools such as ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud, and N-able through phishing campaigns. These campaigns use social engineering tactics with fake Adobe Acrobat updates, DocuSign viewers, and document access prompts to trick victims into installing remote access tools disguised as business documents. Delivery methods include LNK files, BAT scripts, VBS files, and PDFs. The RMM tools contain embedded configuration data linking back to attacker infrastructure, enabling remote access while evading detection.
The npm package @bellaxchuu/belbails version 1.0.1 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This subscription uses the victim's authenticated WhatsApp session without their consent. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @lendxntaa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This action is performed by injecting a covert subscription into the WhatsApp socket layer using the victim's authenticated session. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code. The targeted channels are obfuscated or dynamically fetched to avoid detection.
The npm package kiyoramarkets version 8.0.16 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The target channel identifiers are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package css-reading-display-polyfill, version 1.0.0, contains malicious code that executes system commands to collect sensitive host information and environment variables, then exfiltrates this data to a hardcoded external webhook. The package masquerades as a CSS polyfill but instead acts as a dependency confusion probe targeting Wix build infrastructure, potentially leaking CI secrets and cloud credentials.
The npm package 'tensorlake' version 0.5.144 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised system is strongly advised.
The DarkSword/Coruna iOS exploitation platform was found exposed via open directories on five hosts, revealing an active commercial exploitation-as-a-service operation targeting cryptocurrency wallets. The platform extracts BIP39 recovery phrases from 18 different wallet applications and automates theft. Analysis uncovered victim data and an agent/reseller model. A separate China-based operator uses identical tooling on independent infrastructure, indicating multiple threat actors. The infrastructure was actively polling Chinese iOS devices during analysis. Development targeting iOS 26 via CVE-2026-31001 was identified but not yet deployed.
A phishing campaign exploited legitimate Microsoft Power BI domains to distribute rogue ScreenConnect remote monitoring tools. Attackers sent phishing emails with links redirecting victims to fake reference documents hosted on Power BI infrastructure. Clicking the download link led to attacker-controlled sites that fingerprinted victims' systems before downloading malicious ScreenConnect installers. Multiple ScreenConnect instances were deployed for persistent remote access, with scheduled tasks created to maintain persistence. The campaign used browser fingerprinting and Telegram bots to filter victims and track infections, leveraging trusted Microsoft domains to bypass email security and increase credibility.
The npm package tailwindcss-animatecss-keyframes version 1.0.0 contains malicious code or depends on a malicious package. Installation or use of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
The npm package @ikyyjee/ikkysingle version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The malicious code uses obfuscation techniques to hide the target channel identifiers and may fetch updated target lists at runtime. This behavior abuses the installer's authenticated WhatsApp session but does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The npm package @ikyyjee/ikyysinggle version 1.7.7 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched to evade detection. This malicious behavior abuses the installer's WhatsApp session to increase subscribers for attacker channels but does not steal credentials or execute arbitrary code.
The npm package @ikyyjee/ikyysingle version 1.7.8 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious code uses the victim's own WhatsApp session to issue subscription requests. This behavior does not involve credential theft, persistence, or arbitrary code execution.
PoeLLM is malware involved in a cryptomining campaign targeting exposed AI servers. The malware infects these servers to convert them into scanners and exploit launchpads for further attacks. There is no detailed technical information or confirmed exploits in the wild provided.
A core member of the Qilin ransomware group was arrested in Japan and extradited to Germany to face hacking charges related to ransomware attacks. Qilin, active since August 2022, is a prolific ransomware-as-a-service operation responsible for hundreds of attacks worldwide, causing significant financial and operational damage. The group has targeted various sectors including healthcare, logistics, and manufacturing, and exploited vulnerabilities such as CVE-2026-50751 in Check Point products. The arrest marks a law enforcement success against this ransomware gang.
The npm package 'waie-crash-baileys' contains malicious code or depends on a malicious package. Installing or running this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine is strongly advised.
An Iranian state-aligned threat actor known as CL-STA-1178 has been conducting the Blinder Tunnel campaign since November 2025, targeting Iraqi critical infrastructure. The attackers impersonate the Dubai Airports IT department to deliver trojanized coding challenges that deploy ShelbyLoader V2 malware. The attack chain involves AppDomainManager hijacking and DLL sideloading techniques. The threat actor uses GitHub API infrastructure for command-and-control communications, including fallback channels via repositories and issues. Operational security mistakes linked this campaign to a separate credential harvesting operation targeting Israeli entities with conflict-themed Google Drive lures in mid-2026.
The Akira ransomware attack involved an adversary gaining initial access via Remote Desktop Protocol (RDP), disabling antivirus protections on the compromised endpoint, exfiltrating data using Rclone, and maintaining persistence with a GOST tunneling tool before deploying the ransomware payload. Key indicators of compromise include specific SHA256 hashes of malicious binaries and a command and control (C2) server IP address. This attack demonstrates tactics such as antivirus evasion, data exfiltration, and persistence mechanisms.
The npm package css-jptvix-polyfill version 1.0.0 contains malicious code that mimics internal Wix thunderbolt modules to trigger its payload when imported. Upon loading, it executes system commands to gather environment details and sends this sensitive information to a hardcoded external server. It also downloads and executes attacker-controlled JavaScript, potentially establishing a reverse shell on the victim's machine. This behavior indicates a dependency confusion attack targeting Wix thunderbolt builds.
