---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
Multiple cheap Android projectors using the Allwinner H713 chipset, sold under various brand names, come pre-installed with a multi-stage malware ecosystem. This malware includes a command-and-control (C2) loader that deploys modular plugins for residential proxy networks, ad-fraud, and botnet activities. The malware has root backdoors and can execute arbitrary code with system privileges. It exfiltrates device identifiers to servers in China and supports geo-fenced malicious activities. The infection chain involves four stages: StoreOS dropper, SilentSDK, PluginManager, and final plugins. Network-level blocking and disabling malicious apps via ADB are recommended mitigations.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (92a0735c100233f803adcf4cec20645acbb5f01b1757e8889dfaa631e49dae71)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (c0f6ddfc6a324d42219bbea8405be17115f83eca0e2d2eecb4e3fe6b6ec3dbde)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
The echogen package on PyPI version 1.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The PyPI package 'voxcpmtts3' versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that impersonates legitimate activity but actually deploys a cryptocurrency miner. This behavior is part of a campaign identified as 2026-10-voxeval, which has clear malicious intent. There is no CVSS score available for this threat.
The voxel-tts package on PyPI versions 0.5.0 and 0.5.1 contains malicious code that deploys a cryptocurrency miner instead of its advertised functionality. This is part of a campaign identified as 2026-10-voxeval with clear malicious intent.
The voxeval package on PyPI versions 0.4.2 through 0.4.5 contains malicious code that deploys a cryptocurrency miner instead of providing legitimate functionality. This is a malicious campaign identified as 2026-10-voxeval with clear intent to misuse victim resources for cryptomining.
The npm package 'ui-base-colors' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'translate-base-font' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'ui.dist.min.js' contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by the package.
The npm package '@smwebserver/static' version 99.9.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No official patch or remediation information is provided.
The China-linked ransomware group Warlock targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities to gain initial access. [...]
The dedh-devops-automation package on PyPI contains malicious code that executes during installation. It deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate sensitive data. The package overrides the install command in setup.py to perform these malicious actions. Multiple versions of the package are affected, including 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, and 5.9.0. This campaign is identified as having clear malicious intent, targeting cloud tokens and credentials.
The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It tricks victims with a fake Cloudflare CAPTCHA page to manually run msiexec.exe commands that install malware. This malware steals browser credentials, session tokens, and cryptocurrency wallet data from wallets such as MetaMask and Trust Wallet. It maintains persistence through browser extensions using native messaging and scheduled tasks, and communicates with a REST API for further commands. The campaign uses signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. It is financially motivated and specifically targets Ukrainian victims.
A sophisticated multi-component malware campaign targets telecommunications and network-edge appliances using BPFDoor variants and a newly identified implant called AVERAT. The attackers exploit SMTP traffic on port 25 to hide command-and-control communications within legitimate mail relay activity. The malware uses memory-only execution to avoid leaving forensic artifacts on disk. BPFDoor variants impersonate legitimate processes on South Korean systems, while AVERAT targets Taiwanese appliances with regional disguises. The operation employs compromised consumer devices as relays, consistent with a China-linked covert network. The campaign demonstrates advanced evasion techniques including process spoofing and encrypted configurations.
CloudSyncD is a persistent backdoor malware targeting macOS users via a fake Zoom installer. Delivered through social engineering, the malware dropper masquerades as a legitimate Zoom installer and requires user activation, during which it collects the user's password to gain root privileges. The malware runs stealthily as a daemon named CloudSyncD, performing host profiling and exfiltrating system and user details to its command-and-control servers. It avoids standard infostealer functions and focuses on establishing long-term access. Researchers observed the malware progressing from development to deployment, with multiple builds communicating with C2 servers disguised as benign JavaScript fetches.
BraZetsu is a Python-based Windows malware framework used by the Brazilian threat actor Exilware. It functions as a toolkit for Initial Access Brokers, converting compromised systems into assets for sale in underground markets. The malware targets corporate, financial, industrial, and law enforcement sectors primarily in Iberia and Latin America. It harvests financial transaction files in the Brazilian CNAB format, browsing histories, and digital certificates. BraZetsu supports the 'Infected Marketplace' where initial access is sold to criminal clients for further exploitation. Since early 2026, it has rapidly evolved to include AI-enhanced reconnaissance and advanced evasion techniques. There is no indication of known exploits in the wild or available patches.
During August 2026, multiple APT campaigns targeted South Korean entities primarily through spear phishing attacks utilizing LNK files. Six distinct attack types were identified, employing various techniques including PowerShell scripts, AutoIt programs, and DLL side-loading. Type A used HEX data extraction with PubNub command and control, while Type B leveraged curl.exe to download HTA files from GitHub and Google Drive, deploying infostealers and keyloggers. Type C distributed XenoRAT malware via GitHub repositories. Type D used resume-themed lures with VBS, BAT, and PowerShell scripts for backdoor injection. Type E employed Python-based backdoors through disguised pythonw.exe executables. Type F exploited Hangul documents with embedded OLE objects for malicious DLL loading. Attacks focused on information theft, system control hijacking, and additional malware deployment.
