Malware threats

The Underground malware campaign uses an Aotera/Tedy loader to inject a Vidar-class stealer into Windows processes. It targets cryptocurrency exchange accounts by injecting malicious scripts into Chrome and Edge sessions, enabling automatic theft via fake security overlays and email manipulation. The malware also includes a clipboard hijacker that replaces copied cryptocurrency wallet addresses with attacker-controlled addresses. Active since October 2023, the operation has stolen approximately $100,000 from 350-430 victims across 23 blockchain networks. Infection begins with lure archives containing trojanized files and includes anti-analysis checks against 67 monitoring tools. The campaign rapidly rotates Cloudflare-fronted domains to evade reputation-based detection.

The npm package 'kartykgithub-ph-f' version 1.0.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.

RemusStealer is a malware-as-a-service program exhibiting multiple similarities to LummaStealer, including anti-virtual machine checks, credential theft tactics, and Application-Bound Encryption bypass methods. A key distinction is RemusStealer's use of Ethereum smart contracts for C2 communications instead of Steam or Telegram dead drop resolvers. Written in Go, the stealer performs extensive system discovery, gathering information about antivirus products, hardware specifications, and operating systems. It employs hidden desktop environments to evade detection while launching Microsoft Edge and Brave browser processes on non-primary window stations to steal credential files. The malware establishes connections to suspicious domains ending in .shop or .biz and communicates with Ethereum-related infrastructure. This evolution demonstrates attackers' increasing sophistication in leveraging blockchain technology to masquerade malicious communications through smart contracts.

TIKTOUK is a credential collection toolkit targeting WordPress sites. It includes modules that identify WordPress installations, extract exposed configuration files and database credentials, decrypt email credentials from SMTP plugins, and harvest secrets from client-side JavaScript. The toolkit sends all collected data to a centralized controller. Real-world incidents have revealed approximately 50,000 compromised server credentials across 37,000 domains, including hundreds of validated AWS keys that could be abused.

The spo365-graph package on PyPI contains malicious code introduced in version 1.1.2 that executes during installation. This code deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate other sensitive data. The package overrides the install command in setup.py to carry out these malicious actions.

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join. The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork. The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code. Affected package: @kelvdra/baileys (npm), version(s): 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (839545967c959062f79d5b217758730bd2c6a69219949c2eea494e75e3cfc12a) package.json in @kelvdra/baileys@1.0.6-rc.4 declares the dependency `libsignal` as `github:Kelvdra/libsignal` with no version, tag, or commit SHA. On `npm install`, npm resolves this specifier to the current tip of the referenced repository's default branch and installs whatever bytes it returns, running any lifecycle scripts contained within them, with no integrity check. The dependency source is not the npm registry and not a pinned commit, so the code that lands on the installer's machine can change at any moment without any change to this package. Control of that GitHub account or repository translates directly into install-time code execution on every installer of this package.

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the victim's account to channels it never asked to join. The target JID(s) are hidden from casual source review via one of several obfuscation techniques observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change after installation without a new npm publish. Every sample in the family shares the same underlying mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after connect), even though the package name, JID value(s), and obfuscation/delivery method differ per fork. The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish persistence, or execute arbitrary remote code. Affected package: @bottino/baileys (npm), version(s): 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.2, 1.0.1. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (571d52cf3274d95d4824667269921b2e0ad1478fe9f324a74fab0ba377bb9a26) This fork of Baileys overrides `requestPairingCode` so that when the caller does not supply an explicit `pairKey`, `authState.creds.pairingCode` is set to the fixed literal string `BYPAKI64`. That value is then used as the KDF input for the WhatsApp companion-device link-code encryption via `derivePairingCodeKey(authState.creds.pairingCode, salt)`. Because the pairing code is a known constant baked into the package, anyone who knows the target phone number of the installer's WhatsApp account can complete the companion-device pair flow from a device they control and obtain persistent access to the installer's WhatsApp session (read/send messages, contacts, media) — a full account takeover backdoor against any application built on this library. Additionally, on socket connect the code auto-subscribes the installer's WhatsApp account to a hardcoded newsletter JID `120363418582531215@newsletter` and persists a `basedbysam` flag so the covert subscribe runs once per credential store; this covert action uses the installer's WhatsApp identity without disclosure.

KillSec was a ransomware group active since around 2024, responsible for roughly 1,000 suspected attacks worldwide. The group used software vulnerabilities and weakly protected entry points, especially cloud storage, to steal sensitive data from victims. Police have shut down KillSec's leak site, seized at least 110 terabytes of stolen data, and arrested several alleged members, including a 16-year-old suspected leader. The group's infrastructure, including five core servers, was taken over by law enforcement, and its domains now redirect to seizure notices. The investigation is ongoing with international cooperation and support from cybersecurity firms.

friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f) The package presents itself as 'Small greeting utilities' but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer's Snowflake OAuth session token, calls snowflake.connector.connect with authenticator='oauth' and role='ACCOUNTADMIN', then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN='arn:aws:iam::631484165566:role/pentests_s3_role', and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer's Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage. The obfuscation (gzip+base64+exec), the cover-story package description, and the hardcoded attacker S3 bucket and IAM role are consistent with a Snowflake-targeted data-theft payload. ## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381) The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-friendly-greeting-tools Reasons (based on the campaign): - exfiltration-generic - obfuscation

The US Treasury Department has sanctioned Anibal Alexander Canelon Aguirre, aka 'Prometheus,' the alleged developer of ATM jackpotting malware linked to the Tren de Aragua criminal network. The malware, known as Ploutus, enables attackers to remotely force ATMs to dispense cash illicitly. The network operates primarily from Mexico and Venezuela, targeting ATMs in the United States, with reported losses exceeding $40 million from over 1,500 attacks as of August 2025. Several associates and entities linked to this network have also been sanctioned and indicted. The US government has taken extensive legal and financial actions against the individuals and their cryptocurrency addresses to disrupt their operations.

On August 31, 2026, threat actors exploited two zero-day vulnerabilities in PaperCut MF version 24.0.2, targeting an internet-facing print server in the Education sector. The attackers deployed an in-memory Java loader to establish a web shell, through which they delivered a trojanized Microsoft Copilot binary containing an AdaptixC2 implant. This implant connected to command-and-control infrastructure hosted on Alibaba servers. After a dormant period, the attackers performed reconnaissance and Active Directory enumeration, stole a token from a domain-privileged service account, and moved laterally to a domain controller. On the domain controller, they dumped credentials, enabled Windows Restricted Admin mode for pass-the-hash attacks, and extracted the NTDS.dit database, achieving full domain compromise.

The Russian state-sponsored threat actor Star Blizzard has developed a new malware delivery technique called RedFlick to deploy its CosmicPulse backdoor. This method automates the infection chain by using a password-protected archive containing a virtual disk with a malicious shortcut file, which when opened, triggers hidden commands to download and install malware components via scheduled tasks. These tasks perform distinct roles to evade detection and ultimately deliver the CosmicPulse backdoor, capable of executing attacker-supplied Python code. The campaigns primarily target Ukrainian individuals and institutions, as well as international NGOs, think tanks, governments, and financial organizations supporting Ukraine. Microsoft recommends phishing-resistant authentication, Conditional Access policies, email protection, and endpoint detection and response solutions to mitigate these attacks.

Since January 2026, the Russian state threat actor Star Blizzard has enhanced its cyberespionage operations by adopting a new malware delivery technique called RedFlick, alongside large-scale phishing campaigns and use of compromised website accounts. These tactics improve detection evasion and target Ukrainian individuals and institutions, as well as international NGOs, Western think tanks, governments, and organizations linked to Ukraine support. Indicators include multiple malicious domains, file hashes, and an IP address associated with the campaign. No specific software vulnerabilities or CVEs are identified.

Malware#redflick#espionageUkraine

2CLoader is a newly identified malware loader active since August 2026 that delivers information stealers such as Vidar and Remus, as well as the XWorm RAT. It features advanced anti-analysis and evasion techniques, including anti-VM, anti-debug, indirect system calls via Hell's Gate, and inline trampoline hooks to bypass endpoint security. The loader protects its payloads with rolling XOR and AES-GCM encryption stored as PE resources and supports multiple execution methods. It communicates with command-and-control servers using encrypted JSON over HTTP POST and maintains persistence through registry keys, scheduled tasks, and startup folders.

The @hanzofc/baileys npm package versions 7.0.0 and 7.0.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert follow query into the WhatsApp socket connection, leveraging the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.

The @japofc/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.

The npm package @lendkzn/xntaabail version 7.0.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or fetched dynamically, and the malicious action uses the installer's own WhatsApp session to perform the subscription. This behavior does not involve credential theft, persistence, or arbitrary code execution.

The npm package @noxleyss/baileys version 1.1.10 is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The subscription targets are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.

The npm package @nyzzpedia/baileys-new version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. This behavior does not steal credentials, maintain persistence, or execute arbitrary code.

The @queenanya/baileys npm package versions 9.10.1, 9.7.3-beta.1, and 9.7.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel identifiers are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.