Search: df.exe

A sophisticated supply-chain attack named NetamLoader targets a custom Windows 10 build used exclusively by government entities in Asia. The attack uses a multi-stage infection chain involving CAB archives in Windows update directories, exploiting AppDomainManager injection and BinaryFormatter deserialization vulnerabilities. It bypasses AMSI protections, uses AES encryption for network communications, and employs anti-analysis techniques including long polling intervals and forensic evidence removal. The malware operates covertly by migrating to dllhost.exe and executing payloads in isolated AppDomains. Commercial hosting infrastructure such as Cloudflare CDN is used for command-and-control communications.

@apexacc/cli is distributed by "Apex Accelerator" (Apex Arena), a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs (REF8801, published 2026-10-12) found it is a repackaged Oh My Pi coding agent (1,351 of 1,363 files identical) with malicious additions that hijack the developer's AI coding agent: it overwrites OPENROUTER_BASE_URL so model traffic (prompts, files read, tool results) goes to attacker infrastructure at arena.apexaccs.org; persists an attacker-controlled remote MCP server in ~/.apex/agent/mcp.json; and defaults tool approval to "yolo". A bootstrap retrieves commands from vrf.apexaccs.org: on macOS it drops CloudSyncD (fake password prompt, credential theft, C2 ccmihr.com); on Windows a staged loader chain ends in an infostealer that exfiltrates browser credentials, wallets, messengers, VPN clients and Claude/Cursor/Windsurf configs over Telegram. Elastic analyzed version 1.6.1 and traced the bootstrap to the earliest preserved version (script host arenapex.cloud). The package was still live on npm (latest 1.6.2) with no OSV record as of 2026-10-16. Independently confirmed by static inspection of the live 1.6.2 npm tarball (sha256 7ca5e3908dd8721d0cf6af2488f0825c0d91a5e0b7c8529ef830141a4a3ba31f) on 2026-10-16, without execution: the bin launcher apex.cjs (sha256 4029192a44ee738deba9aa53b57550075cb8fd170a63f0636dea5452256f2175) runs when the user invokes the CLI (no install script). On Windows it sets the current user's PowerShell execution policy to RemoteSigned (no elevation needed), and on Windows 11 it launches a hidden, elevated (UAC RunAs) PowerShell that attempts to add a Defender exclusion for ~/.apex and to set HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 (disabling Smart App Control). From 1.5.122 (2026-09-17) through 1.6.2 those two commands are built in a JavaScript template literal with single backslashes, so the shipped paths are mangled (the exclusion lands on a sibling path '<home>.apex' and the registry key is invalid) and both likely fail; the UAC prompt still appears. Versions 1.5.120 (registry change) and 1.5.121 (adds the Defender exclusion), both 2026-09-17, carried correctly escaped versions of these commands without an elevation prompt, effective only when already running as administrator. The execution-policy change first appears in 1.6.2. It then downloads a ~114MB native binary from GitHub releases of apexaccs/copilot into ~/.apex/bin, and on macOS an additional apex-verify-darwin helper. Both GitHub repositories referenced by the package versions (apexaccs/copilot, Apex-Accelerator/apexcli) return 404 as of 2026-10-16. All versions affected. Indicators from Elastic's report. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c174007782646e1fdfd9806ecd699e427fd36661dd7137fa462672f41aee6e79) On CLI startup (invoked via npx per the package README), apex.cjs unconditionally detects Windows 11 and launches a hidden, UAC-elevated PowerShell via Start-Process -Verb RunAs -WindowStyle Hidden with a UTF-16LE base64 -EncodedCommand payload. The elevated payload (a) calls Add-MpPreference -ExclusionPath on %USERPROFILE%\.apex to whitelist the package directory in Windows Defender, and (b) writes HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy VerifiedAndReputablePolicyState=0 via reg add, disabling Smart App Control / Code Integrity enforcement machine-wide. The elevation path uses underscore-prefixed identifiers (_ps, _enc, _sp, _osv, _isWin11, _home), a hidden window, base64 command encoding, and a broad try/catch that silently swallows errors. After weakening the host, the CLI downloads a ~105MB apex-<platform>.exe (and an optional native.node addon) from the publisher's GitHub Releases with no hash or signature verification, chmods 0755, and executes it via spawnSync with inherited stdio and the full process.env. The security-policy downgrade is not consistent with any documented function of an AI CLI and converts an otherwise routine publisher-pinned binary fetch into execution of unverified code under a machine-wide-weakened Windows security posture.

BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.

QuartzLine, also known as CLOUDHAZE, is malware disguised as a legitimate Windows PDF viewer that contains a backdoor. It has been distributed via malicious advertising campaigns, leveraging AWS S3 buckets for hosting. The malware establishes persistence through scheduled tasks and communicates with command-and-control servers. It operates with user-level privileges, allowing attackers to execute arbitrary Windows commands and deploy additional malware such as the Caira and IronBark remote access trojans. Early activity includes theft of Chrome browser data within one week of infection. The malware is signed with a now-revoked legitimate EV code-signing certificate, appearing as paperline.exe and fielddesk.exe.

ImageMagick on Windows versions through 7.1.2-33 and 6.9.13-58 has an uncontrolled search path vulnerability in the NTGhostscriptEXE() function. This function launches the Ghostscript executable gswin64c.exe by its bare name when Ghostscript is not registered. An attacker can exploit this by placing a malicious gswin64c.exe in the working directory, causing it to be executed with ImageMagick's privileges during conversion of PDF, PostScript, or EPS files.

The Psychedelic Stealer is an active malware campaign targeting Ukrainian small-business websites as of September 2026. It uses a fake Cloudflare CAPTCHA page to trick victims into manually running msiexec.exe commands, which install malware that steals browser credentials, session tokens, and cryptocurrency wallet data from wallets like MetaMask and Trust Wallet. The malware maintains persistence through browser extensions with native messaging and scheduled tasks, and communicates with a REST API for further commands. It employs signed Microsoft binaries and avoids encoded PowerShell scripts to evade detection. The campaign is financially motivated and specifically targets Ukrainian victims.

Malware#cryptocurrency theft#fake captchaUkraine+1

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1) The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI invocation. Both dist/index.cjs (the package main) and dist/cli.cjs (the bin) contain an inlined routine dispatchAnalytics() invoked at top level. That routine reads dist/stest.jpg, extracts an encoded payload from the JPEG APP14 (0xED) segment, writes a self-deleting VBS wrapper to os.tmpdir(), and launches it via wscript.exe to run powershell.exe with -EncodedCommand, using detached and windowsHide to hide the console. The strings 'powershell.exe', 'wscript.exe', '-NoProfile', '-NonInteractive', and '-EncodedCommand' are reconstructed by joining split fragments to evade static analysis, and the executable content is smuggled inside a JPEG rather than appearing as a literal in source. Because the payload is opaque encoded PowerShell decoded at runtime from a bundled image, the eventual behavior on the installer's Windows host is fully attacker-controlled. Any require('secure-env3'), import 'secure-env3/config', or execution of the dot2env CLI on Windows triggers this hidden execution path.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf) The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.

Threat actors exploited trusted brands and cloud services in a sophisticated web campaign combining fraudulent DocuSign workflows, Florida healthcare screening lures, and deceptive cloud infrastructure to deploy ConnectWise ScreenConnect Access clients. The attack utilized Cloudflare Pages hosting with fake Cloudflare verification workflows to establish legitimacy. Victims were socially engineered to download a ZIP archive containing a malicious HTA file that employed Base64-encoded VBScript, fake Adobe interfaces, UAC privilege escalation, and Microsoft Defender SmartScreen registry modifications. The attack leveraged living-off-the-land techniques using native Windows tools like mshta.exe, curl.exe, and msiexec.exe for silent ScreenConnect installation, ultimately providing unauthorized remote access. The campaign was classified as Zero Hour Fraudulent and blocked at the web entry point before payload delivery could occur.

A China-nexus threat actor is targeting Myanmar government personnel and diplomats through Operation QUICSILVER, delivering malware via Virtual Hard Disk files disguised as JPEG images. The campaign uses Burmese-language lures impersonating Myanmar's Information Technology and Cyber Security Department, including graduation ceremony invitations. The multi-stage infection chain begins with a malicious LNK file that abuses ftp.exe to execute scripts, reconstructs payloads from split files, and deploys QUICAgent, a custom Go-based backdoor. The implant retrieves C2 infrastructure through Cloudflare Workers, communicates over HTTP/3 using QUIC protocol, and employs RC4 encryption. Deleted documents recovered from the VHD reveal interest in ASEAN affairs, BIMSTEC, and Myanmar diplomatic activities. Three related campaigns were identified between April and July 2026, sharing similar TTPs and infrastructure.

Malware#vhd file#quic protocolMyanmar

<!-- maintainer-action:start --> ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: `CAND-PNPM-063` / `GHSA-w466-c33r-3gjp` - Advisory URL: https://github.com/pnpm/pnpm/security/advisories/GHSA-w466-c33r-3gjp - Shared patch PR: https://github.com/pnpm/pnpm-ghsa-j2hc-m6cf-6jm8/pull/1 - Shared patch branch: `security/ghsa-batch-2026-06-09` - Patch commit: `a93449314f398cf4bdf2e28d033c02d37395ad22` - Base commit: `origin/main` `55a4035abf1ae3fe7208ba1f5ef43c5eff58ccec` - Maintainer priority: `start-here` - Component: `pnpm packageManager env lockfile` - Patch area: package-manager env lockfile is re-resolved through trusted registries before execution - Affected packages: `npm:pnpm`, `npm:@pnpm/installing.env-installer` - CWE IDs: `CWE-829`, `CWE-494`, `CWE-345` - Conservative CVSS: `8.8` / `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` - Next action: review the shared patch branch for this component, set the final affected version range, merge and release the fix, then publish or close the advisory. ### Expected Patched Behavior Committed env-lockfile package-manager entries are force-refreshed through trusted registries before execution; attacker tarball requests and markers stay at zero. ### Files And Tests To Review - `installing/env-installer/src/resolvePackageManagerIntegrities.ts` - `pnpm/src/switchCliVersion.ts` - `pnpm/src/switchCliVersion.test.ts` - `.changeset/clean-package-manager-registries.md` ### Focused Validation Run these from a checkout of the shared patch branch. They are the useful maintainer commands with machine-local artifact paths removed. ```bash ./node_modules/.bin/tsgo --build installing/env-installer/tsconfig.json ./node_modules/.bin/tsgo --build pnpm/tsconfig.json PNPM_REGISTRY_MOCK_PORT=7799 NODE_OPTIONS="--experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169" ../node_modules/.bin/jest src/switchCliVersion.test.ts -t "re-resolved package-manager lockfile" --runInBand PNPM_REGISTRY_MOCK_PORT=7799 NODE_OPTIONS="--experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169" ../node_modules/.bin/jest src/switchCliVersion.test.ts src/syncEnvLockfile.test.ts --runInBand ./node_modules/.bin/eslint installing/env-installer/src/resolvePackageManagerIntegrities.ts pnpm/src/switchCliVersion.ts pnpm/src/switchCliVersion.test.ts git diff --check ``` The full patched replay for the shared branch passed with all 20 candidates marked fixed. This candidate's replay evidence is `results/CAND-PNPM-063-patched-result.json`. <!-- maintainer-action:end --> ### Summary pnpm can persist package-manager bootstrap metadata in the first YAML document of `pnpm-lock.yaml`. Before the patch, direct pnpm execution trusted an already resolved `packageManagerDependencies` entry when the committed env lockfile contained matching `pnpm` and `@pnpm/exe` versions. A malicious repository could therefore commit package-manager lockfile package records and snapshots that bypassed fresh package-manager resolution, then cause pnpm to install and execute bytes selected by that committed lockfile state during automatic version switching. ### Details The vulnerable source-to-sink path was: - `lockfile/fs/src/envLockfile.ts` reads the repository's first YAML lockfile document and validates shape only. - `pnpm/src/main.ts` reaches `switchCliVersion()` when a direct pnpm invocation sees a wanted `pnpm` package manager with `onFail=download`. - `pnpm/src/switchCliVersion.ts` reads the committed env lockfile when package-manager metadata should be persisted. - `installing/env-installer/src/resolvePackageManagerIntegrities.ts` treated `packageManagerDependencies` as resolved when only the `pnpm` and `@pnpm/exe` versions matched. - `engine/pm/commands/src/self-updater/installPnpm.ts` converts env-lockfile `snapshots` and `packages` into the wanted lockfile used by `headlessInstall()`. - `pnpm/src/switchCliVersion.ts` executes the installed `pnpm` binary with `spawn.sync()`. The helper fast path is intentionally still version-based for non-execution callers, so the security boundary is enforced at the execution path: `switchCliVersion()` now re-resolves already present package-manager env-lockfile entries before they can reach `installPnpmToStore()` and `spawn.sync()`. ### PoC Standalone PoC and verification script: The PoC constructs a committed env-lockfile object with matching package-manager dependency versions and attacker-selected package metadata: ```json { "importers": { ".": { "configDependencies": {}, "packageManagerDependencies": { "@pnpm/exe": { "specifier": "9.3.0", "version": "9.3.0" }, "pnpm": { "specifier": "9.3.0", "version": "9.3.0" } } } }, "lockfileVersion": "9.0", "packages": { "/pnpm@9.3.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916) The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x86_64 ELF at dist/internal/calc-math.dat. The main entry's top-level IIFE chmods 0755 and spawns this binary detached on any require()/import, under cover text 'Native accelerator loaded'. The ELF is a remote-controlled shell beaconing to hardcoded C2 217.60.77.63: it accepts remote commands and pipes them to /bin/sh and /bin/bash (arbitrary RCE on the installer's host), fetches second-stage ELF/shellcode over plain HTTP from http://217.60.77.63/Others/ and http://217.60.77.63/SC/ into /tmp or a memfd for chmod+exec, installs a systemd user unit at ~/.config/systemd/user/svc-update.service (Description='System Update Service', ExecStart=/proc/self/exe, enabled via systemctl --user) for reboot-surviving persistence, and streams collected files (SSH keys, credentials, database finds, clipboard, downloads) to http://217.60.77.63/api/extract-receive as chunked POSTs tagged Loot_<host>_<date>. Behavior fires on import, requires no user interaction beyond installing the package, and grants the operator full interactive shell, dropper, persistence, and bulk file exfiltration on any host that installs or transitively depends on this package. ## Source: ghsa-malware (f1234e3b7168d42083f0164bd35e94c2bde548891b63b0f33b2dbd53b65e40aa) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Files built with the polyglot technique have been showing up more and more in cyberattacks in recent years. They let attackers slip malware past email filters and file scanners, deceive victims in phishing attacks, and complicate incident investigations. To pull this off, attackers deliberately construct a file that a system can interpret as different formats depending on which application opens it. A classic example is a file that can be handled as a PNG image or a ZIP archive. All it takes is changing the file’s extension, or simply using one or another application to open it. Let’s take a look at why it’s even possible to create files like this, which format combinations have turned up in real-world attacks, and how organizations can protect themselves from this threat. Why polyglot files are possible The data formats behind polyglot files are seldom exotic. It all comes down to a clever combination of common formats that happen to be structurally compatible. Polyglots exploit at least one of the following quirks in certain file formats: Most file formats need decoding from the very first byte, but some require to read them from the end. The clearest example is a ZIP archive: a corrupted or missing beginning doesn’t stop applications from reading the file, because all the needed headers actually sit at the end. This lets attackers simply glue two files together — in the example above, a PNG and a ZIP. The beginning reads as a valid PNG image, while the end reads as a valid ZIP archive. Many formats work like Russian matryoshka nesting dolls: despite outwardly having a specific extension matching its intended usage, inside the file is essentially a ZIP archive containing the necessary data. This group includes modern office documents (DOCX/XLSX/PPTX), Android installation packages (APK), Java library files (JAR), and many others. Some formats have no strict structural requirements — or their requirements are loose enough that the application that’s processing the file can locate the fragment it needs even when that fragment isn’t at the beginning. The Polydet GitHub repository describes numerous examples of possible file combinations for building a polyglot. Under the MITRE classification, this technique falls under the Masquerading category ( T1036.008 , Masquerade File Type). Examples of polyglot files in known cyberattacks Publicly available malware campaign analyses reveal all kinds of polyglots. Attackers adapt the entire attack scenario to fit a specific file type combination. The Head Mare group delivered the PhantomPyramid malware as a ZIP attachment. The file consisted of Windows executable code (EXE) with a small ZIP archive glued onto the end. When the victim opened the archive, it contained a file with the extension PDF.LNK, which would then launch that same polyglot attachment — this time as an executable file. In the attack documented by JPCERT , attackers created a file that started as a PDF and was detected as a PDF by most scanners but carried a DOC extension and opened in Office applications as a valid DOC file containing malicious macros. The attacks spreading the StrRAT and Ratty Trojans used a polyglot built from a signed Windows installer package (MSI) with malicious Java code (JAR) tacked onto the end. The StrelaStealer attacks used a polyglot with an HTML extension: a Windows library (DLL) with a decoy HTML document glued onto the end. A shortcut in the archive launched the file twice: once via the start command (the equivalent of a double-click, which opened a browser showing the HTML document), and once via rundll32 (which launched the malicious DLL). In a simulated but elegant attack, researchers joined two ordinary ZIP files together and found that different popular archive tools displayed the combined file differently: some showed only the first archive, some only the second, and some showed both at once as if it were a single archive with shared contents. If the attacker is familiar with the vic…

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in audit_dupe_exe() A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved (e.g., via do_renameat2()), the VFS layer locks the parent directory (I_MUTEX_PARENT), which synchronously triggers an fsnotify_move event. If an existing executable audit rule matches the file being moved, the audit subsystem catches this event and calls audit_dupe_exe() to duplicate the watch and update the rule. Then, audit_alloc_mark() would call kern_path_parent() to resolve the path, leading to a blind attempt to acquire the exact same I_MUTEX_PARENT lock already held by the task, resulting in the following recursive locking deadlock: ============================================ WARNING: possible recursive locking detected 6.12.0-55.27.1.el10_0.x86_64+debug #1 Not tainted -------------------------------------------- mv/5099 is trying to acquire lock: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: __kern_path_locked+0x10a/0x2f0 but task is already holding lock: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1){+.+.}-{3:3}, at: lock_two_directories+0x13f/0x2b0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&inode->i_sb->s_type->i_mutex_dir_key/1); lock(&inode->i_sb->s_type->i_mutex_dir_key/1); *** DEADLOCK *** May be due to missing lock nesting notation 6 locks held by mv/5099: #0: ffff888112a9c440 (sb_writers#13) at: do_renameat2+0x34c/0xbc0 #1: ffff888112a9c790 (&type->s_vfs_rename_key#3) at: do_renameat2+0x415/0xbc0 #2: ffff888132846b58 (&inode->i_sb->s_type->i_mutex_dir_key/1) at: lock_two_directories+0x13f/0x2b0 #3: ffff888132845358 (&inode->i_sb->s_type->i_mutex_dir_key/5) at: lock_two_directories+0x175/0x2b0 #4: ffffffffb3a1fb10 (&fsnotify_mark_srcu) at: fsnotify+0x454/0x28a0 #5: ffffffffaf886230 (audit_filter_mutex) at: audit_update_watch+0x36/0x11e0 stack backtrace: Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_deadlock_bug.cold+0xbd/0xca validate_chain+0x83a/0xf00 __lock_acquire+0xcac/0x1d20 lock_acquire.part.0+0x11b/0x360 down_write_nested+0x9f/0x230 __kern_path_locked+0x10a/0x2f0 kern_path_locked+0x26/0x40 audit_alloc_mark+0xfb/0x4f0 audit_dupe_exe+0x6c/0xe0 audit_dupe_rule+0x6c2/0xc00 audit_update_watch+0x4cc/0x11e0 audit_watch_handle_event+0x12c/0x1b0 send_to_group+0x5d0/0x8b0 fsnotify+0x615/0x28a0 fsnotify_move+0x1d8/0x630 vfs_rename+0xdcd/0x1df0 do_renameat2+0x9d4/0xbc0 __x64_sys_renameat+0x192/0x260 do_syscall_64+0x92/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0491fe8c4e Code: 0f 1f 40 00 48 8b 15 c1 e1 16 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 49 89 ca b8 08 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 89 RSP: 002b:00007ffc7210bf38 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0491fe8c4e RDX: 0000000000000003 RSI: 00007ffc7210e6c8 RDI: 00000000ffffff9c RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 00005575eb2dae2a R11: 0000000000000246 R12: 00005575eb2dae2a R13: 00007ffc7210e6c8 R14: 0000000000000003 R15: 00000000ffffff9c </TASK> The aforementioned deadlock can be consistently reproduced by running the script below: audit-dupe-exe-deadlock.sh -------------------------- #!/bin/bash auditctl -D mkdir -p /tmp/foo touch /tmp/file auditctl -a always,exit -F exe=/tmp/file -F path=/tmp/file -S all -k dr mv /tmp/file /tmp/foo/file rm -Rf /tmp/foo This patch fixes the issue by introducing struct audit_watch_ctx to pass the fsnotify event context down to audit_alloc_mark(). By utilizing the already-resolved directory inode provided by the event, we bypass the kern_path_parent() path resol ---truncated---

Have you ever tried to open an “encrypted” email or an urgent document, only to realize with horror that your usual DOCX attachment is actually a file with the extension .docx.exe? Or maybe you received an email supposedly with an invoice, contract, or internal memo attached — only for the file to prove something entirely different from what it claimed to be? If so, you were likely targeted in a malware infection attempt. Cybercriminals routinely disguise malicious files as harmless documents and archives, banking on recipients blindly clicking without checking the extension. Kaspersky experts analyzed the file formats most frequently deployed in malicious email blasts to reveal what really lurks behind these extensions — and how attackers weaponize them in their campaigns. Important note: the extensions we’ll be discussing here are routinely used for completely legitimate files. For example, Windows executables normally end in .exe. However, we’re focusing specifically on scenarios where attackers disguise or spoof a file’s extension to pass it off as a totally different type of file. What extensions are most commonly found in malware? Our experts analyzed malicious email blasts from the beginning of 2026 to pinpoint the 15 most common dangerous file extensions. .exe .js .html .dll .bat .vbs .xls .pdf .jse .au3 .docx .htm .wsf .scr .lnk The top 15 file extensions used in malicious email blasts Let’s take a look at what files with these extensions actually do under the hood. Executable files An executable file is a compiled computer program that’s ready to run. Once launched, a malicious executable can download additional payloads, alter system settings, steal user data, connect your device to external attacker-controlled servers, and much more. These are the most common executable extensions found in malicious email campaigns: .exe .dll .com .scr .exe The classic Windows executable extension. It powers every program you use daily, from web browsers and games to office suites and software installers. By the way, attackers often wrap EXE malware in double extensions: invoice.docx.exe, report.pdf.exe, or even photo.jpg.exe. They take advantage of a default Windows setting: hiding extensions for known file types. Because this setting is turned on by default, users only see the first part of the file name — invoice.docx, report.pdf, or photo.jpg — and assume it’s just a normal document or image. But the second you open this trap file, the malware fires up. .dll Another common extension abused in malicious campaigns is .dll (dynamic-link library). These libraries hold functions that Windows programs frequently require while running, such as printing a document. This modular architecture prevents redundant code by letting multiple applications call on the exact same library for specific tasks. However, if an attacker replaces a legitimate library with an infected one, running any normal program that calls on it can trigger malicious code. .com While files with the .com extension have absolutely nothing to do with the web domain of the same name, cybercriminals likely count on victims mistaking these files for links in an unusual format. In reality, it’s a legacy Windows executable format. While modern versions of Windows no longer rely on this file type, the operating system can still run and execute it, which makes opening one a very bad idea. .scr SCR files are screensavers — those idle Windows screen animations featuring abstract patterns, the iconic bouncing logo, or whatever else. Despite their harmless reputation, screensavers are essentially executables just like EXE files: once opened, they can install extra components or alter system settings all the same. In malicious campaigns, these files routinely masquerade as images, screenshots, or documents. Scripts Scripts are text files containing a sequence of commands that a computer runs automatically in order. They can download files, install and launch programs, modify securi…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135) The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a top-level IIFE that chmod +x's a shipped Linux ELF at dist/internal/calc-cache.bin, verifies its sha256, and spawns it detached via child_process.spawn on any require()/import of the package. The binary is a remote-shell implant (strings include "REDSHELL", "SECURE_BEACON", "RedShell commands:", "/redshell socks start <port>") that connects to a hardcoded C2 at 217.60.77.63 and awaits operator commands. Once running, the implant exposes commands to (a) download and execute additional ELF binaries and raw shellcode fetched from http://<c2>/Others/... and http://<c2>/SC/... into /tmp or via memfd_create (syscall 319), (b) harvest SSH keys, credentials, database files, clipboard contents, and arbitrary files, exfiltrating them over a chunked HTTP POST channel to /api/extract-receive with BIGEXTRACT_START/END framing, and (c) install systemd user-unit persistence by writing ~/.config/systemd/user/svc-update.service (Description="System Update Service", Restart=always, ExecStart=/proc/self/exe) and running systemctl --user daemon-reload && enable --now. The ELF is labeled a "Native math accelerator" in the loader, but contains no math functionality — its entire string table is red-team beacon / SOCKS5 proxy / port-forward / shellcode-injection tooling. Importing this package hands remote command execution, credential access, and reboot-persistent access on the installer's host to the C2 operator. ## Source: ghsa-malware (c703ba5a38df97a92435243475d2439422432b7fa02025b4e41ae0308e1dde9b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5) On require(), _bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded *.workers.dev hosts (oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev) with a DNS TXT-record fallback channel over *.dl.wel1.ru subdomains, writes it to /tmp or %TEMP% under a disguised name (.cache_<tag> / dotnet_diag_<tag>.exe), chmods 0755, and detached-spawns it via /bin/sh -c or cmd /c start (_bootstrap.js line 119, 121, 125). Destination hostnames are split across array joins to evade static string search, and a secondary loader reassembles a base64 payload from indexed DNS TXT records (count from c.<domain>, chunks from <i>.<domain>). Cover-story comments frame the behavior as analytics/telemetry. ## Source: ghsa-malware (9e7caf9639d9018e9b2d1b267b2ac9aa3910b7c1554c960ac992a948d435b7ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e) On require() of bigops-storio, _support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split *.workers.dev hosts (oob-worker.cf100-416.workers.dev, cf101-adf, cf99-9b3, cf103-070 under workers.dev), assembled at runtime via array.join("") to hide the destinations from static inspection. The fetched bytes are written to /tmp or %TEMP% under a hidden random filename (dot-prefixed / dotnet_diag-style cover names), chmod 0755'd, and spawned detached via /bin/sh -c or cmd.exe /c start /b with stdio ignored. A DNS-TXT fallback (txtFetch/dns.resolveTxt against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, net.dl.wel1.ru — also assembled from string fragments) reassembles N base64-encoded TXT chunks into the same executable payload when HTTPS delivery fails. There is no version pinning, no hash or signature verification, and the fetched executable is unrelated to the package's stated storio abstraction purpose. The dropper runs automatically at library load time via index.js's try{require('./_support')}. ## Source: ghsa-malware (cd9ebb4bf8d8e6554d93f8343675d991c677dea6469481d1689813b405dca59c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f8f5027d945d8a05fe554b838ba2036e29a99c4296ad532b8d47a1bbaa22650e) The package name resembles @ngrx/component-store. The main entry index.js requires./_helpers, which on module load assembles attacker-controlled hostnames via array-join concatenation (e.g. ["oob-worker.","cf99-9b3.workers.d","ev"].join("")) to reach oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, and oob-worker.cf101-adf.workers.dev, with a DNS-TXT chunked base64 fallback under *.dl.wel1.ru. A platform-specific binary is fetched, written to /var/tmp or %TEMP% under a disguised name (.cache_<hex> or dotnet_diag_<hex>.exe), chmod 0755'd, and spawned detached via /bin/sh -c or cmd /c start /b. lib/telemetry.js hides dangerous API names by string concatenation (require("child_" + "process"), fs["chmod" + "Sync"]). The load-time fetch-and-execute of an opaque native executable from obfuscated hosts fires on any require() of this package. ## Source: ghsa-malware (6971cd73a1bd6b15cddd886529f19aca32451e75071ece000fddd17fd74c35fb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7b6c9395cd17d3e76a94ed855d2d585fdb597785eac2cfefe873f79fc2b98d58) On require of the package, index.js loads _bridge.js which selects a platform-specific binary path and downloads an opaque native binary from author-controlled Cloudflare Workers hosts whose names are reconstructed at runtime by array-join to evade static analysis (oob-worker.cf99-9b3.workers.dev, cf101-adf.workers.dev, cf103-070.workers.dev), with a DNS-TXT chunk fallback under *.dl.wel1.ru. The binary is written under /var/tmp or %TEMP% with cover-story filenames (dotnet_diag_<hex>.exe,.cache_<hex>), chmod 0755'd, and detached-spawned via cmd.exe/start or /bin/sh -c. A cache stamp under /tmp/.analytics_* is used to avoid re-execution. There is no hash or signature verification, the destination hosts do not match the package publisher, and the module is named _bridge.js with cover-story identifiers (analytics_state, dotnet_diag). An additional 81KB lib/telemetry.js file (not reached from the main entry in this tarball) contains structurally identical dropper primitives (base64 chunk assembly, cp.spawn('/bin/sh',['-c', filePath+' &']), chmodSync 0755, ServiceDiscovery/WorkerHost classes) as a reserve/variant payload. ## Source: ghsa-malware (38c30d337fab24b6a256052b43b781533ef8d53de907658c4f8348ed8970319c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.