Threats Tagged 'sandbox evasion'

A coordinated campaign identified on July 7, 2026, involved 17 malicious packages published simultaneously across the npm and PyPI ecosystems. These packages typosquatted legitimate payment SDKs such as PaySafe, Skrill, and Neteller to steal developer credentials and tokens. The malware uses advanced anti-analysis techniques including sandbox detection based on CPU cores and hostname patterns, multi-layer C2 domain obfuscation with XOR encoding, and selective activation gating. Once executed, the packages exfiltrate environment variables containing sensitive API keys, secrets, tokens, and authentication credentials to AWS-hosted infrastructure via an ngrok endpoint. This campaign reflects a financially motivated, organized threat actor with cross-ecosystem capabilities and operational security awareness.