Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Stealit malware campaign leverages Node.js Single Executable Application (SEA) technology to distribute malicious payloads as standalone binaries, bypassing the need for a Node.js runtime. Distributed mainly as disguised game and VPN installers via file-sharing sites, the malware employs heavy obfuscation and anti-analysis techniques to evade detection. Once executed, it acts as a Remote Access Trojan (RAT), stealing sensitive information such as login credentials and cryptocurrency wallet data. The campaign demonstrates adaptability by switching between Node.js SEA and Electron frameworks for payload delivery. Although no known exploits are currently active in the wild, the malware’s capability to control victim systems and extract valuable data poses a significant threat. The campaign’s medium severity rating reflects its stealth and information theft focus, with no immediate widespread exploitation reported. European organizations using Node.

The newly identified Stealit malware campaign exploits the Node.js Single Executable Application (SEA) feature to bundle malicious scripts into standalone executable binaries. This approach allows the malware to run on victim systems without requiring a pre-installed Node.js runtime environment, increasing its deployment flexibility and evasion capabilities. The malware is primarily distributed through file-sharing websites masquerading as legitimate game or VPN application installers, targeting users who download software from untrusted sources. The campaign employs advanced obfuscation and anti-analysis techniques, complicating detection by traditional antivirus and endpoint security solutions. Once installed, Stealit functions as a Remote Access Trojan (RAT), enabling attackers to remotely control the infected system. It specifically targets sensitive information, including login credentials and cryptocurrency wallets, facilitating financial theft and identity compromise. The campaign is notable for its adaptability, alternating between Node.js SEA and Electron frameworks to deliver payloads, which broadens its attack surface and complicates defensive measures. Although no known exploits are currently active in the wild, the campaign’s tactics, techniques, and procedures (TTPs) align with several MITRE ATT&CK techniques such as code obfuscation, credential dumping, and persistence mechanisms. The medium severity rating reflects the malware’s potential for significant information theft and system compromise, balanced against the lack of widespread exploitation and the requirement for user interaction to execute the disguised installers.

Detailed information about New Stealit Campaign Abuses Node.js Single Executable Application. Get real-time updates, technical details, and mitigation strategie

New Stealit Campaign Abuses Node.js Single Executable Application - Live Threat Intelligence - Threat Radar | OffSeq.com

New Stealit Campaign Abuses Node.js Single Executable Application

Threats Tagged 'single executable application'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'single executable application'

Lead Pen Test Professional