Author: Mark

The U.S. Department of Justice (DoJ) said it has filed a civil forfeiture complaint in federal court that targets over $7.74 million in cryptocurrency, non-fungible tokens (NFTs), and other digital assets allegedly linked to a global IT worker scheme orchestrated by North Korea.

“For years, North Korea has exploited global remote IT contracting and cryptocurrency ecosystems to evade U.S. sanctions and bankroll its weapons programs,” said Sue J. Bai, Head of the Justice Department’s National Security Division.

The Justice Department said the funds were originally restrained in connection with an April 2023 indictment against Sim Hyon-Sop, a North Korean Foreign Trade Bank (FTB) representative who is believed to have conspired with the IT workers.

The IT workers, the department added, gained employment at U.S. cryptocurrency companies using fake identities and then laundered their ill-gotten gains through Sim to further Pyongyang’s strategic objectives in violation of the sanctions imposed by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) and the United Nations.

The fraudulent scheme has evolved into a massive operation since its origins way back in 2017. The illegal employment operation leverages a combination of stolen and fictitious identities, aided with the help of artificial intelligence (AI) tools like OpenAI ChatGPT, to bypass due diligence checks and secure freelance jobs.

Tracked under the monikers Wagmole and UNC5267, the activity is assessed to be affiliated with the Workers’ Party of Korea and is viewed as a methodically engineered strategy to embed IT workers inside legitimate companies to draw a steady source of revenue for North Korea.

Besides misrepresenting identities and locations, a core aspect of the operation involves recruiting facilitators to run laptop farms across the world, enable video interview stages, as well as launder the proceeds back through various accounts.

One such laptop farm facilitator was Christina Marie Chapman, who pleaded guilty earlier this February for her involvement in the illicit revenue regeneration scheme. In a report published last month, The Wall Street Journal revealed how a LinkedIn message in March 2020 drew Chapman, a former waitress and massage therapist with over 100,000 followers on TikTok, into the intricate scam. She is scheduled to be sentenced on July 16.

“After laundering these funds, the North Korean IT workers allegedly sent them back to the North Korean government, at times via Sim and Kim Sang Man,” the DoJ said. “Kim is a North Korean national who is the chief executive officer of ‘Chinyong,’ also known as ‘Jinyong IT Cooperation Company.’”

An analysis of Sim’s cryptocurrency wallet by TRM Labs has revealed that it has received more than $24 million in cryptocurrency from August 2021 to March 2023.

North Korea Organizational assessment

“Most of these funds were traced back to Kim’s accounts, which were opened using forged Russian identity documents and accessed from Korean-language devices operating from the U.A.E. and Russia,” TRM Labs said. “Sim, a North Korean official, operated out of Dubai and maintained a self-hosted wallet that received laundered funds from dozens of sources.”

Kim, from his base in Vladivostok, Russia, acted as an intermediary between the IT workers and FTB, using two accounts to collect funds from them and re-distribute the proceeds to Sim and to other wallets connected to North Korea.

Cybersecurity company DTEX has characterized the IT worker threat as a state-sponsored crime syndicate that’s mainly geared towards sanctions evasion and generating profits, with the threat actors gradually shifting from laptop farms to using their own machines as part of companies’ Bring Your Own Device (BYOD) policies.

“Opportunity is really their only tactic and everything is treated as a tool of some sort,” Michael Barnhart, DTEX Principal i3 Insider Risk Investigator at DTEX Systems, told The Hacker News.

“If the focus is on laptop farms, which has been very good in getting that word out there, then naturally this opportunistic nation wants to gravitate to where the path is much easier if it is impacting operations. Until laptop farms are no longer effective at all, then that will still be an option, but abuse of BYOD was something that DTEX had seen in investigations and wasn’t publicized as much as the farms were.”

DTEX further pointed out that these IT workers could fall under either of the two categories: Revenue IT workers (R-ITW) or malicious IT workers (M-ITW), each of which has their own function within North Korea’s cyber structure.

While R-ITW personnel are said to be less privileged and primarily motivated to make money for the regime, M-ITW actors go beyond revenue generation by extorting a victim client, sabotaging a cryptocurrency server, stealing valuable intellectual property, or executing malicious code in an environment.

Chinyong, per the insider risk management firm, is one of the many IT companies that has deployed its workers in a combination of freelance IT work and cryptocurrency theft by leveraging their insider access to blockchain projects. It operates out of China, Laos, and Russia.

Two individuals associated with Chinyong-related IT worker efforts have been unmasked as having used the personas Naoki Murano and Jenson Collins to raise funds for North Korea, with Murano previously linked to a $6 million heist at crypto firm DeltaPrime in September 2024.

“Ultimately, the detection of DPRK-linked laptop farms and remote worker schemes requires defenders to look beyond traditional indicators of compromise and start asking different questions – about infrastructure, behavior, and access,” security researcher Matt Ryan said. “These campaigns aren’t just about malware or phishing; they’re about deception at scale, often executed in ways that blend seamlessly with legitimate remote work.”

Further investigation into the sprawling multi-million dollar fraud has uncovered several accounts tied to fake domains set up for the various front companies used to provide fake references to the IT workers. These accounts were infected with information-stealing malware, Flashpoint noted, enabling it to flag some aspects of their tradecraft.

The company said it identified a compromised host located in Lahore, Pakistan, that contained a saved credential for an email account that was used as a point of contact when registering the domains associated with Baby Box Info, Helix US, and Cubix Tech US.

On top of that, browser history captured by the stealer malware in another instance has captured Google Translate URLs related to dozens of translations between English and Korean, including those related to providing falsified job references and shipping electronic devices.

That’s not all. Recent research has also laid bare a “covert, multi-layered remote-control system” used by North Korean IT workers to establish persistent access to company-issued laptops in a laptop farm while being physically located in Asia.

“The operation leveraged a combination of low-level protocol signaling and legitimate collaboration tools to maintain remote access and enable data visibility and control using Zoom,” Sygnia said in a report published in April 2025. “The attack chain […] involved the abuse of ARP packets to trigger event-based actions, a custom WebSocket-based command-and-control (C2) channel, and automation of Zoom’s remote-control features.”

“To further enhance stealth and automation, specific Zoom client configurations were required. Settings were meticulously adjusted to prevent user-facing indicators and audio-visual disturbances. Users were persistently signed in, video and audio were automatically muted upon joining, participant names were hidden, screen sharing initiated without visible indicators, and preview windows disabled.”

Running complementary to Wagemole is another campaign referred to as Contagious Interview (aka DeceptiveDevelopment, Famous Chollima, Gwisin Gang, Tenacious Pungsan, UNC5342, and Void Dokkaebi) which primarily conducts malicious activity targeting developers to gain unauthorized company access as opposed to gaining employment.

“Gwisin Gang frankly are IT workers that instead of taking the long process of applying for a job, they target someone who already had the job,” Barnhart said. “They do appear elevated and unique in that they have malware usage that echoes this notion as well. IT workers is an overarching term though and there are many styles, varieties, and skill levels amongst them.”

As for how the IT worker scheme could evolve in the coming years, Barnhart points to the traditional financial sector as the target.

“With the implementation of blockchain and Web3 technologies into traditional financial institutions, I think all the DPRK cyber assets in that space are going to be aiming to have a run on these companies the way it was happening in years past,” Barnhart pointed out. “The more we integrate with those technologies, the more careful we have to be as DPRK is very entrenched.”

Cybersecurity researchers from SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads.

The packages in question are listed below –

• eslint-config-airbnb-compat (676 Downloads)
• ts-runtime-compat-check (1,588 Downloads)
• solders (983 Downloads)
• @mediawave/lib (386 Downloads)

All the identified npm packages have since been taken down from npm, but not before they were downloaded hundreds of times from the package registry.

SafeDep’s analysis of eslint-config-airbnb-compat found that the JavaScript library has ts-runtime-compat-check listed as a dependency, which, in turn, contacts an external server defined in the former package (“proxy.eslint-proxy[.]site”) to retrieve and execute a Base64-encoded string. The exact nature of the payload is unknown.

“It implements a multi-stage remote code execution attack using a transitive dependency to hide the malicious code,” SafeDep researcher Kunal Singh said.

Solders, on the other hand, has been found to incorporate a post-install script in its package.json, causing the malicious code to be automatically executed as soon as the package is installed.

“At first glance, it’s hard to believe that this is actually valid JavaScript,” the Veracode Threat Research team said. “It looks like a seemingly random collection of Japanese symbols. It turns out that this particular obfuscation scheme uses the Unicode characters as variable names and a sophisticated chain of dynamic code generation to work.”

This second-stage PowerShell script, also obscured, is designed to fetch a Windows batch script from another domain (“cdn.audiowave[.]org”) and configures a Windows Defender Antivirus exclusion list to avoid detection. The batch script then paves the way for the execution of a .NET DLL that reaches out to a PNG image hosted on ImgBB (“i.ibb[.]co”).

“[The DLL] is grabbing the last two pixels from this image and then looping through some data contained elsewhere in it,” Veracode said. “It ultimately builds up in memory YET ANOTHER .NET DLL.”

Furthermore, the DLL is equipped to create task scheduler entries and features the ability to bypass user account control (UAC) using a combination of FodHelper.exe and programmatic identifiers (ProgIDs) to evade defenses and avoid triggering any security alerts to the user.

The newly-downloaded DLL is Pulsar RAT, a “free, open-source Remote Administration Tool for Windows” and a variant of the Quasar RAT malware.

“From a wall of Japanese characters to a RAT hidden within the pixels of a PNG file, the attacker went to extraordinary lengths to conceal their payload, nesting it a dozen layers deep to evade detection,” Veracode said. “While the attacker’s ultimate objective for deploying the Pulsar RAT remains unclear, the sheer complexity of this delivery mechanism is a powerful indicator of malicious intent.”

Crypto Malware in the Open-Source Supply Chain

The findings also coincide with a report from Socket that identified credential stealers, cryptocurrency drainers, cryptojackers, and clippers as the main types of threats targeting the cryptocurrency and blockchain development ecosystem.

Some of the examples of these packages include –

• express-dompurify and pumptoolforvolumeandcomment, which are capable of harvesting browser credentials and cryptocurrency wallet keys
• bs58js, which drains a victim’s wallet and uses multi-hop transfers to obscure theft and frustrate forensic tracing.
• lsjglsjdv, asyncaiosignal, and raydium-sdk-liquidity-init, which functions as a clipper to monitor the system clipboard for cryptocurrency wallet strings and replace them with threat actor‑controlled addresses to reroute transactions to the attackers

“As Web3 development converges with mainstream software engineering, the attack surface for blockchain-focused projects is expanding in both scale and complexity,” Socket security researcher Kirill Boychenko said.

“Financially motivated threat actors and state-sponsored groups are rapidly evolving their tactics to exploit systemic weaknesses in the software supply chain. These campaigns are iterative, persistent, and increasingly tailored to high-value targets.”

AI and Slopsquatting

The rise of artificial intelligence (AI)-assisted coding, also called vibe coding, has unleashed another novel threat in the form of slopsquatting, where large language models (LLMs) can hallucinate non-existent but plausible package names that bad actors can weaponize to conduct supply chain attacks.

Trend Micro, in a report last week, said it observed an unnamed advanced agent “confidently” cooking up a phantom Python package named starlette-reverse-proxy, only for the build process to crash with the error “module not found.” However, should an adversary upload a package with the same name on the repository, it can have serious security consequences.

Furthermore, the cybersecurity company noted that advanced coding agents and workflows such as Claude Code CLI, OpenAI Codex CLI, and Cursor AI with Model Context Protocol (MCP)-backed validation can help reduce, but not completely eliminate, the risk of slopsquatting.

“When agents hallucinate dependencies or install unverified packages, they create an opportunity for slopsquatting attacks, in which malicious actors pre-register those same hallucinated names on public registries,” security researcher Sean Park said.

“While reasoning-enhanced agents can reduce the rate of phantom suggestions by approximately half, they do not eliminate them entirely. Even the vibe-coding workflow augmented with live MCP validations achieves the lowest rates of slip-through, but still misses edge cases.”

chimera-sandbox-extensions Published as a Red Teaming Exercise

Lastly, a new package discovered on the Python Package Index (PyPI) repository with capabilities to capture sensitive developer-related information, such as credentials, configuration data, and environment variables, has been identified as a red teaming effort.

The package, named chimera-sandbox-extensions, attracted 143 downloads and likely targeted users of a service called Chimera Sandbox, which was released by Singaporean tech company Grab last August to facilitate “experimentation and development of [machine learning] solutions.”

The package masquerades as a helper module for Chimera Sandbox, but “aims to steal credentials and other sensitive information such as Jamf configuration, CI/CD environment variables, AWS tokens, and more,” JFrog security researcher Guy Korolevski said in a report published last week.

Once installed, it attempts to connect to an external domain whose domain name is generated using a domain generation algorithm (DGA) in order to download and execute a next-stage payload.

Specifically, the malware acquires from the domain an authentication token, which is then used to send a request to the same domain and retrieve the Python-based information stealer.

The stealer is equipped to siphon a wide range of data from infected machines. This includes –

• JAMF receipts, which are records of software packages installed by Jamf Pro on managed computers
• Pod sandbox environment authentication tokens and git information
• CI/CD information from environment variables
• Zscaler host configuration
• Amazon Web Services account information and tokens
• Public IP address
• General platform, user, and host information

The kind of data gathered by the malware shows that it’s mainly geared towards corporate and cloud infrastructure. In addition, the extraction of JAMF receipts indicates that it’s also capable of targeting Apple macOS systems.

The collected information is sent via a POST request back to the same domain, after which the server assesses if the machine is a worthy target for further exploitation. However, JFrog said it was unable to obtain the payload at the time of analysis.

“The targeted approach employed by this malware, along with the complexity of its multi-stage targeted payload, distinguishes it from the more generic open-source malware threats we have encountered thus far, highlighting the advancements that malicious packages have made recently,” Jonathan Sar Shalom, director of threat research at JFrog Security Research team, said.

“This new sophistication of malware underscores why development teams remain vigilant with updates – alongside proactive security research – to defend against emerging threats and maintain software integrity.”

In a statement shared with The Hacker News, Grab said that the package chimera-sandbox-extensions was published to PyPI as part of a red teaming exercise conducted by its cybersecurity team.

“The PyPI package […] was not created with malicious intent and Grab was not targeted by unknown threat actors,” Vincent Wong, head of cyber defense at Grab, told the publication. “The purpose of this simulation was to test and improve our own internal security detection and response capabilities.”

Stating that the activity was “planned, authorized, and controlled,” Wong said “the package itself was not set up to steal credentials or tokens and would not have executed on any non-Grab systems. We understand that from an external perspective, this activity could be misinterpreted as a genuine threat.”

(The story was updated after publication to include a response from Grab.)

Jun 16, 2025Ravie LakshmananMalware / Ransomware

An emerging ransomware strain has been discovered incorporating capabilities to encrypt files as well as permanently erase them, a development that has been described as a “rare dual-threat.”

“The ransomware features a ‘wipe mode,’ which permanently erases files, rendering recovery impossible even if the ransom is paid,” Trend Micro researchers Maristel Policarpio, Sarah Pearl Camiling, and Sophia Nilette Robles said in a report published last week.

The ransomware-as-a-service (RaaS) operation in question is named Anubis, which became active in December 2024, claiming victims across healthcare, hospitality, and construction sectors in Australia, Canada, Peru, and the U.S. Analysis of early, trial samples of the ransomware suggests that the developers initially named it Sphinx, before tweaking the brand name in the final version.

It’s worth noting that the e-crime crew has no ties to an Android banking trojan and a Python-based backdoor of the same name, the latter of which is attributed to the financially-motivated FIN7 (aka GrayAlpha) group.

“Anubis runs a flexible affiliate program, offering negotiable revenue splits and supporting additional monetization paths like data extortion and access sales,” the cybersecurity company said.

The affiliate program follows an 80-20 split, allowing affiliate actors to take 80% of the ransom paid. On the other hand, data extortion and access monetization schemes offer a 60-40 and 50-50 split, respectively.

Attack chains mounted by Anubis involve the use of phishing emails as the initial access vector, with the threat actors leveraging the foothold to escalate privileges, conduct reconnaissance, and take steps to delete volume shadow copies, before encrypting files and, if necessary, wipe their contents.

This means that the file sizes are reduced to 0 KB while leaving the file names or their extensions untouched, making recovery impossible and, therefore, exerting more pressure on victims to pay up.

“The ransomware includes a wiper feature using /WIPEMODE parameter, which can permanently delete the contents of a file, preventing any recovery attempt,” the researchers said.

“Its ability to both encrypt and permanently destroy data significantly raises the stakes for victims, amplifying the pressure to comply — just as strong ransomware operations aim to do.”

The discovery of Anubis’ destructive behavior comes as Recorded Future detailed new infrastructure associated with the FIN7 group that’s being used to impersonate legitimate software products and services as part of a campaign designed to deliver NetSupport RAT.

The Mastercard-owned threat intelligence firm said it identified three unique distribution vectors over the past year that have employed bogus browser update pages, fake 7-Zip download sites, and TAG-124 (aka 404 TDS, Chaya_002, Kongtuke, and LandUpdate808) to deliver the malware.

While the fake browser update method loads a custom loader dubbed MaskBat to execute the remote access trojan, the remaining two infection vectors employ another custom PowerShell loader dubbed PowerNet that decompresses and executes it.

“[MaskBat] has similarities to FakeBat but is obfuscated and contains strings linked to GrayAlpha,” Recorded Future’s Insikt Group said. “Although all three infection vectors were observed being used simultaneously, only the fake 7-Zip download pages were still active at the time of writing, with newly registered domains appearing as recently as April 2025.”

Introduction

The cybersecurity landscape is evolving rapidly, and so are the cyber needs of organizations worldwide. While businesses face mounting pressure from regulators, insurers, and rising threats, many still treat cybersecurity as an afterthought. As a result, providers may struggle to move beyond tactical services like one-off assessments or compliance checklists, and demonstrate long-term security value.

To stay competitive and drive lasting impact, leading service providers are repositioning cybersecurity as a strategic business enabler, and transitioning from reactive, risk-based services to ongoing cybersecurity management aligned with business goals.

For service providers, this shift opens a clear opportunity to move beyond tactical projects and become long-term security partners, while unlocking new streams of recurring revenue.

Many MSPs, MSSPs, and consultancies already provide valuable point solutions, from identifying vulnerabilities to supporting audits and meeting compliance needs. These one-off services often serve as a strong foundation and can be expanded into broader, recurring offerings.

That’s why we created the playbook: Transforming Your Cybersecurity Practice Into an MRR Machine. This playbook will guide you how to build on the services you already provide and expand them into a scalable, recurring, and strategic offering, one that delivers deeper client value and more predictable, high-margin revenue for your business.

What End-to-End Cybersecurity Programs Include

Cybersecurity services vary widely, but short-term fixes like patching or assessments often leave clients vulnerable to evolving threats. End-to-end programs offer a better path: continuous oversight, proactive risk management, and ongoing compliance support. They turn cybersecurity into a strategic business function, not just a technical task.

For clients, this means stronger resilience. For providers, it means predictable revenue and a deeper, more strategic role. These programs require closer collaboration with leadership, elevating the provider from a project vendor to a trusted advisor.

Strategic providers typically offer services like:

• Risk assessment and ongoing risk management
• Long-term cybersecurity roadmaps aligned to business goals
• Continuous compliance management
• Business continuity and disaster recovery (BC/DR) planning
• Security awareness and training programs
• Incident response planning and testing
• Third-party risk management

Just as important, they also need to communicate effectively with executive leadership, translating security insights into business terms and providing reporting that supports strategic decision-making.

Service Tiers: Structuring Your Offering

One of the most impactful and lucrative services a provider can offer is Fractional CISO or Virtual CISO (vCISO) services, but delivering it effectively goes beyond technical expertise. It requires strategic leadership, business fluency, and a repeatable delivery model. That’s why many successful providers structure their services into clear tiers that align with client needs and maturity levels. This approach not only simplifies packaging and pricing but also makes it easier for clients to understand the value and grow into more advanced offerings over time.

A typical tiered model starts with Governance, Risk & Advisory services, which are ideal for smaller, non-regulated organizations. This includes core offerings like risk assessments, cybersecurity roadmaps, and foundational policy development.

The next tier, Governance, Risk, Advisory & Compliance, is built for mid-sized, regulated organizations that need support aligning with frameworks like CMMC, ISO, or HIPAA. In addition to foundational services, this level includes compliance management and ongoing framework alignment.

At the top is the Fractional CISO tier, suited for larger or highly regulated organizations. These engagements require deeper involvement, more rigorous reporting, and closer integration with business leadership, positioning the provider as a true strategic advisor.

To help providers confidently scale into these higher-value tiers, Cynomi offers free online vCISO Academy Courses. The courses cover essential frameworks, client management strategies, and proven methods for delivering high-impact, recurring security services.

What’s Holding You Back? Common Barriers and How to Overcome Them

Many providers hesitate to expand into strategic services because the path forward seems overwhelming. Some worry they lack the expertise to act as a virtual CISO. Others fear that serving more than a few clients will stretch their teams too thin. Still others feel lost trying to navigate compliance frameworks or define service packages.

The truth? You don’t need to make a massive leap, most providers are already closer than they think. If you’re doing risk assessments or helping clients prepare for audits, you’re halfway there. What’s needed is a structured, phased approach.

Read the full playbook to learn how to build on what you’re already doing, introduce strategic value in phases, and unlock long-term growth through standardization, automation, and smart service design.

Automation and Standardization: The Secret to Scale

Strategic services demand consistency, speed, and repeatability. That’s where automation comes in. Platforms like Cynomi enable providers to:

• Standardize workflows and client engagement
• Cut assessment times
• Continuously monitor risk and compliance
• Generate audit-ready reports automatically
• Operate with leaner teams

Real-World Example: Burwood Group: Burwood, a technology consulting firm, expanded its business by evolving from offering smaller cybersecurity engagements to delivering ongoing strategic offerings and vCISO services that provide greater scale and recurring revenue. By standardizing delivery with Cynomi and clearly demonstrating the value of ongoing support, they boosted upsells by 50%. Read the full case study in the Playbook.

Final Thoughts

The shift from reactive to strategic cybersecurity is becoming a key differentiator for service providers. Whether you’re already delivering risk assessments or just starting to think about scaling your business, Cynomi’s playbook offers actionable guidance to build a scalable, future-proof security practice.

Some of the biggest security problems start quietly. No alerts. No warnings. Just small actions that seem normal but aren’t. Attackers now know how to stay hidden by blending in, and that makes it hard to tell when something’s wrong.

This week’s stories aren’t just about what was attacked—but how easily it happened. If we’re only looking for the obvious signs, what are we missing right in front of us?

Here’s a look at the tactics and mistakes that show how much can go unnoticed.

⚡ Threat of the Week

Apple Zero-Click Flaw in Messages Exploited to Deliver Paragon Spyware — Apple disclosed that a security flaw in its Messages app was actively exploited in the wild to target civil society members in sophisticated cyber attacks. The vulnerability, CVE-2025-43200, was addressed by the company in February as part of iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1. The Citizen Lab said it uncovered forensic evidence that the flaw was weaponized to target Italian journalist Ciro Pellegrino and an unnamed prominent European journalist and infect them with Paragon’s Graphite mercenary spyware.

• Microsoft Fixes WebDAV 0-Day Exploited in Targeted Attacks — Microsoft addressed a zero-day bug in Web Distributed Authoring and Versioning (WebDAV) that was exploited by a threat actor known as Stealth Falcon (aka FruityArmor) as part of highly targeted attacks to deliver Horus Agent, a custom implant built for the Mythic command-and-control (C2) framework. Horus Agent is believed to be an evolution of the customized Apollo implant, an open-source .NET agent for Mythic framework, that was previously put to use by Stealth Falcon between 2022 and 2023. “The new Horus Agent appears to be written from scratch,” according to Check Point. “In addition to adding custom commands, the threat actors placed additional emphasis on the agent’s and its loader’s anti-analysis protections and counter-defensive measures. This suggests that they have deep knowledge of both their victims and/or the security solutions in use.”
• TokenBreak Attack Bypasses AI Moderation With a Single Character Change — Cybersecurity researchers disclosed an attack technique called TokenBreak that can be used to bypass a large language model’s (LLM) safety and content moderation guardrails with just a single character change. “The TokenBreak attack targets a text classification model’s tokenization strategy to induce false negatives, leaving end targets vulnerable to attacks that the implemented protection model was put in place to prevent,” HiddenLayer said.
• Google Addresses Flaw Leaking Phone Numbers Linked to Accounts — Google has fixed a security flaw that could have made it possible to brute-force an account’s recovery phone number by taking advantage of a legacy username recovery form and combining it with an exposure path Looker Studio that serves as an unintended oracle by leaking a user’s full name. Google has since deprecated the username recovery form.
• Rare Werewolf and DarkGaboon Leverage Readymade Tooling to Target Russia — Two threat actors tracked as Rare Werewolf and DarkGaboon have been observed employing legitimate tools, living-off-the-land (LotL) tactics, and off-the-shelf malware to target Russian entities. While adversaries are known to adopt such tactics, the complete abstinence of bespoke malware speaks to the effectiveness of the approach in helping them evade detection triggers and endpoint detection systems. Because these techniques are also commonly used by administrators, distinguishing between malicious and benign activity becomes significantly more challenging for defenders.
• Zero-Click AI Flaw Allows Data Exfiltration Without User Interaction — The first known zero-click artificial intelligence vulnerability in Microsoft 365 could have allowed attackers to exfiltrate sensitive internal data without any user interaction. The flaw, dubbed EchoLeak, involved what’s described as an LLM Scope Violation, referring to scenarios where a large language model (LLM) can be manipulated into leaking information beyond its intended context. In this case, an attacker can craft a malicious email containing specific markdown syntax that could slip past Microsoft’s Cross-Prompt Injection Attack (XPIA) defenses, causing the AI assistant to process the malicious payload and exfiltrate data using Microsoft’s own trusted domains, including SharePoint and Teams, which are allowlisted under Copilot’s content security policies. These domains can be used to embed external links or images that, when rendered by Copilot, automatically issue outbound requests to redirect stolen data to an attacker-controlled server. The most important aspect of this attack is that it all happens behind the scenes and users don’t even have to open the email message or click on any link. All it requires is for a victim to ask Microsoft 365 Copilot a business-related question that triggers the whole attack chain automatically. Microsoft, which is tracking the issue as CVE-2025-32711, has resolved it and emphasized it found no evidence of the vulnerability being exploited in the wild.
• VexTrio Runs a Massive Affiliate Program to Propagate Malware, Scams — The threat actors behind the VexTrio Viper Traffic Distribution Service (TDS) have been linked to a far-reaching campaign that hijacks WordPress sites to funnel victims into malware and scam networks. The malicious operation is designed to monetize compromised infrastructure, transforming legitimate websites into unwitting participants in a massive criminal advertising ecosystem. The scale of VexTrio’s activities came to light in November 2024 when Qurium revealed that Los Pollos, a Swiss-Czech adtech company, was part of the illicit TDS scheme. A new analysis from Infoblox has found that Los Pollos is one of the many companies controlled by VexTrio, including Taco Loco and Adtrafico, each overseeing different functions within the commercial affiliate network. These companies are in charge of recruiting publishing affiliates, who compromise websites with JavaScript injects, and advertising affiliates, who are the operators behind scams, malware, and other forms of fraud, turning VexTrio into an Uber-like intermediary for a criminal model that has generated substantial profits for the enterprise. Furthermore, when Los Pollos announced the cessation of their push monetization services in November 2024, many of these malware operations simultaneously migrated to TDSs called Help TDS and Disposable TDS, which are one and the same, and enjoyed an “exclusive relationship with VexTrio” until around the same time.

‎️‍🔥 Trending CVEs

Attackers love software vulnerabilities – they’re easy doors into your systems. Every week brings fresh flaws, and waiting too long to patch can turn a minor oversight into a major breach. Below are this week’s critical vulnerabilities you need to know about. Take a look, update your software promptly, and keep attackers locked out.

This week’s list includes — CVE-2025-43200 (Apple), CVE-2025-32711 (Microsoft 365 Copilot), CVE-2025-33053 (Microsoft Windows), CVE-2025-47110 (Adobe Commerce and Magento Open Source), CVE-2025-43697, CVE-2025-43698, CVE-2025-43699, CVE-2025-43700, CVE-2025-43701 (Salesforce), CVE-2025-24016 (Wazuh), CVE-2025-5484, CVE-2025-5485 (SinoTrack), CVE-2025-31022 (PayU CommercePro plugin), CVE-2025-3835 (ManageEngine Exchange Reporter Plus), CVE-2025-42989 (SAP NetWeaver), CVE-2025-5353, CVE-2025-22463, CVE-2025-22455 (Ivanti Workspace Control), CVE-2025-5958 (Google Chrome), CVE-2025-3052 (DT Research DTBios and BiosFlashShell), CVE-2025-2884 (TCG TPM2.0 reference implementation), CVE-2025-26521 (Apache CloudStack), CVE-2025-47950 (CoreDNS), CVE-2025-4230, CVE-2025-4232 (Palo Alto Networks PAN-OS), CVE-2025-4278, CVE-2025-2254, CVE-2025-5121, CVE-2025-0673 (GitLab), CVE-2025-47934 (OpenPGP.js), CVE-2025-49219, CVE-2025-49220 (Trend Micro Apex Central), CVE-2025-49212, CVE-2025-49213, CVE-2025-49216, CVE-2025-49217 (Trend Micro Endpoint Encryption PolicyServer), CVE-2025-4922 (HashiCorp Nomad), CVE-2025-36631, CVE-2025-36632, CVE-2025-36633 (Tenable Agent), CVE-2025-33108 (IBM Backup, Recovery, and Media Services), CVE-2025-6029 (KIA-branded Aftermarket Generic Smart Keyless Entry System), and a patch bypass for CVE-2024-41713 (Mitel MiCollab).

📰 Around the Cyber World

• Kazakh and Singapore Authorities Disrupt Criminal Networks — Kazakh authorities said they dismantled a network that was using Telegram to illegally sell citizens’ personal data extracted from government databases. More than 140 suspects were arrested in connection with the scheme, including business owners and alleged administrators of Telegram channels used to peddle the stolen information, according to officials. If convicted, the suspects could face up to five years in prison and a fine. The development came as the Singapore Police Force (SPF), in partnership with authorities from Hong Kong, Macao, Malaysia, Maldives, South Korea, and Thailand, announced the arrests of 1,800 subjects between April 28 and May 28 for their involvement in various online scams. The cross-border anti-scam initiative has been codenamed Operation FRONTIER+. “The subjects, aged between 14 and 81, are believed to be involved in more than 9,200 scam cases, comprising mainly government official impersonation scams, investment scams, rental scams, internet love scams, friend impersonation scams, job scams, and e-commerce scams, where victims reportedly lost over S$289 million (approximately USD225 million),” the SPF said. “More than 32,600 bank accounts suspected to be linked to scams were detected and frozen by the participating law enforcement agencies, with more than S$26.2 million (approximately USD20 million) seized in these bank accounts.” Singapore officials said they arrested 106 people locally who were responsible for 1,300 scams that netted them about $30 million.
• Microsoft to Block .library-ms and .search-ms File Types in Outlook — Microsoft announced it will expand the list of blocked attachments in Outlook Web and the new Outlook for Windows starting next month, to include .library-ms and .search-ms file types. Both file types have been repeatedly exploited by bad actors in phishing and malware attacks. “The newly blocked file types are rarely used, so most organizations will not be affected by the change. However, if your users are sending and receiving affected attachments, they will report that they are no longer able to open or download them in Outlook Web or the New Outlook for Windows,” Microsoft said.
• Meta and Yandex Caught Using Tracking Code to Leak Unique Identifiers to Installed Native Apps on Android — Meta and Yandex misused Android’s localhost ports to stealthily pass tracking data from mobile browsers into native apps like Facebook, Instagram, and Yandex services. This behavior allowed them to bypass browser sandboxing and Android’s permission system, likely making it possible to attach persistent identifiers to detailed browsing histories. The tracking worked even in private browsing modes across major browsers like Chrome and Firefox. Put differently, the loophole lets the apps detect any websites that Android device users visit and integrate the tracking scripts, and gather web cookie data via the device’s loopback interface. It takes advantage of the fact that the Android operating system allows any installed app with the INTERNET permission to open a listening socket on localhost (127.0.0.1) and browsers running on the same device can also access this interface without user consent or platform mediation. This opens the door to a scenario where JavaScript embedded on web pages can communicate with native Android apps and share identifiers and browsing habits over standard Web APIs. Evidence of Meta using the technique first emerged in September 2024, but Yandex is said to have adopted the technique in February 2017. Meta Pixel is embedded on over 6 million websites, while Yandex Metrica is present on close to 3 million websites. “These native Android apps receive browsers’ metadata, cookies, and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of websites,” a group of academics from IMDEA Networks, Radboud University, and KU Leuven said. “These JavaScripts load on users’ mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programmatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users’ visiting sites embedding their scripts.” As of June 3, 2025, the Meta/Facebook Pixel script is no longer sending any packets or requests to localhost, and the code responsible for sending _fbp cookie has been removed. Yandex claimed the feature in question did not collect any sensitive information and was solely meant to improve personalization. However, it has discontinued its use, citing privacy concerns. Google and Mozilla have released countermeasures to plug the eavesdropping scheme.
• Replay Attacks as a Way to Bypass Deepfake Detection — New research has found that replay attacks are an effective method to bypass deepfake detection. “By playing and re-recording deepfake audio through various speakers and microphones, we make spoofed samples appear authentic to the detection model,” a team of researchers said. The development heralds new cyber risks as voice cloning technology has become a major driver of vishing attacks, allowing attackers to use artificial intelligence (AI) tools to generate synthetic audio that impersonate executives or IT personnel in an effort to gain privileged access to corporate systems.
• Linux Malware Families Receive Steady Code Updates — A new analysis of known Linux malware such as NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidRain has found that “they had at least two significant code updates within the last year, meaning threat actors are actively updating and supporting them,” Palo Alto Networks unit 42 said. “Additionally, each of the malware strains accounted for at least 20 unique sightings of samples in the wild over the last year. This means that threat actors are actively using them.” The activities indicate that these malware families are highly likely to be used in future attacks aimed at cloud environments.
• Microsoft Defender Flaw Disclosed — Cybersecurity researchers have detailed a now-patched security flaw in Microsoft Defender for Identity that allows an unauthorized attacker to perform spoofing over an adjacent network by taking advantage of an improper authentication bug. The vulnerability, tracked as CVE-2025-26685 (CVSS score: 6.5), was patched by Microsoft in May 2025. NetSPI, which discovered and reported the flaw, said the issue “abused the Lateral Movement Paths (LMPs) feature and allowed an unauthenticated attacker on the local network to coerce and capture the Net-NTLM hash of the associated Directory Service Account (DSA), under specific conditions.” Once the Net-NTLM hash is captured, it can be taken offline for password cracking using tools like Hashcat or exploited in conjunction with other vulnerabilities to elevate privileges to the DSA account and obtain a foothold in the Active Directory environment.
• Apple Updates Passwords App with New Features — Apple has previewed new features in its Passwords app with iOS 26 and macOS 26 Tahoe that allow users to view the complete version history for stored logins, including the timestamps when a particular password was saved or changed. Another useful addition is the ability to import and export passkeys between participating credential manager apps across iOS, iPadOS, macOS, and visionOS 26. “This user-initiated process, secured by local authentication like Face ID, reduces the risk of credential leaks,” Apple said. “The transfer uses a standardized data schema developed by the FIDO Alliance, ensuring compatibility between apps.” A similar feature is already in the works for Google Password Manager. Last October, the FIDO Alliance unveiled the Credential Exchange Protocol (CXP) and Credential Exchange Format (CXF) to facilitate interoperability.
• CyberEYE RAT Exposed — Cybersecurity researchers have shed light on the inner workings of CyberEYE RAT (aka TelegramRAT, a modular, .NET-based trojan that provides surveillance and data theft capabilities. Its various modules harvest browser history and passwords, Wi-Fi passwords, gaming profiles, files matching configured extensions, FileZilla FPT credentials, and session data from applications like Telegram and Discord. “Its use of Telegram for Command and Control (C2) eliminates the need for attackers to maintain their own infrastructure, making it more evasive and accessible,” CYFIRMA said. “The malware is deployed through a builder GUI that allows attackers to customize payloads by injecting credentials, modifying metadata, and bundling features such as keyloggers, file grabbers, clipboard hijackers, and persistence mechanisms.” The malware also acts as a clipper to redirect cryptocurrency transactions and employs defense evasion techniques by disabling Windows Defender through PowerShell and registry manipulations.
• WhatsApp Joins Apple’s Encryption Fight With U.K. — Meta-owned WhatsApp said it’s backing Apple in its legal fight against the U.K. Home Office’s demands for backdoor access to encrypted iCloud data worldwide under the Investigatory Powers Act. The move, the company told BBC, “could set a dangerous precedent” by “emboldening” other nations to put forth similar requests to break encryption. In response to the government notice, Apple pulled the Advanced Data Protection (ADP) feature for iCloud from U.K. users’ devices and took legal action to appeal to the Investigatory Powers Tribunal to overturn the secret Technical Capability Notice (TCN) issued by the Home Office. In April 2025, the tribunal ruled the details of the legal row cannot be kept secret. The existence of the TCN was first reported by The Washington Post in January. Governments across the U.S., U.K., and the European Union (E.U.) have sought to push back against end-to-end encryption, arguing it enables criminals, terrorists, and sex offenders to conceal illicit activity. Europol, in its 2025 Internet Organised Crime Threat Assessment (IOCTA) released last week, said: “While encryption protects users’ privacy, the criminal abuse of end-to-end encrypted (E2EE) apps is increasingly hampering investigations. Cybercriminals hide behind anonymity while coordinating sales of stolen data, often with no visibility for investigators.”
• DanaBot C2 Server Suffers From DanaBleed — Last month, a coordinated law enforcement operation felled DanaBot, a Delphi malware that allowed its operators to remotely commandeer the infected machines, steal data, and deliver additional payloads like ransomware. According to Zscaler ThreatLabz, a bug introduced in its C2 server in June 2022 inadvertently caused it to “leak snippets of its process memory in responses to infected victims,” giving more visibility into the malware. The leaked information included threat actor usernames, threat actor IP addresses, backend C2 server IP addresses and domains, infection and exfiltration statistics, malware version updates, private cryptographic keys, victim IP addresses, victim credentials, and other exfiltrated victim data. The June 2022 update introduced a new C2 protocol to exchange command data and responses. “The memory leak allowed up to 1,792 bytes per C2 server response to be exposed,” Zscaler said. “The content of the leaked data was arbitrary and depended on the code being executed and the data being manipulated in the C2 server process at a given time.”
• Lures for OpenAI Sora and DeepSeek Lead to Malware — A bogus site impersonating DeepSeek (“deepseek-platform[.]com”) is distributing installers for a malware called BrowserVenom, a Windows implant that reconfigures Chromium- and Gecko-based browsing instances to force traffic through a proxy controlled by the threat actors by adding a hard-coded proxy server address. “This enables them to sniff sensitive data and monitor the victim’s browsing activity while decrypting their traffic,” Kaspersky said. The phishing sites are promoted in the search results via Google Ads when users search for “deepseek r1.” The installer is designed to run a PowerShell command that retrieves the malware from an external server. The attacks are characterized by the use of CAPTCHA challenges to ward off bots. To date, BrowserVenom has infected “multiple” computers across Brazil, Cuba, Mexico, India, Nepal, South Africa, and Egypt. The disclosure comes as phony installers for OpenAI Sora have been found to distribute a Windows information stealer dubbed SoraAI.lnk that’s hosted on GitHub. The GitHub account hosting the malware is no longer accessible.
• Cyber Partisans Targets Belarus and Russia — A Belarusian hacktivist group called Cyber Partisans has been observed targeting industrial enterprises and government agencies in Russia and Belarus with a backdoor known as Vasilek that uses Telegram for C2 and data exfiltration. The phishing attacks are notable for the deployment of another backdoor called DNSCat2 that enables attackers to remotely manage an infected system and a wiper referred to as Pryanik. “The first thing that draws attention is that the viper acts as a logic bomb: its functionality is activated on a certain date and time,” Kaspersky said. Other tools used as part of the attacks include Gost for proxying and tunneling network traffic, and Evlx for removing events from Windows event logs. In a statement to Recorded Future News, the collective stated that Kaspersky’s attention to its operations may have stemmed from the fact that the attacks relied on the company’s products and had failed to prevent intrusions. “Such attacks make Kaspersky’s technologies appear outdated, and perhaps this is why they are trying to justify themselves or counter us with these publications,” the group was quoted as saying.
• 2 ViLE Members Sentenced to Prison — The U.S. Department of Justice (DoJ) announced the sentencing of two members of the ViLE hacking group – Sagar Steven Singh, 21, and Nicholas Ceraolo, 27, – nearly a year after they pleaded guilty to aggravated identity theft and computer hacking crimes. Singh and Ceraolo have been sentenced to 27 and 25 months’ imprisonment respectively for conspiracy to commit computer intrusion and aggravated identity theft. “Singh and Ceraolo unlawfully used a law enforcement officer’s stolen password to access a nonpublic, password-protected web portal (the ‘Portal’) maintained by a U.S. federal law enforcement agency for the purpose of sharing intelligence with state and local law enforcement,” the DoJ said. “The defendants used their access to the Portal to extort their victims.” The sentencing came as five men pleaded guilty for their involvement in laundering more than $36.9 million from victims of an international digital asset investment scam conspiracy (aka romance baiting) that was carried out from scam centers in Cambodia. The defendants include Joseph Wong, 33, of Alhambra, California; Yicheng Zhang, 39, of China; Jose Somarriba, 55, of Los Angeles; Shengsheng He, 39, of La Puente, California; and Jingliang Su, 44, of China and Turkey. They are said to be “part of an international criminal network that induced U.S. victims, believing they were investing in digital assets, to transfer funds to accounts controlled by co-conspirators and that laundered victim money through U.S. shell companies, international bank accounts, and digital asset wallets.” So far, eight people have pleaded guilty to participating in the criminal scheme, counting Chinese nationals Daren Li and Yicheng Zhang.
• Kimsuky Targets Facebook, email, and Telegram Users in South Korea — The North Korean-affiliated threat actor known as Kimusky targeted Facebook, email, and Telegram users in its southern counterpart between March and April 2025 as part of a campaign codenamed Triple Combo. “The threat actor used an account named ‘Transitional Justice Mission’ to send friend requests and direct messages to multiple individuals involved in North Korea-related activities,” Genians said. “The attacker also hijacked another Facebook account for their operation.” Subsequently, the attackers attempted to approach the targets via email by using the email address obtained through Facebook Messenger conversations. Alternately, the Kimsuky actors leveraged the victims’ phone numbers to contact them again via Telegram. Regardless of the channel used, these trust-building exercises triggered a multi-stage infection sequence to deliver a known malware called AppleSeed.

🎥 Cybersecurity Webinars

• AI Agents Are Leaking Data — Learn How to Fix It Fast ➝ AI tools often connect to platforms like Google Drive and SharePoint—but without the right settings, they can accidentally expose sensitive data. In this webinar, experts from Sentra will show simple, real-world ways these leaks happen and how to stop them. If you’re using AI in your business, don’t miss this fast, clear guide to securing it before something goes wrong.
• They’re Faking Your Brand—Stop AI Impersonation Before It Spreads ➝ AI-driven attackers are mimicking brands, execs, and employees in real-time. Join this session to see how Doppel detects and blocks impersonation across email, social media, and deepfakes—before damage is done. Fast, adaptive protection for your reputation.

🔧 Cybersecurity Tools

• CRADLE ➝ It is an open-source web platform built for cyber threat intelligence (CTI) analysts. It simplifies threat investigation workflows by enabling teams to collaborate in real-time, map relationships between threat actors and indicators, and generate detailed intelligence reports. Designed with modular architecture, CRADLE is easy to extend and runs locally using Docker for quick setup and testing.
• Newtowner ➝ It is a security testing tool that helps identify weaknesses in network trust boundaries by simulating traffic from different global cloud providers and CI/CD environments. It allows you to detect misconfigurations—such as overly permissive access from specific data centers—by comparing HTTP responses from multiple sources like GitHub Actions, AWS, and EC2. This is especially useful in modern cloud setups where implicit trust between internal services can lead to serious security gaps.

Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards.

🔒 Tip of the Week

4 Hidden Ways You’re Tracked (and How to Fight Back) ➝ Most people know about cookies and ads, but companies now use sneaky technical tricks to track you—even if you’re using a VPN, private mode, or a hardened browser. One method gaining attention is localhost tracking: apps like Facebook and Instagram silently run a web server inside your phone. When you visit a website with a hidden code, it can ping this server to see if the app is installed—leaking your activity back to the app, without your permission.

Another trick is port probing. Some websites scan your device to check if developer tools or apps are running on certain ports (like 3000 or 9222). This reveals what software you use or whether you’re running a specific company’s tool—leaking clues about your job, device, or activity. Sites may even detect browser extensions this way.

On mobile, some websites silently test if apps like Twitter, PayPal, or your banking app are installed by triggering invisible deep links. If the app opens or responds, they learn what apps you use. That’s often used for profiling or targeted phishing. Also, browser cache abuse (using things like ETags or service workers) can fingerprint your browser—even across private tabs—keeping you identifiable even when you think you’re clean.

How to protect yourself:

• Uninstall apps you rarely use, especially ones from big platforms.
• Use browsers like Firefox with uBlock Origin and enable “Block outsider intrusion into LAN.”
• On mobile, use hardened browsers like Bromite or Firefox Focus, and block background data for apps using tools like NetGuard.
• Clear browser storage often, and use temporary containers or incognito containers to isolate sessions.

These aren’t tinfoil hat ideas—they’re real-world methods used by major tech firms and trackers today. Staying private means going beyond ad blockers and learning how the web really works behind the scenes.

Conclusion

What goes undetected often isn’t invisible—it’s just misclassified, minimized, or misunderstood. Human error isn’t always a technical failure. Sometimes it’s a story we tell ourselves about what shouldn’t happen.

Review your recent alerts. Which ones were ignored because they didn’t “feel right” for the threat profile? The cost of dismissal is rising—especially when adversaries bank on it.

Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that’s capable of harvesting sensitive developer-related information, such as credentials, configuration data, and environment variables, among others.

The package, named chimera-sandbox-extensions, attracted 143 downloads and likely targets users of a service called Chimera Sandbox, which was released by Singaporean tech company Grab last August to facilitate “experimentation and development of [machine learning] solutions.”

The package masquerades as a helper module for Chimera Sandbox, but “aims to steal credentials and other sensitive information such as Jamf configuration, CI/CD environment variables, AWS tokens, and more,” JFrog security researcher Guy Korolevski said in a report published last week.

Once installed, it attempts to connect to an external domain whose domain name is generated using a domain generation algorithm (DGA) in order to download and execute a next-stage payload.

Specifically, the malware acquires from the domain an authentication token, which is then used to send a request to the same domain and retrieve the Python-based information stealer.

The stealer malware is equipped to siphon a wide range of data from infected machines. This includes –

• JAMF receipts, which are records of software packages installed by Jamf Pro on managed computers
• Pod sandbox environment authentication tokens and git information
• CI/CD information from environment variables
• Zscaler host configuration
• Amazon Web Services account information and tokens
• Public IP address
• General platform, user, and host information

The kind of data gathered by the malware shows that it’s mainly geared towards corporate and cloud infrastructure. In addition, the extraction of JAMF receipts indicates that it’s also capable of targeting Apple macOS systems.

The collected information is sent via a POST request back to the same domain, after which the server assesses if the machine is a worthy target for further exploitation. However, JFrog said it was unable to obtain the payload at the time of analysis.

“The targeted approach employed by this malware, along with the complexity of its multi-stage targeted payload, distinguishes it from the more generic open-source malware threats we have encountered thus far, highlighting the advancements that malicious packages have made recently,” Jonathan Sar Shalom, director of threat research at JFrog Security Research team, said.

“This new sophistication of malware underscores why development teams remain vigilant with updates—alongside proactive security research – to defend against emerging threats and maintain software integrity.”

The disclosure comes as SafeDep and Veracode detailed a number of malware-laced npm packages that are designed to execute remote code and download additional payloads. The packages in question are listed below –

• eslint-config-airbnb-compat (676 Downloads)
• ts-runtime-compat-check (1,588 Downloads)
• solders (983 Downloads)
• @mediawave/lib (386 Downloads)

All the identified npm packages have since been taken down from npm, but not before they were downloaded hundreds of times from the package registry.

SafeDep’s analysis of eslint-config-airbnb-compat found that the JavaScript library has ts-runtime-compat-check listed as a dependency, which, in turn, contacts an external server defined in the former package (“proxy.eslint-proxy[.]site”) to retrieve and execute a Base64-encoded string. The exact nature of the payload is unknown.

“It implements a multi-stage remote code execution attack using a transitive dependency to hide the malicious code,” SafeDep researcher Kunal Singh said.

Solders, on the other hand, has been found to incorporate a post-install script in its package.json, causing the malicious code to be automatically executed as soon as the package is installed.

“At first glance, it’s hard to believe that this is actually valid JavaScript,” the Veracode Threat Research team said. “It looks like a seemingly random collection of Japanese symbols. It turns out that this particular obfuscation scheme uses the Unicode characters as variable names and a sophisticated chain of dynamic code generation to work.”

Decoding the script reveals an extra layer of obfuscation, unpacking which reveals its main function: Check if the compromised machine is Windows, and if so, run a PowerShell command to retrieve a next-stage payload from a remote server (“firewall[.]tel”).

This second-stage PowerShell script, also obscured, is designed to fetch a Windows batch script from another domain (“cdn.audiowave[.]org”) and configures a Windows Defender Antivirus exclusion list to avoid detection. The batch script then paves the way for the execution of a .NET DLL that reaches out to a PNG image hosted on ImgBB (“i.ibb[.]co”).

“[The DLL] is grabbing the last two pixels from this image and then looping through some data contained elsewhere in it,” Veracode said. “It ultimately builds up in memory YET ANOTHER .NET DLL.”

Furthermore, the DLL is equipped to create task scheduler entries and features the ability to bypass user account control (UAC) using a combination of FodHelper.exe and programmatic identifiers (ProgIDs) to evade defenses and avoid triggering any security alerts to the user.

The newly-downloaded DLL is Pulsar RAT, a “free, open-source Remote Administration Tool for Windows” and a variant of the Quasar RAT.

“From a wall of Japanese characters to a RAT hidden within the pixels of a PNG file, the attacker went to extraordinary lengths to conceal their payload, nesting it a dozen layers deep to evade detection,” Veracode said. “While the attacker’s ultimate objective for deploying the Pulsar RAT remains unclear, the sheer complexity of this delivery mechanism is a powerful indicator of malicious intent.”

Crypto Malware in the Open-Source Supply Chain

The findings also coincide with a report from Socket that identified credential stealers, cryptocurrency drainers, cryptojackers, and clippers as the main types of threats targeting the cryptocurrency and blockchain development ecosystem.

Some of the examples of these packages include –

• express-dompurify and pumptoolforvolumeandcomment, which are capable of harvesting browser credentials and cryptocurrency wallet keys
• bs58js, which drains a victim’s wallet and uses multi-hop transfers to obscure theft and frustrate forensic tracing.
• lsjglsjdv, asyncaiosignal, and raydium-sdk-liquidity-init, which functions as a clipper to monitor the system clipboard for cryptocurrency wallet strings and replace them with threat actor‑controlled addresses to reroute transactions to the attackers

“As Web3 development converges with mainstream software engineering, the attack surface for blockchain-focused projects is expanding in both scale and complexity,” Socket security researcher Kirill Boychenko said.

“Financially motivated threat actors and state-sponsored groups are rapidly evolving their tactics to exploit systemic weaknesses in the software supply chain. These campaigns are iterative, persistent, and increasingly tailored to high-value targets.”

AI and Slopsquatting

The rise of artificial intelligence (AI)-assisted coding, also called vibe coding, has unleashed another novel threat in the form of slopsquatting, where large language models (LLMs) can hallucinate non-existent but plausible package names that bad actors can weaponize to conduct supply chain attacks.

Trend Micro, in a report last week, said it observed an unnamed advanced agent “confidently” cooking up a phantom Python package named starlette-reverse-proxy, only for the build process to crash with the error “module not found.” However, should an adversary upload a package with the same name on the repository, it can have serious security consequences.

Furthermore, the cybersecurity company noted that advanced coding agents and workflows such as Claude Code CLI, OpenAI Codex CLI, and Cursor AI with Model Context Protocol (MCP)-backed validation can help reduce, but not completely eliminate, the risk of slopsquatting.

“When agents hallucinate dependencies or install unverified packages, they create an opportunity for slopsquatting attacks, in which malicious actors pre-register those same hallucinated names on public registries,” security researcher Sean Park said.

“While reasoning-enhanced agents can reduce the rate of phantom suggestions by approximately half, they do not eliminate them entirely. Even the vibe-coding workflow augmented with live MCP validations achieves the lowest rates of slip-through, but still misses edge cases.”