x.js: Deterministic Credential Generator Payload
x.js is an alternate payload in the BdThemes attack that generates deterministic administrative credentials based on the victim website's hostname, allowing attackers…
Tag: JavaScript
w2.js: Malicious JavaScript Payload in BdThemes Supply Chain Attack
w2.js is a JavaScript payload used in the BdThemes supply chain attack. It contacts a C2 server, creates rogue admin accounts, installs…
CryptoJS: JavaScript Cryptography Library
A widely used JavaScript library with a critical weak RNG flaw in versions below 4.0.0, affecting cryptocurrency wallet recovery phrase generation.
Adform Supply-Chain Attack Swaps Crypto Wallet Addresses via Poisoned JavaScript
Attackers compromised a JavaScript file served by advertising technology company Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses.…
core-js npm Package
core-js is a legitimate npm package for polyfilling JavaScript features. The malicious core.js file in typo-crypto was named to impersonate it.
Bun: JavaScript Runtime Used in Malware Payload
Bun is a JavaScript runtime that the worm's stage one downloads (version 1.3.13) to execute a compiled credential-stealing bundle.
Yarn: JavaScript Package Manager
Yarn is a package manager for JavaScript that provides deterministic dependency resolution. It has implemented cooldown controls to enhance supply chain security.
SpyPress: JavaScript Malware Used in Operation RoundPress
SpyPress is an obfuscated JavaScript-based malware used by TA458 in Operation RoundPress. It targets webmail platforms including Roundcube, Zimbra, Kerio, SOGo, and…
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security,…
jsDelivr: Free CDN for Open Source Projects
jsDelivr is a free content delivery network for open source projects. It was used by the G2 module to fetch remote JavaScript…