18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Cybersecurity researchers have uncovered a sophisticated software supply chain attack targeting users of Alibaba developer tools with a cross-platform remote access trojan…
Tag: malware
Cross-Platform RAT Targets Alibaba Developer Tools
A sophisticated cross-platform remote access trojan (RAT) was delivered via malicious npm packages impersonating Alibaba's private packages. The RAT is capable of…
Complex Backdoor with Lateral Movement Capabilities
The final-stage payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload/download, host reconnaissance, payload staging, and lateral movement…
Thorn C2: Previously Undocumented Malware Family
Thorn C2 is a previously undocumented malware family referenced in an open directory listing in Frankfurt. The listing exposed operator tooling, including…
Android TV Boxes: Target of Fuyao Malware
Cheap Android TV boxes, particularly models like H96_MAX_V11, are the primary devices affected by the Fuyao operation. They are shipped with malicious…
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories
ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories Ravie LakshmananJul 30, 2026Hacking News / Cybersecurity News…
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts Swati KhandelwalJul 30, 2026Vulnerability / Web Security South Korean authorities…
CageyChameleon: North Korean Cyber Group
CageyChameleon is a North Korean cyber group associated with cryptocurrency theft and malware campaigns, overlapping with Sapphire Sleet.
Aikido: Security Platform for Developers
Aikido is a security platform that reported at least 868 packages affected by the npm worm and linked the campaign to the…
typo-crypto npm Package
typo-crypto is a malicious npm package designed to impersonate crypto-js, first published in March 2025. It contained a trojanized file (core.js) and…