Node.js Backdoor Used in DPRK Malvertising Campaign
A Node.js backdoor deployed via fake macOS updates, using LaunchAgent for persistence and Ethereum smart contracts for C2 communication. It polls the…
Tag: Node.js
clientCode: Node.js RAT Payload
clientCode is a heavily obfuscated Node.js remote access trojan (RAT) that uploads files, retrieves JavaScript, collects host details, and reads clipboard data,…
n8n Sandbox Escape Vulnerability Allows OS Command Execution via Workflow Editor
n8n has patched a high-severity expression-sandbox escape vulnerability that allows authenticated workflow editors to execute operating-system commands on the server running the…
20+ Hijacked Brazilian Government Websites Used as Malware Delivery Channels in PhantomEnigma Campaign
More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN,…
PhantomEnigma Backdoor: Modular Malware with Rotating C2 Infrastructure
PhantomEnigma is a modular backdoor built on Inno Setup and Node.js, hidden inside patched Electron applications like Boostnote. It collects system information,…
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security,…
wisp-server-node: Node.js Wisp Server Implementation
A Node.js implementation of the Wisp protocol server by Mercury Workshop. It was exploited in the campaign due to its lack of…
Weekly Cybersecurity Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
This week's cybersecurity landscape is marked by a series of critical threats and vulnerabilities. Progress has urged ShareFile customers to shut down…
SimpleHelp CVE-2026-48558 Exploited to Deploy TaskWeaver and Djinn Stealer Malware
An unknown threat actor is exploiting CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp (CVSS 10.0), to deliver two new malware families:…
TaskWeaver: Node.js Loader Used in SimpleHelp Exploitation
A heavily obfuscated Node.js loader delivered as jquery.js, executed via node.exe. It establishes encrypted communications with a remote server and retrieves additional…