Microsoft Warns of Photo ZIP Phishing Campaign Targeting Hotels with Node.js Implant
Microsoft has issued a warning about an active phishing campaign targeting hotels and hospitality organizations across Europe and Asia since April 2026.…
Tag: Node.js
TonRAT: Node.js Implant Used in Hotel Phishing Campaign
TonRAT is a Node.js-based implant used in a phishing campaign targeting hotels. It resolves C2 domains via the TON blockchain API and…
GitHub to Disable npm Install Scripts by Default to Combat Supply Chain Attacks
GitHub has announced significant security changes for npm version 12, set to release next month, aimed at mitigating software supply chain attacks.…
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
Cybersecurity researchers have identified multiple ClickFix campaigns deploying three new malware loaders: BabaDeda Loader, Lorem Ipsum Loader, and Potemkin. These campaigns use…
Malicious npm Packages Disguised as PostCSS Tools Deploy Windows RAT
Cybersecurity researchers at JFrog have uncovered a set of malicious npm packages that masquerade as legitimate PostCSS tools to deliver a Windows-based…
npm: Registry Affected by Supply Chain Campaigns
npm is the package registry for Node.js. It was affected by two supply chain campaigns: one typosquatting CLI binary names and another…
Node.js v24.13.0 Used as Implant Runtime
The phishing campaign downloads a legitimate Node.js v24.13.0 runtime from nodejs.org to execute the TonRAT implant in user space.