Cryptocurrency-Stealing Remote Access Trojan Deployed in Mastra Attack
A cross-platform information stealer deployed as the final payload in the Mastra supply chain attack. It harvests browser history, steals data from…
Tag: persistence
145 Mastra npm Packages Compromised in Supply Chain Attack, Crypto-Stealer Deployed
On June 17, 2026, a software supply chain attack codenamed 'easy-day-js' compromised 145 npm packages under the @mastra/* namespace, a popular open-source…
Junior Hacker Used Tailscale and OpenSSH to Maintain Persistent Access After C2 Outage
A French-speaking attacker, operating under the handle 'Poisson,' breached a small French automotive business using a keylogger to steal banking and email…
SimpleHelp: Remote Support Tool Used Alongside Evilginx
SimpleHelp is a remote support tool that was found running on the same server as the Evilginx proxy, used by the operator…
gs-netcat: Tool Used by AryStinger for Persistence on QNAP NAS
gs-netcat is a networking tool used by AryStinger for persistence on infected QNAP NAS devices, providing remote access and tunneling capabilities.
Visual Basic Script Used by SHEETCORD for Persistence
SHEETCORD uses a Visual Basic Script in the Windows Startup folder to establish persistence on infected systems.