#malware

Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised

Vào ngày 24/6/2026, tin tặc đã phát tán phiên bản độc hại của 20 package npm thuộc hệ sinh thái Leo Platform chỉ trong vòng chưa đầy 3 giây, sử dụng toolkit 'Phantom Gyp' tương tự chiến dịch Miasma trước đó. Phần mềm độc hại đánh cắp bí mật từ GitHub Actions, kho lưu trữ đa đám mây (AWS, GCP, Azure), registry package, HashiCorp Vault, Kubernetes và trình quản lý mật khẩu, sau đó exfiltrate qua token GitHub của nạn nhân để tránh bị phát hiện. Nó còn hoạt động như một worm trong chuỗi cung ứng, tự động phát tán phiên bản độc hại các package mà nạn nhân có quyền publish bằng cách vượt qua xác thực 2FA.

Lập trình viên nên đọc bài này để hiểu cách một cuộc tấn công supply chain mới sử dụng các kỹ thuật phức tạp—như obfuscation và evasion Bun—để tránh phát hiện và khai thác quyền truy cập vào các hệ thống quan trọng từ các gói npm phổ biến, từ đó cảnh báo về rủi ro khi sử dụng các thư viện công cộng mà không kiểm tra nguồn gốc và bảo mật.

The Latest Addition to Turla’s Intelligence Gathering Apparatus

Google Threat Intelligence Group (GTIG) has published a detailed analysis of STOCKSTAY, a multi-component .NET backdoor attributed to the Russian state-linked threat actor Turla (FSB Center 16). Active since at least December 2022, STOCKSTAY targets Ukrainian government and military organizations as well as European entities with foreign affairs interests. The backdoor uses a modular architecture (STOCKBROKER for C2 tunneling, STOCKMARKET for orchestration, STOCKTRADER for execution) communicating over encrypted WebSockets. It masquerades as benign applications like stock market tools, PDF viewers, and calculators. STOCKSTAY shares significant code overlaps with Turla's established KAZUAR toolkit, including a shared string obfuscation mechanism called K1MORPHER based on the Squirrel3 PRNG. Deployment methods include malicious RDP files, HTA files, WinRAR CVE-2025-8088 exploitation, and GitHub-hosted MSI installers. The post includes a detailed operational timeline from 2022–2025, YARA detection rules, and indicators of compromise.

Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

A detailed technical analysis of a ClickFix attack chain observed in May 2026 that led to a full hands-on-keyboard intrusion across 11 hosts. The infection began with a user tricked into running a command via the Windows Run Dialog, which fetched and silently installed an MSI dropping 'Potemkin', a custom x64 loader using a Domain Generation Algorithm (DGA) with XorShift32 seeded at 151678 to find its C2. Potemkin reflectively loads 'RMMProject', a 4.4 MB Lua-scriptable DLL with 15 task types including browser credential theft (with a Chrome App-Bound Encryption bypass via DLL injection), hidden remote desktop control, process injection, and module loading. The attacker also deployed EtherRAT (a Node.js backdoor resolving C2 via Ethereum blockchain) and Cloudflare tunnels, then moved laterally via WMIExec and SMBExec to reach the domain controller. The post includes full DGA Python implementation, cipher decryption algorithm, C2 protocol details, and indicators of compromise.

Threat landscape for SMBs in 2026: fake AI tools, phishing and more

Kaspersky's 2026 SMB threat report reveals a nearly fivefold increase in cyberattacks disguising malware as popular AI tools like Claude compared to 2025. Fake messenger apps remain the most common lure with over 414,000 attacks detected in the first four months of 2026. Phishing campaigns increasingly exploit legitimate platforms (OneDrive, Zoom Docs) to bypass email filters. Dark web analysis shows SMBs and mid-sized businesses account for more than half of all initial access listings sold by brokers, with Middle East, Africa, and Latin America seeing significant increases. The report includes a practical cybersecurity action plan covering access controls, employee training, backups, and specialized security solutions.

Be on the lookout for Mistic, a new backdoor used by ransomware broker

Symantec researchers have identified a new backdoor called Mistic, active since April, linked to the initial access broker group Woodgnat (also known as KongTuke). The malware uses DLL sideloading via a legitimate Microsoft Defender executable to load itself in memory, avoiding disk-based detection. It communicates with a C2 server, executes code in memory, and includes a kill switch for stealth. Woodgnat sells network access to ransomware gangs including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Infection chains rely on ClickFix social engineering — fake CAPTCHAs, browser crash lures, and Microsoft Teams impersonation of IT support — to trick users into running malicious PowerShell commands. The report includes indicators of compromise for defenders.

One-two punch delivered in global operation disrupts cybercrime “assembly line”

Cơ quan chức năng toàn cầu cùng các công ty công nghệ, bao gồm Microsoft, đã triệt phá một "dây chuyền lắp ráp" tội phạm mạng bằng cách tấn công đồng thời hai nền tảng malware phổ biến: Amadey (cung cấp dịch vụ malware) và StealC (cung cấp dịch vụ infostealer). Microsoft phát hiện hai công cụ này chia sẻ hạ tầng chung nhờ phân tích AI, hỗ trợ chiến dịch triệt phá phối hợp. Chiến dịch thuộc "Operation Endgame" liên quan đến việc đánh cắp hàng triệu thông tin đăng nhập và hơn 47 triệu USD từ tiền chuộc và gian lận.

Lập trình viên nên đọc bài này để hiểu cách các công ty công nghệ và cơ quan pháp luật sử dụng công nghệ AI và phân tích hệ thống để phát hiện và phá hủy các nền tảng malware được thiết kế để tự động hóa và mở rộng các cuộc tấn công cybercrime, giúp bảo vệ hệ thống của mình trước các mối đe dọa ngày càng phức tạp.

Compromised GitHub action codfish/semantic-release-action steals CI/CD secrets

The codfish/semantic-release-action GitHub Action was compromised on June 24, 2026 via a force-pushed imposter commit attack. An attacker repointed major version tags (v2–v5) to malicious commits containing a composite action that runs the legitimate action first, then silently installs Bun and executes a 781KB obfuscated JavaScript payload. The payload is linked to the Miasma credential-stealing toolkit, which uses GitHub's public commit search API as a dead-drop C2 channel to deliver remote code execution without traditional outbound infrastructure. Affected workflows likely expose GITHUB_TOKEN and NPM_TOKEN secrets. Indicators of compromise, malicious commit hashes, and confirmed clean versions are provided.

Microsoft uses AI to link two malware operations in racketeering suit

Microsoft has used AI to link two malware operations — StealC and Amadey — in a racketeering lawsuit, resulting in the shutdown of over 200 command-and-control (C2) servers.

More Malicious OpenClaw Skills Threaten AI Supply Chain

Unit 42 researchers at Palo Alto Networks identified five malicious skills on ClawHub, the marketplace for the OpenClaw AI agent framework, that bypassed automated security scanning including VirusTotal and ClawScan. The skills fell into three threat categories: infostealers targeting macOS with C2 connectivity, detection evasion via inflated file sizes exceeding scanner thresholds, and novel agentic threats including affiliate link injection and a cryptocurrency pump-and-dump scheme. This follows earlier reports of widespread malicious skills on the platform, including Bitdefender's finding that 17% of analyzed skills carried malicious payloads. All five skills were reported and removed. Defenders are advised to treat skills as potential network entry points, monitor outbound agent traffic, validate publisher provenance, and apply least-privilege access to agents.

Amadey, StealC malware operations disrupted in Operation Endgame action

Microsoft, Europol, and international partners have disrupted the Amadey and StealC malware-as-a-service operations as part of Operation Endgame. The action took down 326 servers and 142 domains, identified over €41 million in criminal cryptocurrency, and recovered approximately 27 million stolen credentials from more than 385,000 compromised systems. Microsoft's Digital Crimes Unit identified over 200 malicious C2 domains linked to the two malware families, which infected more than 140,000 devices in just the first two weeks of May 2026. Amadey is used for initial access and deploying additional malware, while StealC steals credentials and cryptocurrency wallets. The operation also targeted SocGholish. Private-sector partners including ESET, Proofpoint, IBM X-Force, and Bitsight contributed intelligence and analysis. Experts note that without arrests, threat actors often rebuild infrastructure and resume attacks.

Schneier on Security

A malware developer has been found embedding policy-triggering text about nuclear and biological weapons inside JavaScript comment blocks in spyware. The technique exploits AI-based code analysis pipelines: because some scanners feed file content directly to LLMs without isolating it as untrusted data, the fake instructions can cause refusal behavior, prompt confusion, or premature classification before the scanner reaches the actual malicious code. The trick does not defeat traditional static analysis tools like YARA rules, entropy checks, or AST parsing, but is an effective anti-analysis measure against naive LLM-first triage systems.

Stealthy Mistic backdoor linked to ransomware access broker KongTuke

A new stealthy backdoor called Mistic (also tracked as MTLBackdoor by Zscaler) has been linked to KongTuke/Woodgnat, an initial access broker active since 2024 that sells corporate network access to ransomware groups including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Mistic is deployed via DLL side-loading using a legitimate Microsoft executable, disguises itself with names resembling Microsoft endpoint security tooling, and runs payloads entirely in memory with no disk writes. Key capabilities include file operations, C2 beacon interval modification, in-memory code execution, and a kill switch for self-deletion. Notably, it supports Beacon Object Files (BOFs) — a technique common in red team tools like Cobalt Strike — allowing capability expansion without leaving disk artifacts. The backdoor has been observed in attacks targeting insurance, education, IT, and professional services sectors since at least April 2025, often deployed alongside ModeloRAT via ClickFix-style social engineering.

StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon

Kaspersky researchers have uncovered a previously undocumented malware campaign called StrikeShark, which uses a custom loader named SharkLoader to deploy Cobalt Strike Beacon on compromised systems. Initial access is gained through exploitation of vulnerabilities in internet-facing applications (Microsoft Exchange ProxyLogon, Openfire, GeoServer, Fortinet, Cisco, and others) as well as dropper executables disguised as legitimate software like Google Update and Cisco AnyConnect. SharkLoader employs DLL sideloading via a legitimate Windows binary (SystemSettings.exe), uses 'Perfect DLL Hijacking' to bypass the Windows loader lock, and deploys multiple API hooks via Microsoft Detours and MinHook to evade memory scanning. The Cobalt Strike Beacon is encrypted with Blowfish and AES, reflectively loaded in memory, and executed in a suspended thread. Post-compromise activity includes Active Directory enumeration, credential dumping from LSASS and NTDS, and use of open-source tools (FScan, Searchall, Pillager) associated with Chinese-speaking developers. Victims span government entities, diplomatic organizations, and software development companies across Indonesia, Taiwan, Lebanon, Syria, Hong Kong, Colombia, and more. Attribution remains preliminary with low confidence pointing to a Chinese-speaking threat actor.

PostCSS npm Typosquat: How to Check If Your Machine Is Compromised

Three malicious npm packages — postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro — have been impersonating the legitimate PostCSS selector parser library and silently installing a Windows RAT on developer machines. Published by a single npm account, the packages use AES-256-GCM encrypted payloads, download a second-stage ZIP from a fake NVIDIA domain, and deploy Nuitka-compiled Python modules that establish persistence via a Windows registry run key and connect to a C2 server. A dedicated module targets Chrome saved credentials using Windows DPAPI. Detection steps include checking npm dependency trees, scanning %TEMP% for specific directories and files, inspecting the registry for a 'csshost' entry, and monitoring network traffic to a known C2 IP. Remediation requires isolating the machine, removing the packages, deleting artifacts, rotating all Chrome-stored credentials, and notifying security teams on corporate devices.

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

SentinelLABS has analyzed macOS.Gaslight, a DPRK-linked Rust macOS implant with a novel anti-analysis technique: a 3.5 KB embedded prompt-injection payload containing 38 fabricated 'system' messages designed to mislead LLM-assisted triage pipelines into aborting analysis. Beyond this, the implant features a Telegram Bot API C2 with AES-GCM encryption and certificate pinning, a bot-token self-redaction mechanism, a Python-based credential stealer (harvesting browser data, keychains, and terminal history), LaunchAgent persistence masquerading as an Apple system service, and a runtime-fetched standalone CPython interpreter. The prompt injection is more sophisticated than previously documented examples, using a 38-message harness-spoofing cascade rather than a single injected block. Defenders building LLM-assisted analysis pipelines are warned to treat sample contents as adversarial input.

New macOS ClickFix attack silently mounts DMGs to push infostealer

A new macOS ClickFix campaign uses fake CAPTCHA pages to trick users into running Terminal commands that silently download, mount, and execute malicious DMG files. The payload is the Atomic macOS Stealer (AMOS), which harvests browser credentials, cryptocurrency wallet data, Apple Keychain files, messaging app data, and user documents. Unlike previous DMG-based attacks requiring manual user interaction, this campaign automates the entire infection chain via hdiutil and the macOS open command. The malware targets over a dozen Chromium and Firefox-based browsers, multiple crypto wallets, and even replaces legitimate Ledger Live and Trezor Suite installations with malicious versions. All stolen data is zipped and exfiltrated to attacker-controlled servers.

SocGholish Takedown Highlights Malicious TDS Threats

An international law enforcement operation (Operation Endgame) seized 106 servers and numerous domains tied to SocGholish, a JavaScript malware framework used as an initial-access broker for ransomware groups including Evil Corp. The action also remediated nearly 15,000 compromised WordPress websites. SocGholish relies on traffic distribution systems (TDSs) to redirect users from legitimate sites to fake browser update pages, filtering out researchers and bots while targeting domain-joined enterprise systems for deeper intrusion. The FBI issued guidance urging organizations to change default JavaScript file associations, monitor endpoints for suspicious script execution, keep CMS platforms updated, and audit administrator accounts to defend against TDS-based attacks.

Developer Credential Economy: Inside look at the Miasma worm

The Miasma worm, derived from the open-sourced Mini Shai-Hulud toolchain, compromised 89+ npm packages across three waves in June 2026, affecting Red Hat, Vapi.ai, and Microsoft Azure repositories. The root cause was a stolen developer credential that sat in underground markets for seven weeks before weaponization — a pattern Tenable calls the Developer Credential Economy. Key escalations include: malicious packages carrying valid SLSA Build Level 3 provenance attestations, a novel 'Phantom Gyp' technique bypassing install-script monitoring, and a new persistence mechanism targeting AI coding assistants (Claude Code, Cursor, Gemini CLI, VS Code) by dropping configuration file overrides. The public release of the full attack toolchain has permanently lowered the barrier for copycat campaigns. EDR is insufficient because credential theft happens in ephemeral CI/CD environments with no agent visibility. Recommended defenses include dark web credential monitoring with automated rotation, human-gated npm publishing (staged publishing in npm CLI 11.15.0), OIDC token scope restrictions, and treating developer environments as control-plane infrastructure under a CTEM framework.

FortiBleed Attackers Turn Firewalls Into Credentials Stealers

SOCRadar has published a detailed whitepaper exposing the full attack chain behind the 'FortiBleed' campaign, a large-scale credential harvesting operation targeting over 430,000 FortiGate firewalls globally. Threat actors, likely Russian-speaking, deployed a Golang-based tool called FortigateSniffer that abuses FortiOS's built-in diagnostic commands to passively capture authentication traffic across 24 protocols without installing traditional malware. The campaign has already stolen over 110 million credentials including RADIUS, NTLM, and Kerberos material, created 659 credential-harvesting pipelines, and breached targets including a NATO-aligned defense contractor. The attack chain involves five steps: reconnaissance, credential stuffing/brute-force, passive sniffing post-compromise, hash cracking via GPU infrastructure, and lateral movement culminating in data theft or ransomware. CISA has urged organizations to harden Fortinet environments. Recommended mitigations include rotating all credentials, enforcing MFA, removing FortiGate management interfaces from internet exposure, and reviewing authentication logs.

Uplevelling Black Hat Threat Hunters

At Black Hat Asia 2026, the Cisco NOC team describes how they migrated from Secure Malware Analytics (SMA) to Splunk Attack Analyzer (SAA) for malware threat analysis. They built a query to extract high-scoring submissions (≥85), enriched results with network context (traffic telemetry, directionality, action context), and automated surfacing of alerts into Cisco XDR for threat hunters. Key engineering decisions included focusing only on HTTP traffic for relevance, normalizing timestamps, and adding a zScaler exception to prevent false correlations. The result is a detection stream that helps hunters dismiss noise faster and act on actionable signals rather than just high scores.

Vibecoding Malware Fuels a New Wave Of Stealth Attacks

Cybersecurity researchers at University College Cork have found that AI-assisted malware creation, dubbed 'vibeware,' poses a growing threat by generating functionally identical but structurally varied malicious code that evades traditional static detection methods like hash matching and YARA rules. The UCC team demonstrated that malware targeting Linux systems could be crafted with as few as two prompts using tools like Cursor, which did not restrict the requests. Experts from McAfee, Bitdefender, and ProjectDiscovery warn that LLMs lower the barrier to entry for threat actors, enabling even non-coders to build malware. The consensus is that defenders must shift to behavioral and AI-driven detection strategies. Google's discovery of PROMPTFLUX — malware that calls the Gemini API at runtime to rewrite its own code — illustrates how adaptive AI-generated malware could become.