tsecurity.de - News Radar & Live Feeds

Recovering a removed npm malware file using Software Heritage and a surviving CDN digest

Tue, 06 Oct 2026 03:12:40 +0200

I wrote up my investigation into @goodjavascript/dotenv@1.0.0, including how to recover its entry-point file after the npm tarball and jsDelivr file URLs returned 404. The useful detail: Software Heritage’s latest snapshot contained only the security placeholder. An older snapshot retained the original release and its 840-byte index.js. Its... Weiterlesen

Fake ChatGPT Helpers Are Spreading Malware. Here Is How to Spot Them.

Mon, 05 Oct 2026 23:54:46 +0200

Author: Katie Boquetti | Editorial: Craig Taylor Editorial by Craig Taylor: A CAPTCHA should test whether you’re human. It should not audition you for the IT department. If “prove you’re human” means opening PowerShell, the only command you need is: close the tab. Criminals call their instructions a fix. Security researchers call the trick... Weiterlesen

Gratis-Tool gegen Online-Betrug: Malwarebytes prüft verdächtige Links, bevor ihr klickt

Mon, 05 Oct 2026 21:31:54 +0200

Ein neuer Dienst von Malwarebytes prüft verdächtige Links, bevor ihr sie öffnet. Das soll Phishing und andere Online-Betrugsmaschen schneller erkennbar machen. Dieser Artikel wurde einsortiert unter Datenschutz, Schutz vor Malware, Trojanern & Spyware, Aktuelle Betrugswarnungen. Weiterlesen

Malwarebytes Scam Link Check analyzes URLs and explains potential risks

Mon, 05 Oct 2026 16:48:35 +0200

Malwarebytes has launched the Malwarebytes Scam Link Check, a free web tool that lets anyone check whether a website link is safe or dangerous before clicking it. Users paste any suspicious URL, the kind that arrives by text, email, chat, or social media, and the tool returns a safety result, along with the reasons behind it and recommended next... Weiterlesen

ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

Mon, 05 Oct 2026 16:48:19 +0200

ClingSTUN exploits known IoT flaws and abuses public STUN servers to keep proxy access to devices Weiterlesen

GlassWorm Supply Chain Attack Uses Fake VS Code Themes to Deliver Hidden Malware

Mon, 05 Oct 2026 15:19:08 +0200

GlassWorm is turning developer tools into malware delivery channels, this time through extensions advertised as attractive VS Code themes. The investigated cluster spans Visual Studio Marketplace and Open VSX, showing how appearance changes can provide cover for code that runs on developer machines. The campaign first surfaced in October 2025 and... Weiterlesen

ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache

Mon, 05 Oct 2026 15:19:05 +0200

A new ClickFix campaign is turning a web safety check into a route for malware. Visitors to compromised websites see a fake CAPTCHA or repair message and are told to open the Windows Run dialog, paste copied text, and press Enter. The instruction looks simple, but it makes the victim run the attacker’s command. The campaign is concerning because... Weiterlesen

Alleged dev of Ploutus ATM malware appears in US court after arrest

Mon, 05 Oct 2026 15:12:40 +0200

The U.S. Department of Justice has announced the arrest of the alleged developer of Ploutus malware, used to steal millions of dollars in ATM jackpotting attacks across the United States. [...] Weiterlesen

Malicious VS Code Themes Hide GlassWorm Malware Targeting Developers

Mon, 05 Oct 2026 09:23:41 +0200

A group of VS Code theme extensions linked to GlassWorm, a malware campaign targeting developers. Their investigation identified two confirmed malicious extensions and several related themes across the Visual Studio Marketplace and Open VSX registry. Two suspicious themes, Coca-Cola Christmas and Aurora Borealis Studio Theme, had collected more... Weiterlesen

GlassWorm Supply Chain Attack Hides Malware Inside VS Code Color Themes

Mon, 05 Oct 2026 08:27:04 +0200

A GlassWorm-linked software supply chain campaign has abused seemingly harmless Visual Studio Code color themes to distribute malicious loaders across the Visual Studio Marketplace and Open VSX Registry. The activity demonstrates how extensions designed only to change editor colors can become high-impact initial-access vectors when they include... Weiterlesen

SniffDog: I built my job-hunting friend a sniffer dog that sniffs out malware in fake recruiter repos

Mon, 05 Oct 2026 00:32:58 +0200

This is a submission for the Hacktoberfest Weekend Challenge: Build for a Friend What I Built SniffDog checks a take-home coding assignment before you run it. It reads the repo, never executes it, and tells you in plain English whether it's safe to open. I built it for my friend Mayank Raj. Earlier this year, Mayank, a final-year student hunting... Weiterlesen

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 117

Sun, 04 Oct 2026 16:49:10 +0200

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Lunex Unmasked: A New Information Stealer Deployed Through BYOVD Storm-3168: Agentic-driven cloud attacks using compromised service principals Don’t Call Us, We’ll Call Your APIs |... Weiterlesen

Cracked open the Google IPTV malware APK and found its C2 domain

Sun, 04 Oct 2026 10:22:17 +0200

submitted by /u/acealter [link] [comments] Weiterlesen

WordPress Hacked: Malware Removal and Recovery Guide

Sat, 03 Oct 2026 20:04:37 +0200

If your WordPress site was hacked and is now showing pharmaceutical spam, redirecting visitors to somewhere unpleasant, or has been flagged by Google as deceptive, start here rather than with a plugin. The instinct is to install a security scanner and click clean. That removes the visible symptom and leaves the way in, which is why so many sites... Weiterlesen

Google’s Android 17 Locks Accessibility Services to Verified Apps as Malware Threat Branches Out

Sat, 03 Oct 2026 19:47:12 +0200

Google is tightening restrictions on one of mobile malware's most persistent entry points. With Android 17, the company is limiting access to its AccessibilityService API to verified Accessibility Tools only, a change that takes effect the moment a user switches on Advanced Protection. The move, announced Thursday, targets a problem that has... Weiterlesen

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Sat, 03 Oct 2026 10:06:53 +0200

A newly identified IoT botnet, Cling, disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure. The technique enables attackers to manage compromised internet-facing devices while blending activity into routine NAT-traversal traffic used by... Weiterlesen

Cling IoT Malware Masquerades as Google STUN Traffic to Hide C2 Communications

Sat, 03 Oct 2026 06:55:42 +0200

A newly observed IoT botnet named Cling exploits vulnerable internet-facing devices and disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure. The technique lets operators hide malicious instructions amid common NAT-traversal traffic used by... Weiterlesen

Free malware analysis, reverse engineering and exploit development resources

Sat, 03 Oct 2026 05:04:26 +0200

submitted by /u/Potential-Couple-745 [link] [comments] Weiterlesen

Where to get resources and get started with malware dev?

Sat, 03 Oct 2026 05:04:26 +0200

So, I am a student persuing b tech cybersecurity course, and am pretty good in networkings and Linux systems. I also have some experience in pentesting, have solved some vulnhub machines on my own and have practiced on tryhackme. For programming, I can code in python, c, and c++. I want to get into malware development, but am not getting any solid... Weiterlesen

This new ChatGPT scam tricks you into installing malware – how to spot the trap

Fri, 02 Oct 2026 20:24:53 +0200

This authentic-looking scam starts with a sponsored Google link – and it’s catching people off-guard. Weiterlesen

Software Supply Chain Attacks Use Malicious npm Updates to Steal Credentials and Spread Malware

Fri, 02 Oct 2026 19:26:10 +0200

Software supply chain attacks are turning trusted developer tools into channels for credential theft and malware delivery. Campaigns involving S1ngularity, Shai-Hulud, and TeamPCP show how compromised packages can expose developer workstations, build systems, and cloud infrastructure through routine software updates. Rather than attacking each... Weiterlesen

SLTT C2 Traffic Tied to Remus Malware Distribution Operation

Fri, 02 Oct 2026 19:25:27 +0200

The CIS CTI team identified Remus infostealer distribution activity spanning March through September 2026. Read its analysis. Weiterlesen

Malwarebytes Download - Schutz vor Schadsoftware

Fri, 02 Oct 2026 19:21:23 +0200

Der Download von Malwarebytes installiert einen starken Schutz vor Schadprogrammen wie Viren oder Ransomware und wehrt selbst die neuesten Bedrohungen ab. Hierzu kombiniert Malwarebytes 5.7.2 verschiedene ... (Weiter lesen) Weiterlesen

Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware

Fri, 02 Oct 2026 19:17:35 +0200

A growing wave of supply-chain attacks is proving the opposite: attackers are compromising legitimate open-source packages and using trusted update channels to deploy credential-stealing malware directly into developer and enterprise environments. Malicious Nx releases, published after attackers stole an npm publishing token through a GitHub... Weiterlesen

Fake Zoom installer tries to trick Mac users into installing hidden malware

Fri, 02 Oct 2026 19:16:50 +0200

A new Mac threat is hiding inside something that looks like a normal Zoom installer, according to security researchers at Jamf Threat Labs. The file opens as a disk named Zoom and looks like the usual Mac installer: an app icon on the left, a shortcut to the Applications folder on the right. The catch is a set of instructions printed on the... Weiterlesen