49 stories tagged malware, newest first.
582 points by abhisek | 192 comments
SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.
193 points by mindracer | 92 comments
Blog post analyzing in-the-wild exploitation of Plex Media Server vulnerabilities used to deploy a cryptocurrency miner.
393 points by speckx | 181 comments
Blog post about finding malware disguised as South Park episodes on torrent sites that ended up in the author's Sonarr download queue, and reverse-engineering it.
36 points by artninja1988 | 26 comments
Anthropic Frontier Red Team post reporting experiments suggesting small AI models may soon self-replicate on commercial IoT devices without datacenter access.
166 points by luggage_bazooka | 47 comments
A GitHub commit in the colinhacks/zod repository titled "Fix bugs and improve performance" tagged v4.6.6, changing 9 files including the release workflow.
6 points by HieronymusBosch | 1 comments
TorrentFreak article on TorrentClaw, an AI-built torrent search engine whose TrueSpec feature inspects torrent contents, revealing a malware trick using a genuine VLC player as a decoy.
23 points by PicardManeuver | 8 comments
BleepingComputer news article on hackers using Google Ads and Bing redirects to lure users into Claude-themed ClickFix malware attacks.
215 points by hermitcrab | 89 comments
A Successful Software blog post complaining that GitHub has not removed malicious software imitating the author's product three weeks after it was reported.
413 points by xlii | 249 comments
Blog post by the developer of RACE, a Rust macOS terminal multiplexer, about how their software ended up flagged or advertised as malicious via Google Ads.
532 points by abhisek | 468 comments
SafeDep blog post analyzing a malicious version of the Rust crate arrayref that executes a payload at build time via a supply-chain attack.
318 points by CITIZENDOT | 85 comments
A blog post describing how a take-home interview project from a LinkedIn recruiter turned out to contain malware hidden via git hooks.
927 points by theorchid | 240 comments
A blog post describing the discovery of about 10,000 GitHub repositories distributing Trojan malware and the shared pattern used to find them with a script.
1552 points by lwhsiao | 295 comments
Blog post by developer Roman Imankulov describing a backdoor hidden in code sent as part of a LinkedIn job offer, how it triggers, and the borrowed identities used.
441 points by marc__1 | 231 comments
A post by John Scott-Railton noting malware authors embedded nuclear and bioweapons text in spyware to trigger LLM safety refusals and evade AI security scanners.
728 points by kurmiashish | 411 comments
GitHub issue in RedHatInsights/javascript-clients reporting malicious npm releases published under the @redhat-cloud-services scope, citing StepSecurity analysis.
985 points by Timofeibu | 430 comments
BleepingComputer news article reporting that GitHub confirmed a breach of about 3,800 internal repositories via a malicious VSCode extension.
350 points by theanonymousone | 272 comments
SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.
341 points by cmbailey | 202 comments
Threat analysis article on a social engineering campaign abusing an Obsidian plugin to deliver the PHANTOMPULSE RAT to finance and crypto professionals.
450 points by j12y | 172 comments
Semgrep security research post reporting that PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with Shai-Hulud themed credential-stealing malware.
1116 points by speckx | 312 comments
Anchor Hosting blog post describing how someone acquired 30 WordPress plugins and inserted a backdoor into each of them.
379 points by pashadee | 96 comments
The Register reports that the CPUID website was hijacked for about six hours, serving credential-stealing malware in place of HWMonitor and CPU-Z downloads.
1891 points by mtud | 763 comments
StepSecurity blog post reporting that a hijacked maintainer account published malicious axios versions 1.14.1 and 0.30.4 on npm that drop a cross-platform RAT.
415 points by Fibonar | 153 comments
A FutureSearch engineer's blog post with the Claude Code transcript of discovering the compromised LiteLLM PyPI release and getting it quarantined.
701 points by theanonymousone | 281 comments
GitHub issue in BerriAI/litellm reporting a malicious litellm_init.pth file in the 1.82.8 PyPI package that steals credentials via a supply chain compromise.
888 points by dot_treo | 467 comments
GitHub issue in the BerriAI/litellm repo reporting a malicious litellm_init.pth in PyPI release 1.82.8 that acts as a credential stealer.
321 points by natebc | 145 comments
Kaspersky Securelist research article analyzing the Notepad++ supply chain attack, its unnoticed execution chains, and new indicators of compromise.
330 points by OuterVale | 181 comments
GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.
317 points by birdculture | 98 comments
Aikido Security blog post reporting a second Shai Hulud npm supply-chain attack compromising packages from Zapier, ENS, AsyncAPI, PostHog, and Postman.
967 points by mrdosija | 733 comments
HelixGuard blog post reporting that the Shai-Hulud worm returned, infecting over 300 npm packages via a fake Bun runtime within hours.
410 points by canucker2016 | 180 comments
Tom's Hardware article recounting the 1988 Morris worm, which infected about 10 percent of the internet within 24 hours and sparked modern cybersecurity.
349 points by jnord | 248 comments
Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.
829 points by DavidDodda | 427 comments
A blog post by David Dodda recounting how a fake job interview attempted to get him to run malicious code on his machine.
1182 points by jamesberthoty | 965 comments
StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.
367 points by tosh | 263 comments
GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.
1287 points by universesquid | 699 comments
Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.
442 points by neuroo | 243 comments
Semgrep security alert describing a compromise of the nx build tool's npm packages that stole wallets, keys, and credentials from at least 1.4k users.
427 points by longcat | 421 comments
GitHub security advisory from the nrwl/nx repository reporting that malicious versions of Nx and several supporting npm plugins were published.
369 points by air7 | 196 comments
KrebsOnSecurity blog post explaining that many ransomware strains refuse to install on Windows systems with Russian or other CIS-language virtual keyboards installed.
350 points by timsh | 143 comments
Blog post investigating thousands of GitHub repositories posing as game mods and software cracks that distribute data-stealing malware.
976 points by xairy | 501 comments
GitHub repository by xairy with tools and firmware dumps for controlling the webcam LED on a ThinkPad X230, showing it can be disabled while recording.
423 points by crtasm | 168 comments
Blog post describing how GitHub notification emails were abused to deliver malware to developers.
395 points by PROgrammerTHREE | 128 comments
Tom's Hardware news report that a South Korean telecom ISP allegedly deployed malware against 600,000 torrent-using customers, causing missing files and disabled PCs.
738 points by gnabgib | 304 comments
Sansec threat research post reporting that the new Chinese owner of the Polyfill JS project is injecting malware into more than 100,000 websites.
540 points by toby_tw | 229 comments
Landing page for Cyber Scarecrow, alpha software that runs in the background to make a computer look like a security research environment, deterring malware.
476 points by SofianeHamlaoui | 315 comments
Blog post describing observations, attacker commands, and malware samples (e.g. BASHLITE/Gafgyt) collected from running an SSH honeypot for 30 days.
343 points by alexrustic | 145 comments
Lumen Black Lotus Labs report on the Pumpkin Eclipse incident, in which malware destroyed hundreds of thousands of routers at a single ISP in 2023.
833 points by mycall | 484 comments
Raymond Chen's Old New Thing blog post arguing that overly aggressive uninstallers end up behaving like malware on Windows.
920 points by txr | 196 comments
Blog post warning macOS users to uninstall NightOwl, a dark-mode switcher bought by TPE.FYI LLC that enrolls devices in a market-research botnet.
665 points by campuscodi | 237 comments
Blog post investigating how the Swing VPN mobile app uses its users' devices as a botnet to DDoS websites.