🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below
@IRSnews@IRSsmallbiz make an EIN confirmation download button that actually works. This button has been an issue for over a decade. Take 5 minutes to fix this button to prevent countless headaches & significantly reduce your call volume. #irs#fail#DoYourJob#webdev101
[New] - Useful vSphere Automation techniques for assisting with CrowdStrike remediation https://t.co/S6JXRfdXim
☝️Ability to send VM Keystrokes using vSphere API is still one of the lesser known yet super powerful capability of our platform! Hope this can help our IT admins 🙏
Microsoft has released a recovery tool to assist in the recovery of systems affected by the CrowdStrike Channel File blue screen:
https://t.co/WWW6o00aE8
#hugops#crowdstrike#bluescreen
I wrote a PowerShell script called Recall Tool which can be used to extract Recall database and image data: https://t.co/B6llz1ROGT
#windows#recall#privacy#PrivacyMatters
🚨 Two #opendir setups are ripe for a sneaky email campaign loaded with #asyncRAT and #Xworm#malware.
📡#opendir:
57.128.129[.21:9222
57.128.129[.21:8080
C2:
🔗 nmds.duckdns[.org:8895
🔗 xgmn934.duckdns[.org:8896
🔗 xvern429.duckdns[.org:8890
🔗 asyncss.duckdns[.org:8797
I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)
https://t.co/CvKo3xPRkP
📢 If you haven't heard by now, there's a new big security vulnerability: CVE-2024-3094 aka the libxz-utils backdoor.
😳 What's most shocking? The backdoor was introduced by none other than Jia Tan, a long-time maintainer of the XZ library. Per https://t.co/B8VHiZZb7E the following timeline events is an excellently documented summary of what we currently know about the introduction of this vulnerability into XZ 👇
Plus, learn the details in our latest blog by #Bugcrowd's own @codingo_: https://t.co/09wl9tSX9H
Earlier today @ddd1ms shared information regarding allegations from ALPHV affiliates of ALPHV administrative scamming partners.
A user went online to state they are responsible for ransoming Change Healthcare. They state after receiving payment ALPHV administrative staff suspended their account. They continue to say the suspension was suspicious and March 3rd, 2024 the wallet which received the Change Healthcare funds was emptied.
They conclude the post by unveiling an ALPHV wallet which has received approx. $92,749,381 (or 1401 BTC)
Wallet: 14Q5xgBHAkWxDVrnHautcm4PPGmy5cfw6b
*information and photos via @ddd1ms
🚨 On February 26th and 27th Telekom Security and Bayern-CERT observed threat actor #TA577 phishing campaigns. This time the actor is not spreading malware, but apparently uses NTLMv2 handshakes to steal user credentials/hashes. 🧵1/7
New: inside the underground site where "neural networks" churn out fake IDs
- I tested, made two IDs in minutes
- used one to successfully bypass the identity verification check on a cryptocurrency exchange
- massive implications for crime, cybersecurity
https://t.co/hCjHWbKJPf