#вредоносное-по
-
Hugging Face crypto-mining campaign returns days after takedown
Attackers are publishing fake models on Hugging Face that hijack GPU servers for mining and plant backdoors, with the most popular one downloaded over 28,000 times. Separately, a fake Solana starter kit on GitHub is set up to fool AI coding agents.
-
GitHub Launches npm Firewall to Stop Malicious Packages Before Installation
GitHub has opened a public preview of a package firewall for npm. It checks dependencies against a set of policies and blocks suspicious packages at install time.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Anthropic warns small AI models could self-replicate across IoT devices
Anthropic cautions that compact models capable of copying their own weights could give rise to a new generation of computer worms.
-
A fake gig and a git hook: an attempt to steal developer credentials
REVSYS founder Frank Wiles describes how a supposed client tried to run arbitrary code on his laptop through an innocent-looking git repository.
-
Mantax Otax: The Android Malware That Encrypts, Spies On and Intimidates Its Victims
A new Android malware called Mantax Otax combines the functions of ransomware and spyware, and in its second version it has picked up an arsenal for putting psychological pressure on the victim.
-
Microsoft Warns of Surge in ACR Stealer Malware Attacks
The company has recorded a rise in attacks using ACR Stealer — malware that steals passwords and tokens from the browsers of corporate customers.
-
Seven Malicious npm Packages for Vite Used the Blockchain as a C2 Server
Researchers have uncovered the ViteVenom campaign — seven malicious npm packages targeting the Vite ecosystem and using blockchain infrastructure to control infected systems.
-
North Korean hackers hide malware in SVG flags of fake coding tests
Attackers tied to the Contagious Interview campaign are using steganography in SVG images to conceal a malicious payload inside fake assignments for job seekers. The victims are developers who respond to bogus job openings.
-
New OkoBot Malware Framework Discovered Stealing Cryptocurrency
Researchers have identified a new malware framework called OkoBot that deploys more than 20 different payloads to steal data and cryptocurrency. The attacks primarily target crypto wallet seed phrases and user credentials.
-
Credential-Stealing Trojan Planted in AsyncAPI npm Packages
Attackers published five malicious versions of AsyncAPI packages in the npm registry, using them to distribute a remote access trojan with data-theft capabilities. The attack struck the open-source software supply chain.
-
Android trojan RedHook learns to gain shell access via wireless ADB
A new version of the RedHook malware exploits Android's wireless debugging mechanism (Wireless ADB) to obtain shell-level privileges without connecting to a computer.
-
Fake SDKs for the Paysafe and Skrill payment services found on NPM and PyPI
Malicious packages in the NPM and PyPI repositories masqueraded as SDKs for the Paysafe, Skrill and Neteller payment services, stealing the credentials of developers and users alike.
-
Chinese hackers expand ORB network with new LONGLEASH backdoor
The UAT-7810 group is developing the LONGLEASH malware to expand its ORB network by breaching vulnerable network devices, primarily unpatched Ruckus routers.