Coruna and DarkSword kits steal iPhone data from one web visit
Zimperium found 608 domains serving version-specific chains, including a backdoored npm package that infects visitors of otherwise ordinary sites.
84
- Mentions · 7d6
- Mentions · 30d13
- All mentions17
- First seenAug 21, 2026
- Last mentioned17h ago
Timeline
17 articles · newest firstDarkSword iOS chain escapes Safari and steals Apple Notes
Zimperium says a tested iOS 18.6.2 device uploaded NoteStore.sqlite and an inventory of 214 apps to attacker infrastructure.
76
Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Miasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
74
Malicious LiteLLM 1.107.0 ships stealer and backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
76
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
78
Fake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package imgdecode, tied to MALFEX, loads a DLL that downloads and injects shellcode.
74
Fake Arch Linux packages push malware with root privileges
Typosquatted Arch User Repository packages impersonating yay and paru ran a remote shell as root.
74
Auditing the auditor: Unmasking Apex Accelerator
Elastic unmasked Apex, a fake Web3 accelerator pushing malicious npm packages and infostealers to crypto founders.
61
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Shai-Hulud infected Tensorlake’s npm SDK 0.5.144, stealing credentials before the package was removed within minutes.
78
101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
OX Security found 101 malicious npm packages totaling 490,000 downloads that hijack developers' WhatsApp accounts into attacker-controlled groups.
55
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
DPRK-linked actors planted Go malware in HashiCorp Terraform providers and Go modules.
74
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
80
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
55
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2022-485033%8.8Apple Web Content Bounds-Check Flaw Enables Code Execution Across iOS, macOS, Safari
Appears with
- npmproduct · 8
- Socketorganization · 6
- JFrogorganization · 5
- npmvendor · 3
- testmetestmalware · 3
- StepSecurityorganization · 2
- DarkSwordmalware · 2
- Geminiai model · 2
- Shai-Huludmalware · 2
- LiteLLMproduct · 2
- @apexacc/auditproduct · 2
- Safariproduct · 2
- Zimperiumorganization · 2
- Aikidoorganization · 2
- Checkmarxorganization · 2
- GitHub Actionsproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.