SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 118
Security Affairs Round 118 collects reports on ClingSTUN, npm supply-chain theft, AhsayCBS exploitation, and other malware campaigns.
Security Affairs Malware Newsletter Round 118 is a digest of recent malware reporting rather than a single incident write-up. Headlines cover the ClingSTUN Linux backdoor, UAC-0277 using ClickFix to distribute LUNEXSTEALER, long-running MALFEX npm postinstall malware, and a TensorLake npm SDK compromise linked to ChainDrop and Shai-Hulud credential theft. Other items cite the Wazza phishkit targeting US, EU, and Australian sectors, a P7 DarkSword variant, exploitation of critical AhsayCBS flaws to deploy webshells and XMRig, the FakeGit repository fleet, and Midnight Mimosa phone compromise. The list also points to research on malware deception, LLM-assisted analysis, and IoT and memory-forensic detection.
- ClingSTUN is a Linux backdoor that abuses public STUN infrastructure.
- UAC-0277 uses ClickFix on compromised sites to spread LUNEXSTEALER.
- MALFEX and a TensorLake npm compromise show supply-chain credential theft.
- Actors exploit critical AhsayCBS flaws to plant webshells and XMRig.
- The digest also cites Wazza, FakeGit, Midnight Mimosa, and detection research.
Full article193 words · extracted from securityaffairs.com · click to collapse
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape
Malware Newsletter
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER
MALFEX – A malicious npm postinstall no advisory has caught for fourteen months
Canto incognito: tracking the PoeLLM malware
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Wazza Phishkit Targets Banking, Government, and Manufacturing Across the US, EU, and Australia
Sleep, Beacon, Steal, Repeat – The Story of P7 DarkSword Variant
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight
The phone was compromised before the user turned it on: the rise of Midnight Mimosa
ORCAGen: Orchestrating Context-Aware Malware Deception with RAG-Guided Generative AI
MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
An IoT Malware Detection Framework Based on Large Language Models and Deep Learning Techniques
An Explainable Attention-Enhanced Deep Learning Model for Memory-Forensic Malware Detection
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)