Search: “javascript”

2,062 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 2064 Vulnerability 1230 Exploit / PoC 533 Ransomware 333 Threat actor 297 Data breach 242 Phishing & fraud 211 Industry 68 Policy & legal 56 Research 38 Advisory 36 AI tools & infra 32 AI safety & security 17 AI research 7

SeverityAll critical 1289 high 2518 medium 1077 low 227 info 63

JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies

Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.

Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.

The Hacker NewsSep 7, 07:53 UTC · 9d agoMalware in the wild1

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The Hacker NewsAug 4, 05:21 UTC · Aug 4, 2026Malware1

Hades PyPI Attack: 19 Packages Poisoned to Auto

The Hacker NewsJun 9, 10:34 UTC · Jun 9, 2026Malware

Experts Confirm JS#SMUGGLER Uses Compromised Sites to Deploy NetSupport RAT

The Hacker NewsDec 10, 07:34 UTC · Dec 10, 2025Malware

Konni Hackers Turn Google’s Find Hub into a Remote Data

The Hacker NewsNov 17, 14:27 UTC · Nov 17, 2025Malware

New JavaScript Malware Targeted 50,000+ Users at Dozens of Banks Worldwide

The Hacker NewsDec 21, 17:04 UTC · Dec 21, 2023Malware

Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network

The Hacker NewsJun 3, 13:43 UTC · Jun 3, 2022Malware

Malicious JavaScript Loader is a Multi

Infosecurity MagazineNov 24, 11:30 UTC · Nov 24, 2021Malware

Showtime's Web sites roped visitors' CPU into mining cryptocurrency

Help Net SecurityMay 28, 10:05 UTC · May 28, 2020Malware

The Power of Open Source Intelligence

Cisco TalosJul 17, 20:30 UTC · Jul 17, 2012Malware

KRBanker Targets South Korea Through Adware and Exploit Kits

Unit 42 details KRBanker banking trojan targeting South Korean bank users via KaiXin exploit kit and NEWSPOT adware, using pharming and process hollowing.

KRBanker (aka Blackmoon) is a banking trojan targeting online banking users in the Republic of Korea, with roughly 2,000 unique samples and 200+ pharming servers observed by Unit 42 over six months. It is distributed through the KaiXin exploit kit exploiting Adobe Flash CVE-2014-0569 and CVE-2015-3133, and through the NEWSPOT adware update channel that also delivers the Venik trojan. The trojan uses process hollowing, retrieves pharming server IPs from Qzone profile nickname fields, and abuses Proxy Auto-Config with a local proxy to redirect banking traffic to forged sites.