Search: “Decoder”

399 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 116 Exploit / PoC 113 Ransomware 64 Threat actor 42 Malware 24 Data breach 22 Model release 9 AI industry 8 AI safety & security 5 Phishing & fraud 3 Policy & legal 2 Advisory 1 AI research 1 AI tools & infra 1

SeverityAll critical 288 high 95 medium 8 low 0 info 20

OpenAI's GPT-Live-1 API lets developers build apps that talk and listen at the same time

OpenAI's GPT-Live-1 API enables full-duplex speech apps, outperforming GPT-Realtime-2.1 with 0.8s turn-taking latency at $0.05 per minute.

OpenAI released GPT-Live-1 as a developer API for full-duplex speech, allowing applications to listen and talk simultaneously; it already powers ChatGPT voice. Benchmarks show 80.1% on full-duplex interactivity versus 45.4% for GPT-Realtime-2.1, turn-taking latency of 0.8 seconds versus 1.4 seconds, tool-calling accuracy of 87% versus 60%, and a 32% pass rate on a banking voice-support benchmark versus 12.4%. The model costs $0.05 per minute, ships twelve new voices, provides ASR transcripts and response text, and is already in production at Yelp for phone-based reservations.

The DecoderSep 10, 17:47 UTC · 6d agoModel release1

2026-012: Critical Vulnerabilities in Check Point Products

Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.

On 9 September 2026, Check Point released emergency security updates for CVE-2026-85102 (improper certificate-data validation in VPN negotiation) and CVE-2026-85103 (heap overflow in VPN certificate ASN.1 decoding), both CVSS 9.8, allowing unauthenticated remote code execution. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments configured with Remote Access or Site-to-Site VPN, spanning versions R80 through R82.10. CERT-EU advisory 2026-012 urges immediate hotfix application, prioritizing internet-facing and perimeter appliances.

CERT-EU Advisoriesupdated Sep 16, 17:14 UTC · 8h agofirst Sep 10, 08:36 UTC · 6d agoVulnerability 9 sources CVE-2026-85102 CVE-2026-85103

Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root

Two critical ArangoDB flaws (CVSS 9.8 and 9.9) enable unauthenticated API access and root code execution; fixes shipped in version 3.12.11

Remedio researchers found two ArangoDB flaws: GHSA-rrgq-978q-36mq (CVSS 9.8), an authentication bypass caused by the server inconsistently interpreting URL-encoded '/_api' paths, and GHSA-rvhw-4hpw-9vrx (CVSS 9.9), which lets users with database write access run JavaScript tasks with root privileges via the isSystem flag. Chained, they allow administrative database access without credentials, theft of the root password hash, and root code execution, exposing files such as /etc/shadow, TLS keys and cluster signing material on the official container image. ArangoDB shipped fixes in version 3.12.11 on August 31, 2026, with advisories published September 6; CVE identifiers were still pending. Users on 3.12.10.1 or earlier should upgrade, restrict exposure and rotate potentially exposed credentials.

Cyber Security NewsSep 9, 13:50 UTC · 7d agoVulnerability

Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT

SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.

SOCRadar's Threat Research Unit reports active exploitation of CVE-2025-25249, a CVSS 9.8 heap-based buffer overflow in the cw_acd daemon of FortiOS and FortiSwitchManager, via crafted CAPWAP requests to UDP port 5246, compromising at least 178 of 30,000 targeted internet-exposed FortiGate devices since July 2026. The campaign deploys PivotC2, a Node.js RAT that provides interactive shells, SOCKS5/HTTP proxying, port forwarding, network scanning, and automated configuration harvesting that decrypts stored FortiGate credentials, including VPN pre-shared keys, SSL-VPN credentials, and LDAP secrets. Russian-language artifacts, AD enumeration, browser credential theft, RDP enablement, and exfiltration of Exchange .pst files to Wasabi S3 point to a Russian-speaking, financially motivated group; two US organizations confirmed full-network intrusions. Fixes include FortiOS 7.6.4/7.4.9/7.2.12/7.0.18+ and FortiSwitchManager 7.2.7/7.0.6+, plus blocking CAPWAP on internet-facing interfaces.

GBHackersSep 9, 08:57 UTC · 7d agoMalware in the wildCVE-2025-252492

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security NewsSep 8, 16:50 UTC · 8d agoExploit / PoC in the wildCVE-2025-252491

Mistral AI raises 3 billion euros in Europe's largest-ever tech funding round despite lagging behind rivals

Mistral AI closed a €3 billion Series D led by Samsung Electronics, valuing the lab at over €21 billion.

Mistral AI raised €3 billion in what it calls the largest equity round ever by a European tech company, lifting its valuation past €21 billion after ASML valued it near €12 billion in September 2025. Samsung Electronics leads the round with EQT's Scaleup Europe Fund and PSG Equity as co-leads; new investors include Advent, BlackRock-managed funds, and Luxembourg. The company also took an $830 million loan in March to fund its own data centers and serves 125+ enterprise customers including Airbus, ASML, and HSBC. Mistral Medium 3.5 trails open rivals like Qwen and Kimi and doesn't compete with top closed US models.

The DecoderSep 8, 07:45 UTC · 8d agoAI industry1

Anthropic reportedly signs $517 billion in compute deals after Dario Amodei warned rivals about reckless risk

Anthropic signed compute contracts worth up to $517 billion in eleven months, adding 14.8 gigawatts amid the AI capacity race.

According to The Information, Anthropic locked in contracts worth up to $517 billion over eleven months, adding at least 14.8 gigawatts of compute since October 2025 on top of 1–2 gigawatts it already had, and is planning its own data centers. Bloomberg reports Anthropic's annualized revenue topped $65 billion, while OpenAI was above $40 billion as of July and targets 30 gigawatts by 2030. The spending follows Dario Amodei's early-2026 warning that rivals underestimated investment risk, while Sam Altman now cautions about 'unsustainable silliness' from neo-cloud providers.

The DecoderSep 7, 18:12 UTC · 9d agoAI industry1

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeekSep 7, 12:12 UTC · 9d agoThreat actor in the wild1

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.

Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.

The Hacker NewsSep 7, 11:36 UTC · 9d agoMalware in the wild

StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack

Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.

Sansec is investigating StyleSmuggler, an actively exploited unauthenticated remote code execution chain in Magento Open Source and Adobe Commerce, now tracked as CVE-2026-75650 with CVSS 10.0. Adobe released hotfix VULN-39341 via APSB26-146 (priority 1) on September 7 for versions 2.4.4 through 2.4.9, but stores were being exploited for roughly three days before the fix existed. The implant is a Rust backdoor that disguises itself as kworker, fc-cache, or chronyd processes and exfiltrates host data in MessagePack records sent as fake NTP replies over UDP port 123. Adobe advises rotating the encryption key and every credential it protected, and Sansec stresses patching does not clean already-compromised stores.

Sansec (Magento / e-commerce security)Sep 5, 00:00 UTC · 12d agoExploit / PoC in the wildCVE-2026-756501

ASCII smuggling isn't just an AI security risk

Microsoft tracked a phishing campaign peaking at 2.37 million daily messages that hid financial-lure keywords with invisible Unicode tag characters to evade filters.

Microsoft researchers uncovered a large phishing campaign that inserted invisible Unicode tag characters (e.g., U+E0020) inside common financial keywords like 'funding', splitting words so keyword, signature, and regex matches fail. The campaign peaked at more than 2.37 million messages in late February 2026, ran from about 150 finance-themed sender domains on a strict weekday-only schedule, and gradually declined to under 20% of peak weekday volume by late March, with residual spikes through mid-June. The technique repurposes ASCII smuggling, normally used for indirect prompt injection against AI assistants, for traditional email phishing evasion. Microsoft advises defenders to strip or fold invisible Unicode code points before content matching and to watch for bulk weekday spikes from churning finance-themed domains.

The Register · SecuritySep 4, 19:23 UTC · 12d agoPhishing & fraud in the wild1

Chinese Hackers Use AI Agents in Multi

China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.

Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.

Security AffairsSep 4, 11:00 UTC · 12d agoThreat actor in the wild

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security BlogSep 3, 16:00 UTC · 13d agoPhishing & fraud in the wild1

[AINews] Muse Spark 1.3 matches GPT-5.6-Sol, confirming Meta Superintelligence as the newest Frontier Lab, >90% discount for training

Meta's Muse Spark 1.3 reportedly ranks as the world's #3 model, matching frontier models from OpenAI and Anthropic with planned open weights.

The Latent Space AI News roundup leads with Muse Spark 1.3, promised in Zuckerberg's letter, which ranks #3 worldwide per AAII, is slated for open weights, and uses a pricing model over 90% cheaper when users opt in to training. The issue also covers the rumored Gemini 3.8 Flash launch and analysis arguing OpenAI's rumored looped-transformer 'Astra' architecture is a modest tweak rather than a breakthrough. Additional coverage includes ByteDance Seed's HarnessDev harness-evaluation benchmark, a retrieval-invoked actual-use evaluation method, Stanford's revamped agent engineering curricula, and Photon 2.1 adding TTS models and NVIDIA B200 support.

Latent SpaceSep 3, 04:38 UTC · 13d agoModel release1

PaperCut NG/MF vulnerabilities exploited in zero-day attacks

PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.

PaperCut Software confirmed attackers are chaining two vulnerabilities in PaperCut NG and MF: CVE-2026-81578, an improper access control flaw in the web management interface allowing unauthenticated configuration changes, and CVE-2026-82078, unsafe dynamic class loading in database connection utilities enabling arbitrary Java bytecode execution. Huntress reproduced a pre-authentication remote configuration takeover and full RCE chain against PaperCut NG 25.0.11.75758 and observed limited exploitation at two customers, including post-exploitation whoami and ver commands. The vendor released Emergency Patch Release 2 with additional hardening and urged restricting Application Server web access to trusted IPs. In 2023, Clop and LockBit affiliates abused CVE-2023-27350 and CVE-2023-27351 in the same software.

Help Net SecurityAug 31, 14:39 UTC · 16d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-82078 CVE-2023-27350+1 CVEs1

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker NewsAug 31, 09:04 UTC · 16d agoThreat actor in the wild1

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.

The Hacker NewsAug 27, 15:16 UTC · 20d agoVulnerability CVE-2026-75604

[AINews] Hot Chips: OpenAI’s Jalapeño, Cerebras CS-5, Groq 3 LPX, Apple M6

OpenAI unveiled Jalapeno custom inference chip claiming 1.5-1.9x better perf-per-watt than NVIDIA GB200/GB300, deploying in-house by year-end.

At the 37th Hot Chips conference, OpenAI published first benchmark details for its custom Jalapeno inference chip, claiming 1.5-1.9x more work per watt, 1.7-3.6x lower end-to-end latency, and 2.1-4.1x higher interactive-workload performance versus NVIDIA GB200/GB300, with the 700W-rated part staying at or below 550W in tests. Deployment into OpenAI's own infrastructure begins by year-end, with Gen 2 deep in development and Gen 3 underway. OpenAI also said GPT-Astra and Codex helped write low-level kernels, reportedly 1.5-1.8x faster than human-expert code for selected attention and MoE blocks. Cerebras CS-5, Groq 3 LPX and Apple M6 were also featured at the conference.

Latent SpaceAug 27, 01:31 UTC · 21d agoAI industry

Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk

QUIRSO attributes exploitation of VMware vCenter CVE-2026-59310 to a suspected China-nexus actor that hit 361 IPs in 47 countries, deploying backdoors and Babuk.

German incident response firm QUIRSOS assessed with moderate confidence that a suspected China-nexus actor, likely operating in UTC+08:00 hours, exploited VMware vCenter flaw CVE-2026-59310 (CVSS 9.8 directory traversal) beginning five days after Broadcom's July 29 patch. The campaign compromised 361 unique victim IPs across 47 countries, most in Germany, the US, Turkey, Iran, and France. The actor abused cron jobs, a XOR-obfuscated 'linuxFile' WebSocket backdoor with systemd/cron persistence, a JSP web shell, SSH authorized-keys manipulation, and a reverse SSH tool, with one Babuk deployment reported. A separate vCenter 'vcenter_admin' account creation consistent with CVE-2026-59309 exploitation was also observed from August 1.

The Hacker NewsAug 17, 16:59 UTC · Aug 17, 2026Threat actor in the wildCVE-2026-59310 CVE-2026-593091

Threat Brief: Atlassian Confluence Remote Code Execution Vulnerability (CVE-2022

Unauthenticated Confluence RCE CVE-2022-26134 was exploited in the wild; Volexity observed intrusions and Cerber ransomware on unpatched servers.

Volexity identified exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence Server and Data Center, during Memorial Day weekend 2022, with Atlassian issuing a patch. Cortex Xpanse found 19,707 potentially affected Confluence instances, concentrated in the US, Germany, China, and Russia, plus 1,251 end-of-life versions exposed. Unit 42 and Cortex Managed Threat Hunting observed successful exploitation leading to reconnaissance commands and a Cerber ransomware deployment that was blocked by Cortex XDR. A public PoC has increased exploitation risk.

Palo Alto Unit 42Aug 17, 12:19 UTC · Aug 17, 2026Exploit / PoC in the wildCVE-2022-26134

New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure

Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.

Acronis TRU described an ongoing Pakistan-aligned campaign attributed with moderate confidence to APT36, delivering a previously undocumented C/C++ backdoor named PATCHCORD via fake VPN installers impersonating Afghan Telecom (AFTEL) and telecom management tools. PATCHCORD persists by hijacking browser shortcuts for Chrome, Edge, and Firefox, registers with a single C2 server, and executes shellcode and arbitrary cmd.exe commands. Infrastructure analysis revealed SHEETCORD, a Go backdoor combining SHEETCREEP and PATCHCORD features that uses Google Sheets for C2 and a PowerShell-based remote execution, delivered via a fake site mimicking India's National Informatics Center. APT36 has used PATCHCORD since at least March 2026, including a variant with anti-analysis features used against India's energy sector, and the toolkit includes antnium, GateSentinel, SuperShell, and exploits for CVE-2024-6387.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wildCVE-2024-6387

Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.

CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.

The Hacker NewsAug 12, 13:45 UTC · Aug 12, 2026Threat actor1

Nearly 800 Malicious npm Packages Deliver Cross

Nearly 800 typo-squatted npm packages deliver WEL1DROPPER, a cross-platform downloader installing RAT and infostealer payloads on Windows, macOS, Linux.

Researchers found roughly 800 npm packages with AI-generated typo-squat names that trigger a WEL1DROPPER downloader when loaded via require() rather than install hooks. The downloader fetches payloads from Cloudflare Workers hosts, falling back to DNS TXT records from wel1.ru, then achieves persistence, sandbox checks, ETW/AMSI patching and Sliver C2 deployment on Linux. Domains like tcsbank.ru suggest targeting of Russian financial institutions; Sonatype tracks the campaign as Flooding Dropper, a possible evolution of the Moika dependency-confusion campaign. Unit 42 separately documented npm/PyPI crypto stealers and malicious Chrome extensions that turn browsers into residential proxy crawlers.

The Hacker NewsAug 11, 14:37 UTC · Aug 11, 2026Malware in the wild