clipboard stealer, wallet drainer
credential/clipboardexfiltration/sensitive-data
Fallout in firefox, Aug 24 – Aug 30
What we caught this week while monitoring over 166,903,936 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 30 · 1 catch · 0 waves · 1 singleSATURDAY
Sat Aug 29 · 1 catch · 0 waves · 1 singleExfiltrates credentials to Telegram and external server
channel/messaging
FRIDAY
Fri Aug 28 · 1 catch · 0 waves · 1 singleCredential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
THURSDAY
Thu Aug 27 · 2 catches · 0 waves · 2 singlesCredential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
Credential exfiltration, broad permissions, obfuscation
trojanized/packageexfiltration/sensitive-data
WEDNESDAY
Wed Aug 26 · 3 catches · 0 waves · 3 singlesCredential theft, evasion, broad access
hidden-payload/evaltrojanized/package
Credential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
Native host, PowerShell bypass, credential exfil
hidden-payload/evaltrojanized/package
MONDAY
Mon Aug 24 · 1 catch · 0 waves · 1 singleO objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories