DLL injection dependency
scripts/hook-fileexecution/windows-loader
Fallout in go, Aug 24 – Aug 30
What we caught this week while monitoring over 163,363,865 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 30 · 2 catches · 0 waves · 2 singlesObfuscated Lua payload in wiki
code-metrics/structure
SATURDAY
Sat Aug 29 · 2 catches · 0 waves · 2 singlesObfuscated Lua payload in Go module
code-metrics/structurehidden-payload/exec
Obfuscated Lua payload, nested archives, masquerading LuaJIT dropper
hidden-payload/execcode-metrics/structure
FRIDAY
Fri Aug 28 · 1 catch · 0 waves · 1 singleTHURSDAY
Thu Aug 27 · 1 catch · 0 waves · 1 singleC2 framework with obfuscated Lua payloads
code-metrics/structurehidden-payload/exec
WEDNESDAY
Wed Aug 26 · 2 catches · 0 waves · 2 singlesmalicious htmlescape dependency
C2 URL in package definition
infrastructure/ip-url-phpexecutable/header
TUESDAY
Tue Aug 25 · 11 catches · 0 waves · 3 singlesNPM install hook credential stealer
credential-theft/packagecredential/browser
C2 beacon and reverse shell generator
reverse-shell/ptyreverse-shell/dup
MONDAY
Mon Aug 24 · 4 catches · 0 waves · 3 singlesTest file contains webshell payload
PHP/Gzinflatedwebshell/decoder
emp3r0r C2 framework with RAT, BOF, and evasion
rat/emp3r0rexecution/loader
malicious dependency htmlescape
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories