Bundled high-entropy binary payload
binary/dos
Fallout in javascript, Sep 21 – Sep 27
What we caught this week while monitoring over 181,645,109 artifacts across 51 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
YESTERDAY
Sun Sep 27 · 39 catches · 1 wave · 3 singlesHidden PowerShell, VBS, and registry persistence
execution/wshvbscript/interpreter
Installs MITM root CA, intercepts traffic
create/hiddenrequest/credentials
SATURDAY
Sat Sep 26 · 43 catches · 0 waves · 3 singlesTyposquatting, high release velocity, binary payload
binary/dos
Trojanized dependency rewrites host code
delivery/fetch-evalmanipulation/social
Dependency classified hostile, credential access
High-entropy binary, rapid release churn
binary/dos
FRIDAY
Fri Sep 25 · 35 catches · 0 waves · 3 singlesHigh-entropy binary, rapid releases, typosquatting
binary/dos
Credential harvesting and persistence
execution/filelesscredential-theft/registry
Typosquatting, evasion, preinstall hook
manipulation/sociallibrary/fork-branding
THURSDAY
Thu Sep 24 · 58 catches · 0 waves · 3 singlesHigh-entropy binary, rapid release churn
binary/dos
Embedded credential theft rules
EXE/Discordurldelivery/wmi
AgentTesla infostealer payload detected
backdoor/capturestaging/memory
Windows persistence and credential targeting
dropper/node-bootstrapscripts/dynamic-install
WEDNESDAY
Wed Sep 23 · 42 catches · 2 waves · 3 singlesTyposquatting, high release rate, binary payload
binary/dos
High-entropy binary, rapid release churn
binary/dos
Steals AI credentials, executes remote code
execution/filelessexploit/http-command-injection
TUESDAY
Tue Sep 22 · 37 catches · 1 wave · 3 singlesRemote-controlled newsletter auto-follow, obfuscated strings, install hook
manipulation/socialinstall-hook/hook-only
High-entropy binary, rapid release churn
binary/dos
Hostile dependency included
Credential theft and obfuscation
credential/dev-filerequest/credentials
MONDAY
Mon Sep 21 · 25 catches · 2 waves · 3 singlesBundled high-entropy binary payload
binary/dos
Process injection and code patching
injection/dllinjection/memory
High-entropy binary, rapid release churn
binary/dos
Embedded malicious payload strings
disk/mass-deletedelivery/execute-download
preinstall reverse shell C2
scripts/remote-fetchreverse-shell/dev-tcp
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories