OOB exfiltration of system info
host-profile/httphost-profile/victim
Fallout, Aug 24 – Aug 30
What we caught this week while monitoring over 163,107,774 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 30 · 18 catches · 0 waves · 11 singlesSMM view-bot automation tool
security-bypass/anti-botchannel/messaging
DLL injection dependency
scripts/hook-fileexecution/windows-loader
Malicious region-gated audio injection
supply-chain/sweetalert2-protestwaremanipulation/browser
clipboard stealer, wallet drainer
credential/clipboardexfiltration/sensitive-data
Encrypted strings, SOCKS proxy, process execution
sandbox-detect/suiteproxy/socks
Region-gated UI suppression and audio loop
manipulation/browsersupply-chain/sweetalert2-protestware
Obfuscated backdoor with C2 and self-update
backdoor/whalenttrojanized/package
Remote AI CLI control backdoor
dispatch/websocketservice/systemd
AI CLI remote-control backdoor
disk/mass-deletedispatch/websocket
Obfuscated Lua payload in wiki
code-metrics/structure
SATURDAY
Sat Aug 29 · 23 catches · 1 wave · 14 singlesDiscord webhook exfiltration
loader/stagebrowser/loot
bbfcb5de02ef…
and 2 siblings
Downloads and executes remote payloads
delivery/fetch-execindicator-removal/cleanup
Exfiltrates credentials to Telegram and external server
channel/messaging
Obfuscated credential theft and persistence
hidden-payload/runtimeobfuscator/js-obfuscator
Spawns detached Node with decrypted payload
library/sourcehidden-payload/runtime
preinstall exfiltrates system info
oast/host-profileimpersonation/depconf
Backdoor detection and data exfiltration
Generic/Callbackwebshell/self-label
Bundles protestware payload
manipulation/browserunwanted/sweetalert2-protestware
Obfuscated Lua payload in Go module
code-metrics/structurehidden-payload/exec
Obfuscated Lua payload, nested archives, masquerading LuaJIT dropper
hidden-payload/execcode-metrics/structure
FRIDAY
Fri Aug 28 · 30 catches · 0 waves · 16 singlespreinstall exfiltrates system info
dns/encodedscripts/local-script
Credential theft, obfuscated payload, C2
exploit/sandbox-escapeinstall-hook/node-gyp
Phishing page exfiltrates credentials
phishing/mfa-relayphishing/credential
binding.gyp executes OS command
exploit/sandbox-escapehidden-payload/eval
binding.gyp executes OS command
exploit/sandbox-escapehidden-payload/eval
Credential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
Fake VPN proxy farm
network/proxysupply-chain/fake-vpn-extension-farm
Bundled SweetAlert2 contains region-gated audio/pointer-events sabotage
manipulation/browsersupply-chain/sweetalert2-protestware
Base64 command execution, log deletion
remote-command/controlindicator-removal/application-logs
Exfiltrates files to Telegram C2.
messaging/telegramchannel/messaging
Bundled protestware disables browser
manipulation/browserunwanted/sweetalert2-protestware
Exfiltrates files via hardcoded Telegram bot
messaging/telegramchannel/messaging
Bundled protestware disables UI, plays audio
manipulation/browserunwanted/sweetalert2-protestware
THURSDAY
Thu Aug 27 · 35 catches · 1 wave · 15 singlesTrojanized npm phishing facade
trojanized/packagemanifest/facade
Obfuscated crypto-stealer payload
blockchain/ethereumdelivery/blockchain
obfuscated dynamic import, fake error exit
anti-analysis/self-terminatehidden-payload/runtime
Credential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
Malicious region-gated audio payload
supply-chain/sweetalert2-protestwaremanipulation/browser
Malicious code in SweetAlert2 library
unwanted/sweetalert2-protestwaremanipulation/browser
Credential exfiltration, broad permissions, obfuscation
trojanized/packageexfiltration/sensitive-data
AV evasion, UAC bypass, persistence
hosts-file/block-securityuac-bypass/com
C2 framework with obfuscated Lua payloads
code-metrics/structurehidden-payload/exec
obfuscated remote-updating agent backdoor
backdoor/whalentremote-command/control
Bundled ransomware in SweetAlert2
supply-chain/sweetalert2-protestwaremanipulation/browser
postinstall beacon exfiltrates hostname
package/manifestmanifest/skeleton
WEDNESDAY
Wed Aug 26 · 218 catches · 5 waves · 19 singlesDownloads and executes raw IP payloads
delivery/download-execute
Credential theft, evasion, broad access
hidden-payload/evaltrojanized/package
WhatsApp spam automation tool
extensions/affiliatelibrary/framework
Credential theft, excessive permissions, obfuscation
hidden-payload/evaltrojanized/package
Invoice.js
and 5 siblings
Obfuscated PowerShell dropper with persistence
obfuscation/syntaxscript/wsh
PO-ADT26_0076.JS
and 4 siblings
Obfuscated WSH dropper writes payload
activex/comobfuscation/multi-layer
PO-000191 Shipment Swift.JS
and 4 siblings
Obfuscated WSH dropper writes payload
activex/comobfuscation/multi-layer
RQF1025133.vbs
and 2 siblings
Obfuscated VBScript dropper with C2
execution/wshenvironment-detect/wsh
Ransomware binary with attack functions
linux/generic_threatname-mangling/type-names
Native host, PowerShell bypass, credential exfil
hidden-payload/evaltrojanized/package
obfuscated payload execution in dependency
Obfuscated backdoor with C2 and self-update
backdoor/whalentremote-command/control
malicious htmlescape dependency
XSS injection in htmlescape dependency
SQLi toolkit with embedded exploit payloads
eval/remoteexploit/sql-injection
Bundled protestware disables browser
manipulation/browserunwanted/sweetalert2-protestware
C2 URL in package definition
infrastructure/ip-url-phpexecutable/header
Dependency clay-server classified hostile
TUESDAY
Tue Aug 25 · 117 catches · 1 wave · 29 singlesDownloads and executes raw IP payloads
delivery/download-execute
Bundled protestware disables browser
unwanted/sweetalert2-protestwaremanipulation/browser
Embedded offensive security tooling
Portproxy/CommandMimikatz/Strings
Cybersecurity tool with offensive capabilities
SUSPICIOUS/UsndeletejournalCAPE/Eternalromance
postinstall curl-pipe-shell dropper
dropper/download-executedropper/pipe-execute
NPM install hook credential stealer
credential-theft/packagecredential/browser
C2 beacon and reverse shell generator
reverse-shell/ptyreverse-shell/dup
Keylogger, screen capture, C2, exfiltration
channel/messagingmessaging/telegram
Hostile dependency embedded in archive
sweetalert2 protestware embedded
Telegram-controlled remote desktop malware
channel/messagingmessaging/telegram
Conversios – GA4, Google …eed for WooCommerce 7.2.24
wordpress
enhanced-e-commerce-for-woocommerce-store
Malicious code in SweetAlert2
manipulation/browsersupply-chain/sweetalert2-protestware
Trojanized dependency with malicious install hooks
credential-theft/envlibrary/source
Browser cookie credential extraction
obfuscated C2, credential theft, persistence
execution/network-stagefiles/included
obfuscated eval payload, anti-analysis
obfuscation/multi-layerpayload/encoded
Contains shellcode execution templates
eval/powershell-loadercompile/runtime
Bundled region-gated protestware payload
unwanted/sweetalert2-protestwaremanipulation/browser
Remote code execution in sandbox
hidden-payload/runtimedelivery/fetch-eval
XSS injection in htmlescape dependency
hidden PowerShell, persistence, process injection
script/wshdropper/node-bootstrap
Embedded malicious dependency
HTTP desync probe in dependency
Undisclosed adware, IP-based C2
http/transportnetwork/http
MONDAY
Mon Aug 24 · 138 catches · 7 waves · 28 singlesHostile dependency: credential exfiltration
HTTP desync probe in dependency
Hostile dependency NuGet.exe embedded
embedded reverse shell in dependency
Relays Facebook credentials to third-party server
theft/harvested-storecredential-theft/package
Credential stealer with install hook
credential-theft/packagecredential/browser
Exfiltrates WhatsApp session credentials
messaging/whatsappdestroy/browser-storage
DNS exfiltration in preinstall hook
fingerprint/hardware
credential theft via remote relay
theft/harvested-storecredential-theft/package
Bundled protestware payload
manipulation/browserunwanted/sweetalert2-protestware
Test file contains webshell payload
PHP/Gzinflatedwebshell/decoder
obfuscated wasm payload, typosquatting
debugger-detect/checkstring/array
emp3r0r C2 framework with RAT, BOF, and evasion
rat/emp3r0rexecution/loader
Typosquatting with hidden payload
hidden-payload/packageimpersonation/brand
Install hooks exfiltrate system data
scripts/lifecyclepackage/scoring
Signed malware with C2 and evasion
Deepdata/Autoemulator-detect/hardware
Signed malware with C2 and injection
malicious dependency htmlescape
Bundled protestware disables browser
unwanted/sweetalert2-protestwaremanipulation/browser
EtherHiding malware in disguised font file
delivery/blockchaininstall-hook/tasks
Malicious crypto drainer payload
delivery/blockchaintrigger/ide
Malicious VSCode autorun executes hidden payload
payload/encodeddelivery/blockchain
Bundled protestware disables browser
manipulation/browserunwanted/sweetalert2-protestware
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories