Typosquatting, HTTP deps, fake author
package/direct-urldependencies/direct-url
Fallout, Aug 31 – Sep 6
What we caught this week while monitoring over 163,052,840 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Sep 6 · 777 catches · 62 waves · 22 singlesHardcoded Telegram C2 exfiltration
channel/messagingmessaging/telegram
Downloads and executes hidden PowerShell payload
OR/Downloadinstruction/junk-insertion
Remote control, persistence, credential access
Process injection APIs present
payload/encryptedtiming/evasion
Process injection and evasion APIs
injection/debugger-loaderinfrastructure/ip-port
Credential theft, broad permissions, evasion
monitor/watchmanipulation/core
Embedded credential exfiltration payloads
recon-exfil/pipelinesecrets/source-control
cookie exfil, credential harvesting, autonomous agent
Dec21/SoftOR/Download
Obfuscated self-deleting Ethereum C2 dropper
delivery/blockchainobfuscator/js-obfuscator
Obfuscated crypto miner in font file
masquerade/extension-mismatchdelivery/blockchain
Disables competing proxy extensions
degrade/extension
Agent traffic interception and credential theft
Downloads and executes remote binaries
dns/tunnelinglibrary/source
OOB exfiltration via preinstall hook
scripts/lifecyclepackage/scoring
OOB beacon, fake version, preinstall
package/scoringscripts/lifecycle
Downloads and executes remote payload
dns/tunnelinglibrary/source
Clipboard exfiltration, screen capture, input injection
clipboard/monitorscreenshot/capture
Exfiltrates credentials to OOB server
scripts/lifecyclepackage/scoring
Exfiltrates credentials to OOB server
package/scoringscripts/lifecycle
OOB exfiltration and install hooks
package/scoringbuild/behavioral
Exfiltrates system data to OOB
package/scoringscripts/lifecycle
Exfiltrates environment variables to OOB
package/scoringscripts/lifecycle
Exfiltrates system data via webhook
package/manifestoob/oast
Exfiltrates environment variables to OOB
scripts/lifecyclepackage/scoring
postinstall downloads and executes remote code
delivery/download-executescripts/dynamic-install
OOB exfil, fake version, install hooks
package/manifestbuild/behavioral
Exfiltrates env data via webhook
scripts/lifecyclepackage/scoring
Exfiltrates host info to webhook.site
scripts/lifecycleoob/oast
Exfiltrates credentials to OOB server
scripts/lifecyclepackage/scoring
Downloads and executes remote payload
dns/tunnelinglibrary/source
Exfiltrates system info to OOB
scripts/lifecycleoast/secret
Exfiltrates secrets via install hook
scripts/lifecyclequality/version-sentinel
preinstall exfiltrates system info
build/behavioralregistry/lifecycle
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Preinstall exfiltrates system info
scripts/lifecycleoast/host-profile
Preinstall exfiltrates system info
build/behavioralscripts/lifecycle
Remote agent, persistence, bypass permissions
dispatch/websockethidden-payload/native-extension
Downloads and executes remote payload
library/sourcedns/tunneling
Downloads and executes remote binary
library/sourcedns/tunneling
Exfiltrates environment variables to OOB
scripts/lifecycleoob/oast
Exfiltrates system info to OOB
package/scoringpackage/manifest
SSH key exfiltration, C2 beacon
ssh/keyscripts/postinstall
Downloads and executes remote binary
dns/tunnelinglibrary/source
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
Exfiltrates system data via OOB
fingerprint/hardwarehttp/upload
Full-screen ad overlay injection
manipulation/coreui/delivery
Exfiltrates system info to OOB
package/manifestoob/oast
Trojanized package with malicious dependency
impersonation/npm-clonelibrary/hidden-dep
Trojanized dependency with hidden loader
library/hidden-depimpersonation/npm-clone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
TikTok scraper with C2 and evasion
trojanized/package
Exfiltrates Discord tokens to webhook
scripts/dynamic-installcredential/multi-source
Discord token stealer
credential/discorddiscord/token
Bytecode obfuscation, CDP, shell exec
control/hvncobfuscation/syntax
TikTok scraper with C2 and evasion
trojanized/package
Remote code execution via eval
infrastructure/pastetrigger/activation
Game cheat with process injection
script/wshdelivery/download-execute
Game cheat with process injection
script/wshinjection/dll
Exfiltrates system info via install hooks
scripts/lifecyclebuild/behavioral
Bundled RedShell backdoor binary
fileless/memoryhttp/archive
EtherHiding crypto drainer payload
obfuscator/js-obfuscatorpayload/encoded
Remote code execution via base64
supply-chain/property-demoinfrastructure/paste
Exfiltrates SSH keys, env, Telegram data
stealer/trader-traitor
Obfuscated credential stealer
stealer/workflowdropper/standalone
AI agent remote control tool
dispatch/websockethidden-payload/native-extension
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Remote code execution, C2, obfuscation
infrastructure/pasteeval/require
preinstall downloads and executes remote code
dropper/download-executebuild/behavioral
Obfuscated malware in preinstall hook
dropper/obfuscationJS/Obfuscatorio
Exfiltrates system info via install hooks
scripts/lifecyclebuild/behavioral
Obfuscated session wipe and data exfil
destroy/file-deletion
Russian propaganda audio injection
manipulation/browser
SATURDAY
Sat Sep 5 · 37 catches · 0 waves · 16 singlesRemote AI agent control binary
dispatch/websockethidden-payload/native-extension
Obfuscated Lua dropper in archive
code-metrics/structurehidden-payload/exec
Remote AI CLI control agent
dispatch/websockethidden-payload/native-extension
Fake GitHub domain impersonates AWS ECS Agent
http/upload
Obfuscated dropper with anti-analysis
code-metrics/structureexecution/build
Browser hijacker, data exfiltration
activity/browser
RDP enable, sudoers NOPASSWD, masquerade, evasive base64
Powershell/Webdownloadcontrol/rdp
AD pentest framework, credential dumping
Impacket/impacketexploit/vulnerabilities
Malicious SweetAlert2 payload
manipulation/browsersupply-chain/sweetalert2-protestware
obfuscated self-updating backdoor agent
backdoor/whalenttrojanized/package
Steals Twitter auth tokens
http/browser-extension
Harvests marketplace session cookies
extensions/session
FRIDAY
Fri Sep 4 · 6203 catches · 470 waves · 17 singlesDownloads and executes remote binaries
library/sourcedns/tunneling
config.php contains webshell eval
webshell/decoderPHP/Gzinflated
Exfiltrates wallet private keys
wallet/solana
postinstall exfiltrates to webhook.site
install-hook/hook-only
Downloads and executes remote binaries
library/sourcedns/tunneling
Downloads and executes remote payloads
library/sourcedns/tunneling
Malicious ad injection and self-update
manipulation/coreui/delivery
Obfuscated credential-stealing preinstall hook
supply-chain/shai-huludhidden-payload/git-deaddrop
Exfiltrates system info to hardcoded IP
manifest/attack-labelpackage/manifest
Exfiltrates system data to OOB domain
http/uploaddns/tunnel
Exfiltrates system data to C2
stealer/trader-traitor
Trojanized package with obfuscated code
hidden-payload/evalForeignobject/Nov24
Downloads and executes remote binaries
dns/tunnelinglibrary/source
Preinstall exfiltrates system info to OOB
build/behavioralscripts/lifecycle
Downloads and executes remote binary
library/sourcedns/tunneling
DNS exfil, payload download, execution
dns/tunnelinglibrary/source
Downloads and executes remote binary
library/sourcedns/tunneling
Dropper downloads and executes Bun runtime
theft/multi-storedropper/standalone
Credential stealer with persistence and exfiltration
http/uploadstealer/workflow
Downloads and executes remote binaries
library/sourcedns/tunneling
Obfuscated credential-stealing preinstall payload
supply-chain/shai-huluddropper/bun
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstraptheft/multi-store
Exfiltrates system info via install hooks
registry/lifecyclescripts/postinstall
postinstall exfiltrates logs to OAST
recon-exfil/install-hook
Remote code execution via C2
infrastructure/pastedelivery/fetch-eval
C2, reverse shell, data exfiltration
reverse-shell/dupshell/spawn
Malicious backdoor with C2 and reverse shell
host-profile/socketreverse-shell/dup
Remote code execution via eval
delivery/fetch-evalinfrastructure/paste
DNS exfil, binary download, execution
dns/tunnelinglibrary/source
Remote agent bypasses permissions
dispatch/websockethidden-payload/native-extension
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
Self-referential dependency, remote code execution
scripts/dynamic-installinstall-hook/remote-binary
Downloads and executes remote payload
library/sourcedns/tunneling
preinstall exfiltrates system data
recon-exfil/install-hookhttp/report
Obfuscated malware with credential theft
supply-chain/shai-huludhidden-payload/git-deaddrop
Malicious dependency exfiltrates data
http/uploadscripts/lifecycle
Exfiltrates system info via install hooks
package/manifestmanifest/attack-label
Exfiltrates secrets via install hook
scripts/lifecyclequality/version-sentinel
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Exfiltrates AWS credentials via OOB
manifest/attack-labelscripts/lifecycle
Downloads and executes remote payload
library/sourcedns/tunneling
npm postinstall credential harvester
theft/multi-storelibrary/module-init
Preinstall hook exfiltrates system info
build/behavioralscripts/lifecycle
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
preinstall exfiltrates host identity via OOB
impersonation/depconfpackage/direct-url
preinstall exfiltrates host data via OOB
impersonation/depconfpackage/direct-url
Dropper downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Browser credential and wallet stealer
theft/multi-storelibrary/module-init
Credential theft and email harvesting
scan/utilityhost/software
Malicious C2 and privilege escalation
recon-exfil/npm-install-targetingscript/dropper
Malicious install hook executes hidden PowerShell
dropper/targeted
Malicious install hook executes payload
dropper/targeted
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Downloads and executes remote binary
dns/tunnelinglibrary/source
Exfiltrates email via postinstall
recon-exfil/npm-install-targetingpackage/manifest
postinstall executes remote code
delivery/fetch-evaldropper/runtime
UAC bypass, C2 beacon, data exfil
library/frameworkscript/embedded
Exfiltrates system data to hardcoded IP
quality/version-sentinelscripts/lifecycle
Obfuscated C2 beaconing to malicious domain
recon-exfil/dnsobfuscation/imports
preinstall executes remote code
delivery/fetch-eval
Downloads and executes remote payload
dns/tunnelinglibrary/source
Exfiltrates system data to OOB
oob/endpointoob/oast
Typosquat of big.js with trojanized security-hold dependency
impersonation/npm-clonelibrary/hidden-dep
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Downloads and executes remote binary
library/sourcedns/tunneling
Steals wallets, history, exfiltrates data
credential/multi-sourcestealer/workflow
Exfiltrates secrets to hardcoded IP
infrastructure/ip-portcredential-theft/env
Game cheat with process injection
script/wshdelivery/download-execute
Game cheat with process injection
script/wshdelivery/download-execute
Preinstall exfiltrates system info
scripts/lifecycleoast/env
Remote code execution via postinstall
supply-chain/property-demotrigger/activation
Base64 obfuscated malicious install command
scripts/dynamic-installdelivery/download-execute
Exfiltrates system info to webhook.site
oob/oastpackage/manifest
SSH key injection, data exfiltration
stealer/trader-traitorstealer/system-info
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
preinstall hook executes arbitrary code
package/manifestautoinstall/package
Preinstall hook executes remote code
delivery/fetch-evalhidden-payload/eval
Dynamic code execution, C2 IP
credential-theft/packageeval/require
SSH key injection, data exfiltration
stealer/trader-traitor
Exfiltrates system info to hardcoded IP
recon-exfil/install-hookpackage/manifest
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Exfiltrates environment via preinstall
package/manifestbuild/behavioral
Exfiltrates sensitive data to remote server
credential/multi-sourcestealer/workflow
Trojanized dependency with hidden loader
impersonation/npm-clonelibrary/hidden-dep
Exfiltrates secrets via Telegram
scripts/hook-filepackage/manifest
Credential stealer and dropper
dropper/standaloneapi-harvest/token
Exfiltrates system info to OOB
scripts/lifecyclehost-profile/victim
Exfiltrates credentials, executes remote commands
host-profile/victimstealer/system-info
postinstall exfiltrates environment data
package/manifestmanifest/attack-label
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
DNS exfil, binary download, execution
library/sourcedns/tunneling
Exfiltrates system info via DNS
package/manifestrecon-exfil/install-hook
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
Exfiltrates system info via preinstall
scripts/lifecyclebuild/behavioral
preinstall hook exfiltrates system info
oob/oastscripts/lifecycle
Exfiltrates system data to OOB
package/manifestlibrary/framework
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
Downloads and executes remote payload
execution/stealth-spawn
Exfiltrates system data to C2
install-hook/hook-onlypackage/manifest
Exfiltrates secrets via preinstall hook
credential/envcredential-theft/package
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Exfiltrates system credentials and files
stealer/filehidden-payload/exec
Remote code execution via eval
delivery/fetch-evalstealer/beaver-tail
Exfiltrates system credentials and data
stealer/filehidden-payload/exec
preinstall exfiltrates .env to Telegram
manifest/attack-labelpackage/manifest
DNS C2, payload download, execution
library/sourcedns/tunneling
Token harvester, exfiltrates secrets
theft/multi-storelibrary/module-init
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Obfuscated dropper executes downloaded payload
dropper/standalonetheft/multi-store
Exfiltrates files via webhook.site
scripts/lifecyclepackage/direct-url
Credential theft and exfiltration malware
credential/httphttp/upload
Base64 obfuscated malicious install command
scripts/dynamic-installdelivery/download-execute
Exfiltrates secrets to webhook.site, spawns detached scripts, republishes packages
Compromise/Sep25credential/multi-source
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Remote code execution and persistence
tasking/http-command
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
wallet-utils-pro 1.0.0
and 2 siblings
Steals crypto wallet secrets, exfiltrates to C2
wallet/extension
Embedded agent installer with persistence
Credential and AI-config exfiltration indicators
impersonation/core-module
Fake VPN, known malicious relay domains
supply-chain/fake-vpn-extension-farmnetwork/proxy
Obfuscated font file executes C2
delivery/blockchaintrigger/ide
Exfiltrates secrets via postinstall hook
oob/endpointexfiltration/sensitive-data
Downloads and executes remote binary
execution/native-binarydns/tunneling
preinstall exfiltrates system info
scripts/lifecycleexfiltration/file-upload
Exfiltrates credentials, deploys malware
recon-exfil/pipelinecredential/env
Obfuscated credential stealer and dropper
dropper/standalonestealer/workflow
Downloads and executes remote payload
library/sourcedns/tunneling
Dependency confusion exfiltration POC
package/manifestmanifest/attack-label
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
Obfuscated payload, preinstall downloads/executes Bun
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Dropper downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall runtime download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Downloads and executes hidden Bun runtime
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, Bun dropper, preinstall
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
install-hook/bun-bootstraptheft/multi-store
Preinstall drops obfuscated credential-stealing payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated dropper downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall downloads/executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, downloads and executes Bun runtime
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
Obfuscated credential theft during install
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun download
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall runtime download
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
Obfuscated payload, preinstall Bun dropper
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall downloads/executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall runtime download
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, preinstall runtime download
install-hook/bun-bootstrapdropper/standalone
Downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Credential stealer and C2 exfiltration
dropper/standalonestealer/workflow
postinstall drops and runs encoded stealer
credential/browserwallet/desktop
Credential stealer with obfuscation
api-harvest/tokendropper/standalone
Obfuscated payload, preinstall Bun dropper
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Preinstall downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Obfuscated payload, runtime download, preinstall hook
theft/multi-storeinstall-hook/bun-bootstrap
Obfuscated dropper executes hidden payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated payload, preinstall hook, C2
theft/multi-storeinstall-hook/bun-bootstrap
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstraptheft/multi-store
preinstall downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
package/direct-urltheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated preinstall credential stealer
supply-chain/shai-huluddropper/bun
Obfuscated payload, preinstall hook, C2
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall Bun dropper
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes remote payload
dns/tunnelingdelivery/execute-download
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated payload, preinstall hook, C2
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated payload, preinstall hook, runtime download
dropper/standalonetheft/multi-store
Obfuscated payload, downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper spawns hidden child process
delivery/fetch-evaleval/loader
Remote code execution via axios
hidden-payload/evalaes/runtime-library
preinstall hook executes obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
Remote code execution via axios
supply-chain/property-demodelivery/fetch-eval
Steals credentials, exfiltrates via Telegram
scripts/hook-filesecrets/wallet
OOB exfiltration, dependency confusion POC
oob/oastpackage/manifest
Obfuscated hidden payload execution
eval/requirehidden-payload/encoding
Downloads and executes remote binaries
dns/tunnelinglibrary/source
Obfuscated remote code execution
impersonation/clone-and-rename
preinstall executes hidden ELF binary
trigger/agentdropper/native-loader
postinstall exfiltrates host recon to remote server
install-hook/hook-onlyscripts/hook-file
Obfuscated preinstall dropper spawning payload
dropper/setup-hook
Disables TLS, downloads from raw IP
dropper/native-loaderdelivery/fetch-eval
EtherHiding malware payload
obfuscator/js-obfuscatordelivery/blockchain
preinstall executes obfuscated malicious code
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall executes obfuscated malicious payload
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall hook, obfuscated credential theft
hidden-payload/git-deaddropdropper/bun
preinstall hook executes obfuscated payload
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
package/direct-urlsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
obfuscated credential-stealing malware
supply-chain/shai-huluddropper/bun
preinstall hook runs obfuscated payload
supply-chain/shai-huludhidden-payload/git-deaddrop
Obfuscated credential stealer in preinstall
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall executes obfuscated malware
dropper/bunsupply-chain/shai-hulud
malicious preinstall script
supply-chain/shai-huluddropper/bun
preinstall hook executes obfuscated payload
supply-chain/shai-huluddropper/bun
preinstall executes obfuscated malicious payload
supply-chain/shai-huludhidden-payload/git-deaddrop
preinstall hook executes obfuscated malware
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
dropper/bunsupply-chain/shai-hulud
Obfuscated preinstall credential stealer
hidden-payload/git-deaddropsupply-chain/shai-hulud
preinstall hook executes obfuscated payload
dropper/bunhidden-payload/git-deaddrop
Obfuscated payload in postcss config
eval/loadereval/dynamic
Downloads and executes obfuscated payload
execution/native-binarylibrary/source
Obfuscated remote code execution
obfuscator/js-obfuscatorForeignobject/Nov24
Obfuscated install script downloads and executes payload
dropper/setup-hook
Obfuscated credential stealer in preinstall
stealer/workflowexploit/container
Obfuscated credential stealer with install hook dropper
stealer/workflowapi-harvest/token
Obfuscated credential stealer
dropper/standalonestealer/workflow
Credential stealer with obfuscation
stealer/workflowapi-harvest/token
Obfuscated credential stealer in preinstall
api-harvest/tokenstealer/workflow
Obfuscated credential stealer payload
stealer/workflowdropper/standalone
Obfuscated credential stealer and dropper
stealer/workflowdropper/standalone
Obfuscated credential stealer in preinstall
stealer/workflowdropper/standalone
Obfuscated credential stealer and dropper
stealer/workflowdropper/standalone
Credential stealer in obfuscated router_init.js
api-harvest/tokendropper/standalone
Obfuscated credential stealer and dropper
dropper/standaloneapi-harvest/token
Obfuscated credential stealer with install hook
exploit/containerstealer/workflow
Obfuscated credential stealer and dropper
stealer/workflowapi-harvest/token
Obfuscated C2 with preinstall hook
backdoor/whalentdropper/obfuscation
Whalent malware, obfuscated C2, self-update
backdoor/whalentdropper/obfuscation
Whalent backdoor, obfuscated C2, self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Malicious persistence and payload execution
hidden-payload/runtimetrojan/eth-dev
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Typosquat of bitcoinjs-lib; postinstall launches hidden bip40 daemon
impersonation/clone-and-renamescripts/hook-file
Obfuscated backdoor with C2 and self-update
backdoor/whalentdropper/obfuscation
Exfiltrates secrets via webhook.site
Compromise/Sep25dropper/bun
Recon, flag theft, exfiltration to hardcoded IP
package/manifestquality/version-sentinel
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Obfuscated C2 beacon in install hook
quality/version-sentinel
Embedded Shai-Hulud malware payload
Compromise/Sep25credential/multi-source
Embedded supply chain malware payload
Compromise/Sep25dropper/bun
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Obfuscated credential theft and C2
hidden-payload/git-deaddropcreate/spawn
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Embedded Shai-Hulud malware payload
Compromise/Sep25install-hook/bun-bootstrap
Credential stealer disguised as Mistral SDK
dropper/standalonestealer/workflow
Obfuscated credential stealer in router_init.js
stealer/workflowapi-harvest/token
Embedded script exfiltrates GitHub secrets to webhook.site
Compromise/Sep25dropper/bun
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated preinstall downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Exfiltrates system info to OOB server
scripts/lifecyclehost-profile/victim
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
Obfuscated dropper downloads and executes Bun
theft/multi-storedropper/standalone
Dropper downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Steals credentials, obfuscated, drops runtime
dropper/standaloneapi-harvest/token
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Credential stealer, obfuscated, self-daemonizing
dropper/standaloneapi-harvest/token
obfuscated dropper downloads and executes payload
theft/multi-storedropper/standalone
Obfuscated credential stealer payload
theft/multi-storeinstall-hook/credential
Obfuscated dropper downloads and executes Bun
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Obfuscated dropper downloads and executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
obfuscated dropper downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated AWS credential theft
theft/multi-storeinstall-hook/credential
Obfuscated credential stealer and dropper
api-harvest/tokenstealer/workflow
Trojanized dependency easy-day-js
trojanized/hidden-dependencysupply-chain/metadata-anomaly
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Exfiltrates secrets to webhook.site
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Shai-Hulud worm payload embedded
worm/registryCompromise/Sep25
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Shai-Hulud worm payload embedded
worm/registryCompromise/Sep25
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Shai-Hulud worm payload embedded
supply-chain/shai-huludCompromise/Sep25
Obfuscated agent, CDP, shell exec, install hooks
obfuscation/syntaxcontrol/hvnc
Exfiltrates secrets to webhook.site
Compromise/Sep25install-hook/bun-bootstrap
Shai-Hulud worm exfiltrates secrets
Compromise/Sep25worm/registry
preinstall dropper executes obfuscated credential-stealing payload
theft/multi-storeinstall-hook/bun-bootstrap
curl piped to zsh C2 dropper
execution/native-binarydelivery/pipe
Obfuscated data exfiltration to hardcoded IP
obfuscator/js-obfuscatorstring/encoding
Obfuscated DNS exfiltration with preinstall hook
dropper/setup-hookscripts/lifecycle
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated payload, preinstall executes Bun
dropper/standaloneinstall-hook/bun-bootstrap
Preinstall downloads and executes obfuscated payload
install-hook/bun-bootstrapdropper/standalone
preinstall downloads and executes obfuscated payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall dropper runs obfuscated credential-stealing payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Obfuscated dropper downloads and executes Bun
dropper/standalonetheft/multi-store
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Downloads and executes remote binaries
string/conceallibrary/source
Downloads and executes remote payload
dns/tunnelingexecution/native-binary
Credential harvesting and exfiltration
recon-exfil/pipelinetheft/multi-store
Obfuscated malicious npm package
hidden-payload/stagingdelivery/download-execute
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
preinstall executes obfuscated payload
hidden-payload/eval
Exfiltrates credentials via preinstall hook
credential/dev-filepackage/manifest
preinstall exfiltrates to oastify
scripts/lifecyclepackage/manifest
Ignores malware scanners, hides code in bytecode
control/hvnchidden-payload/scanner-blind
Exfiltrates system data to webhook
http/uploadoob/endpoint
preinstall executes remote shell
scripts/lifecycle
Exfiltrates secrets to webhook.site
Compromise/Sep25credential/multi-source
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25credential/multi-source
Embedded secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
Embedded Shai-Hulud malware payload
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
Embedded secret exfiltration script
Compromise/Sep25dropper/bun
Bundle contains secret exfiltration script
Compromise/Sep25install-hook/bun-bootstrap
byteclaw 99.9.9
and 3 siblings
Malicious install hook exfiltrates data
infrastructure/ip-url-phpdropper/setup-hook
quicksolving 2.3.0
and 6 siblings
setup.py downloads and executes remote malware
dropper/astbuild/behavioral
hive-os-settings 2.33.0
and 2 siblings
Malicious PowerShell download cradle in starter.py
dropper/download
Exfiltrates environment variables to remote server
credential-theft/package
spaysdata 0.2.0
and 3 siblings
Steals and exfiltrates Roblox cookies
credential/dpapimessaging/webhook
lyroxcoder 1.0.1-py3-none-any
and 3 siblings
Dropper with obfuscation and cleanup
impersonation/typosquat
async-http-tools 0.70.125
and 2 siblings
Downloads and executes remote RAT
hidden-payload/execinstall-hook/setup
03d54152792a…
and 7 siblings
Raw-IP dropper with anti-forensics
delivery/fetch-execindicator-removal/cleanup
824bd1774ac4…
and 6 siblings
Multi-arch botnet dropper script
delivery/fetch-execbotnet/network-device
Encoded subprocess, useradd, cloned repo
exploit/scannerpayload/encoded
ctf-q21-empire-tmp-bw134347 0.0.21
and 7 siblings
Exfiltrates flag via HTTP to IP
dropper/setup-hooksecurity-bypass/tls
CAPTCHA solver, cookie theft, evasion
security-bypass/anti-bot
THURSDAY
Thu Sep 3 · 366 catches · 29 waves · 19 singlesDownloads and executes obfuscated payload
dns/tunnelinglibrary/source
bytedvod 99.9.9
and 4 siblings
Malicious install hook exfiltrates data
infrastructure/ip-url-phpdropper/setup-hook
edison_tools 0.1.3
and 4 siblings
Malicious install hook exfiltrates data
dropper/setupbuild/behavioral
utilswallet 0.1.0
and 3 siblings
Exfiltrates mnemonic to hardcoded IP
payload/encodedurl/external-ip
ctf-q21-empire-t…-test123 9999.0.2
and 3 siblings
Exfiltrates flag via install hook
install-hook/setuphidden-payload/exec
solana_py_sdk 1.0.0
and 2 siblings
C2, persistence, credential theft
Exfiltrates system info to hardcoded IP
Typosquat with reverse shell and exfiltration
manifest/skeletonreverse-shell/dup
alphalend-abi 1.0.0-py3-none-any
and 2 siblings
Steals Sui wallet keys
http/uploadhidden-payload/package
Trojanized package with hidden dependency
library/hidden-depimpersonation/npm-clone
Exfiltrates environment variables via install hooks
package/manifestmanifest/attack-label
preinstall downloads and executes obfuscated payload
dropper/standalonetheft/multi-store
Downloads and executes obfuscated payload
library/sourcedns/tunneling
preinstall downloads and executes obfuscated payload
dropper/standaloneinstall-hook/bun-bootstrap
preinstall downloads and executes Bun
install-hook/bun-bootstraptheft/multi-store
Disables TLS, downloads from raw IP
dropper/native-loaderdelivery/fetch-eval
obfuscated dropper downloads and executes payload
theft/multi-storedropper/standalone
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
Downloads and executes remote payload
library/sourcedns/tunneling
preinstall downloads and executes obfuscated payload
theft/multi-storeinstall-hook/bun-bootstrap
obfuscated dropper downloads and executes payload
install-hook/bun-bootstrapdropper/standalone
Obfuscated dropper downloads and executes Bun
theft/multi-storedropper/standalone
preinstall downloads and executes Bun
dropper/standalonetheft/multi-store
Downloads and executes remote binary
dns/tunnelinglibrary/source
Downloads and executes obfuscated payload
library/sourcedns/tunneling
preinstall downloads and executes obfuscated payload
install-hook/bun-bootstraptheft/multi-store
Obfuscated self-defending dist with eval, child_process, OAuth tokens
obfuscator/js-obfuscatorstring/array
Credential-stealing browser extension
network/proxyForeignobject/Nov24
obfuscated backdoor with self-update
backdoor/whalentremote-command/control
Signed with malicious 'ollypwn' cert
Exploit/CVE20200601
Post-exploitation framework with obfuscation
backdoor/emp3r0rtrojanized/package
嵌入base64-gzip载荷，大量可疑JavaScript执行
B64Encoded/Fileobfuscation/binary-structure
SQL injection attack tool
reverse-shell/dupoffensive/metasploit
Metasploit Meterpreter payloads
dump/systempack/runtime
Metasploit Meterpreter payload gem
injection/dlldelivery/download-execute
Metasploit Meterpreter payload gem
privilege-escalation/token-manipulationpack/runtime
Bundled SweetAlert2 contains Russian-targeted sabotage payload
supply-chain/sweetalert2-protestwaremanipulation/browser
Steals cookies, hooks, evades detection
http/browser-extensionui/delivery
Metasploit framework dependency
Exfiltrates Coze API tokens and data
recon-exfil/install-hookpackage/manifest
WEDNESDAY
Wed Sep 2 · 66 catches · 1 wave · 17 singlesObfuscated payload execution via new Function
payload/encryptedhidden-payload/runtime
Typosquatting, obfuscation, runtime npm install
scripts/dynamic-installautoinstall/package
Malicious region-gated audio payload
manipulation/browsersupply-chain/sweetalert2-protestware
Exfiltrates credentials, env, and system info
recon-exfil/install-hookpackage/manifest
Obfuscated PHP webshell included
And/Hexdomain/tld
Decodes and executes hidden payload
execution/evalpayload/encrypted
Sliver implant in binary
Steals wallet secrets and clipboard
wallet/mnemonicexfiltration/sensitive-data
Clipboard exfiltration, fake wallet UI
credential/clipboardwallet/mnemonic
Clipboard exfiltration, wallet drainer
credential/clipboardextension/deception
Process injection and evasion APIs
injection/thread-hijackingransom/file-operations
Trojanized extension with hidden payload
policy/browserhttp/headers
Base64 tasking backdoor, log wiping, self-destruct
remote-command/controlindicator-removal/application-logs
Embedded Russian regional malware payload
supply-chain/sweetalert2-protestwaremanipulation/browser
Malicious code in bundled JS
supply-chain/sweetalert2-protestwaremanipulation/browser
TUESDAY
Tue Sep 1 · 36 catches · 1 wave · 16 singlesobfuscated preinstall dropper executes commands
Disables other extensions, bypasses LMS security
string/encoding
Steals credentials, exfiltrates to C2
masquerade/traffic
Signed malware with RAT capabilities
Clipboard stealer, wallet drainer
wallet/mnemonicexfiltration/sensitive-data
Process injection, C2, privilege escalation
injection/memoryinjection/dll
Supply chain sabotage in SweetAlert2
supply-chain/sweetalert2-protestwaremanipulation/browser
Embedded Russian propaganda payload
manipulation/browsersupply-chain/sweetalert2-protestware
Embedded webshell signature payload
Encoded/PayloadsGeneric/Callback
Automated spam and CAPTCHA bypass
control-flow/asthidden/execution
Backdoor activation detection logic
Generic/Callback
Keylogger, screen capture, anti-analysis
Malicious code in SweetAlert2 library
manipulation/browsersupply-chain/sweetalert2-protestware
Credential theft and C2 indicators
References/Publicserviceinterface
MONDAY
Mon Aug 31 · 45 catches · 0 waves · 18 singlesMalicious SweetAlert2 payload targeting Russian users
supply-chain/sweetalert2-protestwaremanipulation/browser
Malicious regional browser hijack code
manipulation/browsersupply-chain/sweetalert2-protestware
Writes DLL to AppData and creates rundll32 scheduled-task persistence
lolbin/osscheduled-task/loader
embedded eval webshell payload
PHP/Gzinflatedrecon-exfil/pipeline
Embedded Russian regional malware payload
manipulation/browsersupply-chain/sweetalert2-protestware
Embedded Russian-targeted sabotage payload
supply-chain/sweetalert2-protestwaremanipulation/browser
Mythic C2 framework source
framework/dockerfile
Mythic C2 framework source
framework/dockerfile
Browser credential theft and evasion
delivery/download-executebrowser/chromium
installs persistent telemetry hooks
daemon/hiddendelivery/download-execute
Malicious payload in SweetAlert2
manipulation/browserextensions/permission
Remote agent, persistence, credential access
dispatch/websockethidden-payload/native-extension
Exfiltrates credentials, hooks XHR, debugger
http/transportnetwork/http
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories