Malicious Go "crypto" Module Steals Passwords and Deploys Rekoobe Backdoor

An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Feb 26, 2026 Malware, Supply Chain

SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains

An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Feb 20, 2026 Malware, Supply Chain

Malicious Chrome extension CL Suite artwork

Malicious Chrome Extension Steals Meta Business Manager Exports and TOTP 2FA Seeds

Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Feb 13, 2026 Malware, Browser Extensions

GlassWorm Loader Hits Open VSX via Developer Account Compromise

Threat actors compromised four oorzc Open VSX extensions with more than 22,000 downloads, pushing malicious versions that install a staged loader, evade Russian-locale systems, pull C2 from Solana memos, and steal macOS credentials and wallets.

Jan 31, 2026 Malware, Browser Extensions

PyPI Package Impersonates SymPy to Deliver Cryptomining Malware

Malicious PyPI package sympy-dev targets SymPy users, a Python symbolic math library with 85 million monthly downloads.

Jan 21, 2026 Malware, PyPI

Malicious Chrome Extension Steals MEXC API Keys for Account Takeover

A malicious Chrome extension steals newly created MEXC API keys, exfiltrates them to Telegram, and enables full account takeover with trading and withdrawal permissions.

Jan 12, 2026 Malware, Browser Extensions

Spearphishing Campaign Abuses npm Registry to Target U.S. and Allied Manufacturing and Healthcare Organizations

A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting sales personnel at critical infrastructure organizations.

Dec 23, 2025 Malware, npm

Malicious NuGet Package Typosquats Popular .NET Tracing Library to Steal Wallet Passwords

Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.

Dec 15, 2025 Malware, NuGet

Malicious Go Packages Impersonate Google's UUID Library and Exfiltrate Data

A pair of typosquatted Go packages posing as Google's UUID library quietly turn helper functions into encrypted exfiltration channels to a paste site, putting developer and CI data at risk.

Dec 5, 2025 Go, Supply Chain

North Korea Contagious Interview npm attacks artwork

Inside the GitHub Infrastructure Powering North Korea's Contagious Interview npm Attacks

Socket Threat Research Team maps a rare inside look at OtterCookie's npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korea's Contagious Interview operation.

Nov 26, 2025 Malware, North Korea