Tag JavaScript

Major Supply Chain Compromise: Backdoor Found in Ripple’s xrpl.js npm Package Targeting Private Keys

April 23, 2025
Blockchain / Cryptocurrency

The JavaScript library xrpl.js, associated with Ripple cryptocurrency, has been compromised in a supply chain attack by unidentified threat actors, aimed at stealing users’ private keys. This vulnerability impacts several versions of the package: 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2. Versions 4.2.5 and 2.14.3 have since addressed the issue. xrpl.js serves as a widely-used API for interacting with the XRP Ledger blockchain, developed by Ripple Labs since 2012, and has garnered over 2.9 million downloads along with more than 135,000 weekly downloads. “The official xrpl (Ripple) NPM package was compromised by sophisticated attackers who embedded a backdoor specifically designed to steal cryptocurrency private keys and access wallets,” stated Charlie Eriksen of Aikido Security. The malicious code modifications are believed to have been introduced by a…

Ripple’s xrpl.js npm Package Compromised in Significant Supply Chain Attack April 23, 2025 Blockchain / Cryptocurrency In a concerning development within the cryptocurrency sector, the npm JavaScript library for Ripple, known as xrpl.js, has fallen victim to unknown adversaries in a software supply chain attack aimed at capturing users’ private…

Read More

Major Supply Chain Compromise: Backdoor Found in Ripple’s xrpl.js npm Package Targeting Private Keys

April 23, 2025
Blockchain / Cryptocurrency

The JavaScript library xrpl.js, associated with Ripple cryptocurrency, has been compromised in a supply chain attack by unidentified threat actors, aimed at stealing users’ private keys. This vulnerability impacts several versions of the package: 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2. Versions 4.2.5 and 2.14.3 have since addressed the issue. xrpl.js serves as a widely-used API for interacting with the XRP Ledger blockchain, developed by Ripple Labs since 2012, and has garnered over 2.9 million downloads along with more than 135,000 weekly downloads. “The official xrpl (Ripple) NPM package was compromised by sophisticated attackers who embedded a backdoor specifically designed to steal cryptocurrency private keys and access wallets,” stated Charlie Eriksen of Aikido Security. The malicious code modifications are believed to have been introduced by a…

Researcher Uncovers Vulnerability Exposing Phone Numbers Linked to Google Accounts

Jun 10, 2025
Vulnerability / API Security

Google has acted to resolve a security flaw that could allow malicious actors to brute-force recovery phone numbers associated with Google accounts, potentially compromising user privacy and security. Singaporean security researcher “brutecat” identified that the vulnerability exploited a weakness in the company’s account recovery feature. The issue involved a now-obsolete version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked sufficient anti-abuse measures to limit excessive requests. This page allows users to check if a recovery email or phone number is linked to a specific display name (e.g., “John Smith”). By bypassing the CAPTCHA rate limits, attackers could rapidly test various permutations of a Google account’s phone number, leading to possible exploitation.

Security Flaw Discovered in Google Account Recovery Process Exposes User Privacy On June 10, 2025, a significant security vulnerability was identified in Google’s account recovery system, raising concerns about potential risks to user privacy and security. The flaw, discovered by Singaporean security researcher known as “brutecat,” allows for the brute-force…

Read More

Researcher Uncovers Vulnerability Exposing Phone Numbers Linked to Google Accounts

Jun 10, 2025
Vulnerability / API Security

Google has acted to resolve a security flaw that could allow malicious actors to brute-force recovery phone numbers associated with Google accounts, potentially compromising user privacy and security. Singaporean security researcher “brutecat” identified that the vulnerability exploited a weakness in the company’s account recovery feature. The issue involved a now-obsolete version of the Google username recovery form (“accounts.google[.]com/signin/usernamerecovery”) that lacked sufficient anti-abuse measures to limit excessive requests. This page allows users to check if a recovery email or phone number is linked to a specific display name (e.g., “John Smith”). By bypassing the CAPTCHA rate limits, attackers could rapidly test various permutations of a Google account’s phone number, leading to possible exploitation.

Astaroth Banking Malware Emerges in Brazil Through Targeted Spear-Phishing Campaign

On October 16, 2024, Cyber Attack / Banking Trojan

A new spear-phishing initiative in Brazil has been discovered, spreading the banking malware Astaroth (also known as Guildma) through obfuscated JavaScript to evade security measures. According to Trend Micro’s recent analysis, this campaign has particularly affected various sectors, including manufacturing, retail, and government agencies. Malicious emails often disguise themselves as official tax documents, exploiting the urgency of personal income tax submissions to lure victims into downloading the malware. Trend Micro is monitoring this cluster of threat activity under the name Water Makara. Additionally, Google’s Threat Analysis Group (TAG) has identified a similar campaign, dubbed PINEAPPLE, that also targets Brazilian users with the same malware. Both operations begin with phishing messages masquerading as communications from official entities.

Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack On October 16, 2024, reports surfaced detailing a resurgence of the Astaroth banking malware, also known as Guildma, targeting Brazilian entities through a sophisticated spear-phishing campaign. The ongoing threat involves the use of obfuscated JavaScript to bypass traditional security measures, allowing…

Read More

Astaroth Banking Malware Emerges in Brazil Through Targeted Spear-Phishing Campaign

On October 16, 2024, Cyber Attack / Banking Trojan

A new spear-phishing initiative in Brazil has been discovered, spreading the banking malware Astaroth (also known as Guildma) through obfuscated JavaScript to evade security measures. According to Trend Micro’s recent analysis, this campaign has particularly affected various sectors, including manufacturing, retail, and government agencies. Malicious emails often disguise themselves as official tax documents, exploiting the urgency of personal income tax submissions to lure victims into downloading the malware. Trend Micro is monitoring this cluster of threat activity under the name Water Makara. Additionally, Google’s Threat Analysis Group (TAG) has identified a similar campaign, dubbed PINEAPPLE, that also targets Brazilian users with the same malware. Both operations begin with phishing messages masquerading as communications from official entities.

Urgent Security Update: Chrome Zero-Day CVE-2025-6554 Targeted by Active Attacks

Jul 01, 2025
Vulnerability / Browser Security

Google has issued a critical security update to address a zero-day vulnerability in its Chrome browser, currently being exploited in the wild. The flaw, identified as CVE-2025-6554, has a CVSS score of 8.1 and is classified as a type confusion issue within the V8 JavaScript and WebAssembly engine. According to the National Institute of Standards and Technology (NIST), “Type confusion in V8 in Google Chrome prior to version 138.0.7204.96 allowed remote attackers to perform arbitrary read/write operations through a specially crafted HTML page.” This type of vulnerability poses significant risks, potentially enabling attackers to execute arbitrary code, crash systems, or install malicious software. Zero-day vulnerabilities are particularly alarming, as they are often exploited by attackers before a patch is available, leading to possible spyware installations, drive-by downloads, or other harmful actions simply through user interactions.

Google Addresses Active Chrome Zero-Day Vulnerability CVE-2025-6554 With Security Update On July 1, 2025, Google announced critical security updates for its Chrome browser, designed to remedy a zero-day vulnerability labeled CVE-2025-6554. This flaw, currently being exploited in the wild, has received a CVSS score of 8.1, indicating its severity. Classified…

Read More

Urgent Security Update: Chrome Zero-Day CVE-2025-6554 Targeted by Active Attacks

Jul 01, 2025
Vulnerability / Browser Security

Google has issued a critical security update to address a zero-day vulnerability in its Chrome browser, currently being exploited in the wild. The flaw, identified as CVE-2025-6554, has a CVSS score of 8.1 and is classified as a type confusion issue within the V8 JavaScript and WebAssembly engine. According to the National Institute of Standards and Technology (NIST), “Type confusion in V8 in Google Chrome prior to version 138.0.7204.96 allowed remote attackers to perform arbitrary read/write operations through a specially crafted HTML page.” This type of vulnerability poses significant risks, potentially enabling attackers to execute arbitrary code, crash systems, or install malicious software. Zero-day vulnerabilities are particularly alarming, as they are often exploited by attackers before a patch is available, leading to possible spyware installations, drive-by downloads, or other harmful actions simply through user interactions.

New GootLoader Campaign Targets Those Searching for Bengal Cat Regulations in Australia

Date: Nov 11, 2024
Category: Malware / SEO Poisoning

In a uniquely targeted effort, individuals looking for information on the legality of Bengal Cats in Australia are falling victim to the GootLoader malware. “We discovered GootLoader operators utilizing search inquiries regarding a specific cat breed and region to deliver malware: ‘Are Bengal Cats legal in Australia?'” noted Sophos researchers Trang Tang, Hikaru Koike, Asha Castle, and Sean Gallagher in a report released last week. GootLoader, as its name suggests, is a malware loader typically spread through search engine optimization (SEO) poisoning techniques for initial entry. The malware is triggered when users search for terms related to legal documents and agreements; this leads to compromised links that direct them to infected websites hosting a ZIP file containing a JavaScript payload. Once executed, it paves the way for further malicious software installation.

New GootLoader Campaign Targets Searches for Bengal Cat Laws in Australia In a targeted cybersecurity threat, attackers are leveraging interest in the legality of Bengal cats in Australia to distribute GootLoader malware. This specific campaign highlights the methodical approach employed by cybercriminals, as reports from Sophos researchers suggest that individuals…

Read More

New GootLoader Campaign Targets Those Searching for Bengal Cat Regulations in Australia

Date: Nov 11, 2024
Category: Malware / SEO Poisoning

In a uniquely targeted effort, individuals looking for information on the legality of Bengal Cats in Australia are falling victim to the GootLoader malware. “We discovered GootLoader operators utilizing search inquiries regarding a specific cat breed and region to deliver malware: ‘Are Bengal Cats legal in Australia?'” noted Sophos researchers Trang Tang, Hikaru Koike, Asha Castle, and Sean Gallagher in a report released last week. GootLoader, as its name suggests, is a malware loader typically spread through search engine optimization (SEO) poisoning techniques for initial entry. The malware is triggered when users search for terms related to legal documents and agreements; this leads to compromised links that direct them to infected websites hosting a ZIP file containing a JavaScript payload. Once executed, it paves the way for further malicious software installation.

Adult Websites Hiding Exploit Code in Inappropriate .svg Files

Obfuscated Code Found in SVG Files from Pornography Sites Triggers Malicious Attacks Recent findings from cybersecurity firm Malwarebytes have revealed alarming vulnerabilities in the use of SVG file formats on various adult-themed websites. Researchers discovered that these sites were deploying obfuscated JavaScript within SVG files, which, when downloaded, initiate a…

Read MoreAdult Websites Hiding Exploit Code in Inappropriate .svg Files

AI Continues to Produce Vulnerable Code

Artificial Intelligence & Machine Learning, Next-Generation Technologies & Secure Development Veracode Study Finds Nearly Half of AI-Generated Code is Insecure Rashmi Ramesh (@rashmiramesh_) • August 1, 2025 Image: Shutterstock/ISMG Recent findings from Veracode have raised serious concerns regarding artificial intelligence’s role in software development. Researchers discovered that large language models…

Read MoreAI Continues to Produce Vulnerable Code

Hackers Exploit 70+ Microsoft Exchange Servers to Deploy Keyloggers for Credential Theft

June 24, 2025
Vulnerability / Malware

Unidentified threat actors have been targeting publicly exposed Microsoft Exchange servers to inject malicious code into login pages for credential harvesting. A recent analysis by Positive Technologies revealed two types of JavaScript keyloggers on the Outlook login page: one that saves captured data to a locally accessible file and another that transmits it directly to an external server. The Russian cybersecurity firm reported that these attacks affected 65 victims across 26 countries and continue a campaign first noted in May 2024, which targeted organizations in Africa and the Middle East. Initial findings indicated at least 30 victims among government agencies, banks, IT firms, and educational institutions, with evidence of compromises dating back to 2021. The attack chains exploit known vulnerabilities in Microsoft systems.

Cybersecurity Alert: Hackers Compromise Over 70 Microsoft Exchange Servers to Capture Credentials Date: June 24, 2025 In a concerning development for organizations reliant on Microsoft Exchange, unidentified threat actors have been targeting publicly accessible servers to deploy malicious code on login pages designed to capture user credentials. A recent analysis…

Read More

Hackers Exploit 70+ Microsoft Exchange Servers to Deploy Keyloggers for Credential Theft

June 24, 2025
Vulnerability / Malware

Unidentified threat actors have been targeting publicly exposed Microsoft Exchange servers to inject malicious code into login pages for credential harvesting. A recent analysis by Positive Technologies revealed two types of JavaScript keyloggers on the Outlook login page: one that saves captured data to a locally accessible file and another that transmits it directly to an external server. The Russian cybersecurity firm reported that these attacks affected 65 victims across 26 countries and continue a campaign first noted in May 2024, which targeted organizations in Africa and the Middle East. Initial findings indicated at least 30 victims among government agencies, banks, IT firms, and educational institutions, with evidence of compromises dating back to 2021. The attack chains exploit known vulnerabilities in Microsoft systems.