Cybercrime/malcode – Lifeboat News: The Blog

Nov 25
2025

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in the npm registry in a new Shai-Hulud supply-chain campaign.

The malicious packages have been added to NPM (Node Package Manager) over the weekend to steal developer and continuous integration and continuous delivery (CI/CD) secrets. The data is automatically posted on GitHub in encoded form.

At publishing time, GitHub returned 27,600 results corresponding to entries related to the recent attack.

Nov 24
2025

Japan chip plants to face cybersecurity mandate as condition for subsidies

Government turns recommendations into requirements as crippling attacks rise

Nov 23
2025

Trust, Technology, Human Factors: The Foundation Of Cyber Resilience

#cybersecurity #ai #tech #trust #resilience #humanfactors

There is a need for increased Trust in this era of swift technological progress, where AI, automation, and deepfakes are threatening the cybersecurity landscape.

Nov 22
2025

Wargaming: The surprisingly effective tool that can help us prepare for modern crises

Consider the following scenario. There’s a ransomware attack, enhanced by AI, which paralyzes NHS systems—delaying medical care across the country.

Nov 22
2025

CISA warns Oracle Identity Manager RCE flaw is being actively exploited

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) is warning government agencies to patch an Oracle Identity Manager tracked as CVE-2025–61757 that has been exploited in attacks, potentially as a zero-day.

CVE-2025–61757 is a pre-authentication RCE vulnerability in Oracle Identity Manager, discovered and disclosed by Searchlight Cyber analysts Adam Kues and Shubham Shahflaw.

The flaw stems from an authentication bypass in Oracle Identity Manager’s REST APIs, where a security filter can be tricked into treating protected endpoints as publicly accessible by appending parameters like?WSDL or ;.wadl to URLpaths.

Nov 21
2025

From Generative To Agentic: The New Era Of AI Autonomy In 2026

#artificialintelligence

Agentic AI is a form of artificial intelligence that does more than just generate; it will act, reason somewhat, collaborate, and execute on its own. Agentic AI transforms its role from a limited tool to that of a collaborative coworker.

This shift affects various sectors, including cybersecurity, national defense, healthcare, key infrastructure, finance, supply chains, and corporate automation. Additionally, it accelerates the integration of robotics, neuromorphic systems, sensor-driven edge computing, and artificial intelligence.

Systems with the ability to plan and pursue goals characterize Agentic AI. IIt combines APIs and tools, engages with dynamic environments, makes decisions, uses reasoning, and continues to learn and adapt.

Nov 21
2025

Cyberattacks’ harm to universities is growing — and so are their effects on research

Hackers are ramping up attacks on academic institutions to access valuable data and to demand ransoms.

Nov 21
2025

ShadowRay 2.0 Exploits Unpatched Ray Flaw to Build Self-Spreading GPU Cryptomining Botnet

ShadowRay 2.0 exploits an unpatched Ray flaw to spread cryptomining and DDoS malware across exposed GPU clusters.

Nov 20
2025

TamperedChef Malware Spreads via Fake Software Installers in Ongoing Global Campaign

TamperedChef spreads through fake installers and SEO abuse, delivering a persistent JavaScript backdoor across multiple sectors.

Nov 20
2025

Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices

Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil.

“It uses Internet Message Access Protocol (IMAP) to dynamically retrieve command-and-control (C2) addresses, allowing the threat actor to update its C2 server,” Trustwave SpiderLabs researchers Nathaniel Morales, John Basmayor, and Nikita Kazymirskyi said in a technical breakdown of the campaign shared with The Hacker News.

It is distributed through a WhatsApp worm campaign, with the actor now deploying a Python script, a shift from previous PowerShell-based scripts to hijack WhatsApp and spread malicious attachments.