Attacks Analysis

03 Jul SkillLeak: A Browser-Credential Decryptor Delivered Through an MCP Skill

Posted at 08:52h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

30 Jun DeviceDoor: a public npm package shipping a Microsoft 365 device-code phishing and bulk-mail framework

Posted at 14:41h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

22 Jun CryptoDAO Confusion: eleven npm packages, one payload, harvesting CI/CD and crypto-wallet secrets

Posted at 11:05h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

22 Jun Permission Slip: An npm “Authorized Research” Cover Story Hiding Cloud-Metadata Probes and SYSTEM Persistence

Posted at 09:55h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

12 Jun Ectoplasm: npm install hooks that harvest AWS credentials behind a container-only trigger

Posted at 12:15h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

09 Jun SeedSweep: Ten Crypto-Themed npm Packages That Only Run When No One Is Watching

Posted at 11:12h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

05 Jun PairLoop: One npm Package, Seventy Versions, and a Hidden Windows Remote-Control Panel

Posted at 11:48h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

04 Jun ConsentMask: An npm Package That Wears a Telemetry Consent Banner Over Developer-Identity Harvesting

Posted at 12:00h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

29 May JulesJacker: A Fake-PoC npm Worm That Impersonates Google’s Jules Agent — and Turns on the Sandbox Analyzing It

Posted at 11:58h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

22 May RuntimeBroker: an npm Typosquat Plants a 40-Chain Crypto-Clipper as a Cross-OS \”System Runtime Helper”\

Posted at 12:52h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

21 May AuditorTrap: A 22-Package Fake Crypto Security Guild on npm With Two Parallel Payloads

Posted at 12:18h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More

18 May PhantomBot: A Typosquat Campaign That Pivoted From Credential Theft to a Turnkey Botnet Kit

Posted at 09:44h in Attacks Analysis, Must Read, Secrets Security by Xygeni Security Team 0 Comments

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident....

Read More