Tag: marketplace
-
AI browsers can be abused by malicious AI sidebar extensions: Report
‘Dumpster fires’: David Shipley, head of Canadian employee security awareness training firm Beauceron Security, agrees.”I think if CISOs are bored and want to spice up their lives with an incident, they should roll out these AI-powered hot messes to their users,” he said .”But, if they’re like most CISOs and they have lots of problems,…
-
GlassWorm Malware Targets Developers Through OpenVSX Marketplace
GlassWorm, a self-propagating malware, infects VS Code extensions through the OpenVSX marketplace, stealing credentials and using blockchain for control. First seen on hackread.com Jump to article: hackread.com/glassworm-malware-developers-openvsx-marketplace/
-
Researchers track surge in high-level Smishing Triad activity
The China-linked operation has grown from a phishing kit marketplace into an active and growing community supporting a decentralized large-scale phishing ecosystem. First seen on cyberscoop.com Jump to article: cyberscoop.com/unit-42-chinese-language-phishing-operation-smishing-triad/
-
Researchers track surge in high-level Smishing Triad activity
The China-linked operation has grown from a phishing kit marketplace into an active and growing community supporting a decentralized large-scale phishing ecosystem. First seen on cyberscoop.com Jump to article: cyberscoop.com/unit-42-chinese-language-phishing-operation-smishing-triad/
-
CAASM and EASM: Top 12 attack surface discovery and management tools
Tags: access, ai, api, attack, automation, blockchain, business, cloud, control, corporate, credentials, cyber, cybersecurity, dark-web, data, data-breach, detection, dns, endpoint, exploit, framework, guide, hacking, HIPAA, incident response, infrastructure, intelligence, Internet, leak, marketplace, microsoft, monitoring, network, open-source, PCI, risk, risk-assessment, service, soc, software, supply-chain, technology, threat, tool, update, vulnerabilityCAASM and EASM tools for attack surface discovery and management: Periodic scans of the network are no longer sufficient for maintaining a hardened attack surface. Continuous monitoring for new assets and configuration drift are critical to ensure the security of corporate resources and customer data.New assets need to be identified and incorporated into the monitoring…
-
Self-propagating worm found in marketplaces for Visual Studio Code extensions
Tags: access, application-security, attack, backdoor, backup, best-practice, blockchain, breach, ciso, control, credentials, crime, crypto, cyber, data, data-breach, endpoint, framework, github, gitlab, google, government, identity, incident response, infrastructure, intelligence, least-privilege, login, malicious, malware, marketplace, network, open-source, resilience, risk, sans, security-incident, software, supply-chain, threat, tool, update, wormMarketplaces targeted: The Koi Security report is the latest in a series of warnings that threat actors are increasingly targeting VS Code marketplaces in supply chain attacks. Last week, Koi Security exposed a threat actor dubbed TigerJack spreading malicious extensions. And researchers at Wiz just published research showing the widespread abuse of the OpenVSX and…
-
Threat Actors Reportedly Marketing Monolock Ransomware on Dark Web Forums
Tags: cyber, cybercrime, cybersecurity, dark-web, encryption, malicious, marketplace, monitoring, ransomware, software, threatA recent surge in underground cybercrime chatter has shone a spotlight on Monolock Ransomware V1.0, as multiple posts on dark web forums claim that the malicious software is now available for purchase. Cybersecurity researchers monitoring illicit marketplaces report that threat actors are advertising a fully functional ransomware strain, complete with encryption modules, key exchange mechanisms,…
-
Threat Actors Reportedly Marketing Monolock Ransomware on Dark Web Forums
Tags: cyber, cybercrime, cybersecurity, dark-web, encryption, malicious, marketplace, monitoring, ransomware, software, threatA recent surge in underground cybercrime chatter has shone a spotlight on Monolock Ransomware V1.0, as multiple posts on dark web forums claim that the malicious software is now available for purchase. Cybersecurity researchers monitoring illicit marketplaces report that threat actors are advertising a fully functional ransomware strain, complete with encryption modules, key exchange mechanisms,…
-
New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions
GlassWorm is the world’s first self-propagating worm targeting VS Code extensions in the OpenVSX marketplace, unleashing invisible malicious payloads and decentralized command infrastructure that make it nearly impossible to detect or dismantle. First identified on October 17, 2025, GlassWorm hijacks developer machines via invisible Unicode code, harvests credentials, drains cryptocurrency wallets, and transforms infected systems…
-
New GlassWorm Threat Uses Stealthy Code to Target OpenVSX Extensions
GlassWorm is the world’s first self-propagating worm targeting VS Code extensions in the OpenVSX marketplace, unleashing invisible malicious payloads and decentralized command infrastructure that make it nearly impossible to detect or dismantle. First identified on October 17, 2025, GlassWorm hijacks developer machines via invisible Unicode code, harvests credentials, drains cryptocurrency wallets, and transforms infected systems…
-
Self-spreading GlassWorm malware hits OpenVSX, VS Code registries
A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called GlassWorm that has been installed an estimated 35,800 times. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…
-
Threat actors are spreading malicious extensions via VS marketplaces
What are VS extensions: Extensions and themes can be added to Visual Studio code to make life easier for developers, as well as to enhance functionality. An extension can add features like debuggers, new languages, or other development tools, while a theme is a type of extension that changes the appearance of the editor, controlling things like colors…
-
Prosper Market Data Breach Affects 17.6M Individuals
Breach Notification Service Details Peer-to-Peer Lending Marketplace Victim Count. Hackers appear to have stolen personal information pertaining to more than 17 million individuals from peer-to-peer lending marketplace Prosper, including Social Security numbers, contact information and some income and financial details, says the Have I Been Pwned breach notification service. First seen on govinfosecurity.com Jump to…
-
Leaks in Microsoft VS Code Marketplace Put Supply Chain at Risk
Researchers discovered more than 550 unique secrets exposed in Visual Studio Code marketplaces, prompting Microsoft to bolster security measures. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/leaks-microsoft-vs-code-marketplaces-supply-chain-risks
-
Integrationen von Versa Networks mit der Crowdstrike-Falcon-Plattform verbessern den Zero-Trust-Zugriff
Die neuen Integrationen von Versa Networks, Spezialist für Secure-Access-Service-Edge (SASE), mit der Crowdstrike-Falcon-Plattform verbessern den Zero-Trust-Zugriff und bieten SOC-Teams eine umfassende Endpunkt- und Netzwerktransparenz. Dadurch sind sie in der Lage, Bedrohungen frühzeitig zu erkennen und zu stoppen. Die Integrationen sind ab sofort im Crowdstrike-Marketplace verfügbar und umfassen auch die Unterstützung für Falcon-Next-Gen-SIEM. Security-Teams mangelt es…
-
Integrationen von Versa Networks mit der Crowdstrike-Falcon-Plattform verbessern den Zero-Trust-Zugriff
Die neuen Integrationen von Versa Networks, Spezialist für Secure-Access-Service-Edge (SASE), mit der Crowdstrike-Falcon-Plattform verbessern den Zero-Trust-Zugriff und bieten SOC-Teams eine umfassende Endpunkt- und Netzwerktransparenz. Dadurch sind sie in der Lage, Bedrohungen frühzeitig zu erkennen und zu stoppen. Die Integrationen sind ab sofort im Crowdstrike-Marketplace verfügbar und umfassen auch die Unterstützung für Falcon-Next-Gen-SIEM. Security-Teams mangelt es…
-
Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks
New research has uncovered that publishers of over 100 Visual Studio Code (VS Code) extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk.”A leaked VSCode Marketplace or Open VSX PAT [personal access token] allows an attacker to directly distribute a malicious extension…
-
Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks
New research has uncovered that publishers of over 100 Visual Studio Code (VS Code) extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk.”A leaked VSCode Marketplace or Open VSX PAT [personal access token] allows an attacker to directly distribute a malicious extension…
-
TigerJack Hackers Target Developer Marketplaces with 11 Malicious VS Code Extensions
Sophisticated Threat Actor Compromises 17,000+ Developers Through Trojan Extensions That Steal Code and Mine Cryptocurrency. Operating since early 2025 under multiple publisher accounts (ab-498, 498, and 498-00), this sophisticated campaign deploys extensions that steal source code, mine cryptocurrency, and establish remote backdoors for complete system control. A newly identified threat actor known as TigerJack has…
-
North Korean IT Workers Use VPNs and Laptop Farms to Evade Identity Verification
In a sprawling network of covert remote labor, more than 10,000 North Korean IT professionals have infiltrated global technology and freelance marketplaces by exploiting VPNs, virtual private servers (VPS), and so-called “laptop farms” to conceal their true origins. State-backed cyber units employ these operatives to generate revenue for sanctioned weapons programs and gather intelligence across…
-
Russian Cybercrime Marketplace Shifting from RDP Access to Malware Stealer Log Exploits
Tags: access, attack, breach, corporate, credentials, cyber, cybercrime, exploit, login, malware, marketplace, russia, threatThe online cybercrime marketplace, Russian Market, has evolved from selling Remote Desktop Protocol (RDP) access to becoming one of the most active underground hubs for information-stealing malware logs. Stolen user credentials are traded daily, and each compromised login represents a potential gateway into corporate systems. Threat actors routinely purchase credentials to launch credential-based attacks that…
-
Russian Cybercrime Marketplace Shifting from RDP Access to Malware Stealer Log Exploits
Tags: access, attack, breach, corporate, credentials, cyber, cybercrime, exploit, login, malware, marketplace, russia, threatThe online cybercrime marketplace, Russian Market, has evolved from selling Remote Desktop Protocol (RDP) access to becoming one of the most active underground hubs for information-stealing malware logs. Stolen user credentials are traded daily, and each compromised login represents a potential gateway into corporate systems. Threat actors routinely purchase credentials to launch credential-based attacks that…
-
Our APWG eCrimes Paper on Tech Support Scam Facebook Groups
Tags: apple, conference, cybercrime, data, email, finance, google, group, india, marketplace, microsoft, phishing, scam, serviceMy colleague Raghavendra Cherupalli will be at APWG eCrime next month sharing a paper based on our research into the Facebook Groups where illicit Indian Call Centers share “Crime-as-a-Service” offerings with one another. In our paper, “Classification of Cybercriminal Posts Using Large Language Models: A Comprehensive Study on Tech Support Scam Marketplaces,” Raghavendra will be…
-
Our APWG eCrimes Paper on Tech Support Scam Facebook Groups
Tags: apple, conference, cybercrime, data, email, finance, google, group, india, marketplace, microsoft, phishing, scam, serviceMy colleague Raghavendra Cherupalli will be at APWG eCrime next month sharing a paper based on our research into the Facebook Groups where illicit Indian Call Centers share “Crime-as-a-Service” offerings with one another. In our paper, “Classification of Cybercriminal Posts Using Large Language Models: A Comprehensive Study on Tech Support Scam Marketplaces,” Raghavendra will be…
-
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums. The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre…
-
Authorities Dismantle BreachForums’ Reemerged Clearnet Marketplace
In a coordinated effort, international law enforcement agencies seized the clearnet domain breachforums[.]hn, shutting down yet another incarnation of the notorious cybercrime marketplace BreachForums. The domain now displays a joint seizure notice from the U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI), alongside French authorities, including the Brigade de Lutte Contre…