Intelligence Feed

3w ago · Datadog Security Labs

Threat actor MUT-1244 targets offensive security actors, including pentesters and researchers, using phishing campaigns and trojanized GitHub repositories to deliver a second-stage payload. The payload exfiltrates sensitive data such as SSH keys, AWS credentials, and environment variables. Over 390,000 WordPress credentials were harvested after compromising threat actors who used a trojanized credential checker tool named 'yawpp'. The actor leverages multiple initial access methods, including malicious npm packages and phishing emails, to distribute the same backdoor.

3w ago · Datadog Security Labs

Stressed Pungsan, a DPRK-aligned threat actor, has been observed leveraging malicious npm packages for initial access. The actor published two packages, 'harthat-hash' and 'harthat-api', which execute a preinstall script to download and run a malicious DLL from a C2 server. The infrastructure and TTPs align with Microsoft's MOONSTONE SLEET, indicating a focus on Windows environments and potential espionage or credential theft objectives.

3w ago · Datadog Security Labs

A new opportunistic campaign exploiting the Log4Shell vulnerability (CVE-2021-44228) has been observed targeting vulnerable Java applications. The attack uses obfuscated LDAP requests to deliver a malicious Java class, which downloads and executes a crypto-mining payload (XMRig) and establishes persistence via systemd or cron. The threat actor exfiltrates system information and maintains remote access through encrypted reverse shells using Perl and netcat.

3w ago · Datadog Security Labs

In September 2024, Datadog Security Research identified three malicious npm packages—passports-js, bcrypts-js, and blockscan-api—linked to the DPRK-associated threat actor 'Tenacious Pungsan'. These packages distributed BeaverTail, a JavaScript infostealer and downloader used in the Contagious Interview campaign targeting US tech job-seekers. The malware steals cryptocurrency wallet data, browser credentials, and deploys a second-stage Python backdoor called InvisibleFerret. The activity is tied to known infrastructure and overlaps with prior Contagious Interview TTPs, indicating ongoing targeting of developers.

3w ago · Datadog Security Labs

MUT-8694 is a persistent threat actor conducting a supply chain attack across both npm and PyPI ecosystems, distributing malicious packages that deliver infostealer malware to Windows users. The campaign uses typosquatting and obfuscated code to distribute Blank Grabber and Skuld Stealer, both open-source infostealers targeting credentials, cryptocurrency wallets, and gaming data. The threat actor leverages legitimate services like GitHub and Replit to host payloads and employs PowerShell-based execution and evasion techniques, including disabling Windows Defender and exfiltrating data via Telegram and Discord.

3w ago · Datadog Security Labs

CVE-2025-29927 is a critical authorization bypass vulnerability in Next.js middleware that allows attackers to skip security checks by exploiting improper handling of the internal 'x-middleware-subrequest' header. Exploitation involves sending a crafted HTTP request with this header to bypass middleware protections, potentially exposing administrative routes and sensitive content. The vulnerability affects self-hosted Next.js applications using vulnerable versions prior to specific patched releases, with immediate remediation advised through upgrading or implementing temporary mitigations.

3w ago · Datadog Security Labs

MUT-9332 is a threat actor targeting Solidity developers via malicious Visual Studio Code extensions named solaibot, among-eth, and blankebesxstnion. These extensions deliver multi-stage malware that establishes persistence, disables security controls, and exfiltrates cryptocurrency wallet credentials. The campaign uses obfuscated scripts, steganography, and multiple command-and-control domains to evade detection, with infrastructure reuse indicating links to a prior Monero cryptominer campaign.

3w ago · Datadog Security Labs

The Mimo threat actor, previously known for targeting Craft CMS, has expanded its operations to compromise Magento CMS platforms and misconfigured Docker instances through PHP-FPM vulnerabilities. The actor employs sophisticated persistence and evasion techniques, including GSocket-based reverse shells, in-memory execution via memfd_create(), and process masquerading to mimic kernel threads. Mimo monetizes compromised systems through cryptojacking using XMRig and proxyjacking via IPRoyal Pawns, indicating a dual revenue strategy. This evolution reflects increased operational sophistication and a broader targeting scope beyond CMS platforms.