https://blog.dansec.red/vendors/gluestack/Recent content in Gluestack on DanSec DailyHugoen-gbMon, 09 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-09-cybersecurity-news/Mon, 09 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-09-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A supply chain attack targeting npm and PyPI ecosystems has been identified, affecting over a dozen packages associated with GlueStack. The attack delivers malware via a change to &ldquo;lib/commonjs/index.js,&rdquo; potentially impacting millions globally.</li> <li>Over 700 users across Latin America, primarily in Brazil, have been infected since early 2025 through a campaign distributing malicious Chromium-based browser extensions designed to steal user data.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recording devices is being actively exploited by a new Mirai botnet variant, enabling attackers to hijack vulnerable devices.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Cybercriminals are leveraging software supply chain attacks by compromising widely used npm and PyPI packages to distribute malware at scale.</li> <li>Threat actors are targeting Latin American users with malicious browser extensions, focusing on Chromium-based browsers to exfiltrate sensitive information.</li> <li>Mirai botnet operators have adapted their malware to exploit vulnerabilities in digital video recorders, expanding their botnet infrastructure through IoT device compromise.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increased targeting of software supply chains, particularly open-source package repositories (npm, PyPI), as a vector for widespread malware distribution.</li> <li>Use of browser extensions as a method for credential and data theft, specifically targeting users in Latin America.</li> <li>Continued adaptation of IoT botnets (Mirai) to exploit newly discovered vulnerabilities in networked devices, maintaining persistence and expanding reach.</li> </ul>https://blog.dansec.red/posts/2025-06-08-cybersecurity-news/Sun, 08 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-08-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A supply chain attack compromised 15 popular Gluestack NPM packages, which collectively have over 950,000 weekly downloads. The compromised packages were modified to include malicious code functioning as a remote access trojan (RAT).</li> <li>Two malicious NPM packages, disguised as utility tools, were discovered to be destructive data wipers. When installed, these packages delete entire application directories, causing potential data loss for affected users.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Wireshark 4.4.7 was released, addressing one security vulnerability (CVE-2025-5601) and resolving eight additional bugs.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Ongoing investigations and reporting continue regarding unexplained iPhone crashes that some external sources have linked to Chinese threat actors, though Apple denies any connection to Chinese hacking activity.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The tool pngdump.py has been updated to enhance its capability for extracting chunks and embedded data from PNG images, aiding in malware analysis and forensic investigations.</li> <li>There is a noted trend of malicious actors leveraging NPM packages for both remote access and destructive attacks, with packages either installing RATs or acting as wipers that erase project data.</li> </ul>