Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs
Malware authors upped their game, using homoglyphs to impersonate a protected NuGet prefix and IL weaving to inject malicious code, RL researchers found.
Karlo Zanki
Reverse Engineer at ReversingLabs
Posts from Karlo Zanki
Malicious NuGet campaign uses homoglyphs and IL weaving to fool devs
Python downloader highlights noise problem in open source threat detection
RL discovered what appeared to be a malicious downloader on PyPI. It turned out to be red teaming — but highlights a growing problem for threat detection.
BIPClip: Malicious PyPI packages target crypto wallet recovery passwords
RL has discovered a campaign using PyPI packages posing as open-source libraries to steal BIP39 mnemonic phrases, which are used for wallet recovery.
Malware leveraging public infrastructure like GitHub on the rise
ReversingLabs researchers have uncovered two novel techniques running on GitHub — one abusing GitHub Gists, another issuing commands through git commit messages.
IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations
ReversingLabs has highlighted threats in npm, PyPI and RubyGEMS in recent years. This finding shows NuGet is equally exposed to malicious activities by threat actors.
VMConnect supply chain attack continues, evidence points to North Korea
ReversingLabs researchers discovered more packages that are part of the previously identified VMConnect campaign, as well as evidence linking the campaign to North Korea's Lazarus Group.
VMConnect: Malicious PyPI packages imitate popular open source modules
ReversingLabs threat researchers have identified a new malicious PyPI campaign that includes a suspicious VMConnect package published to the PyPI repo.
When byte code bites: Who checks the contents of compiled Python files?
The ReversingLabs research team has identified a novel attack on PyPI using compiled Python code to evade detection — possibly the first attack to take advantage of PYC file direct execution.
Red flags flew over software supply chain-compromised 3CX update
The VOIP software company missed signs that its client had been tampered with before it pushed the update to customers.