ReversingLabs

ReversingLabs

@reversinglabs.com

ReversingLabs is the trusted name in file and software security. RL - Trust Delivered.

140 followers85 following334 posts

ReversingLabs
@reversinglabs.com

The patching window has collapsed. Mean time to exploit crossed zero in 2024, and AI can turn disclosed vulnerabilities into working exploits in ~10-15 minutes. A patch can now be an answer key for the attacker. New analysis from ReversingLabs: www.reversinglabs.com/resources/th...

reversinglabs.comAI and Patch Security: The Patch Is the Attack Payload | ReversingLabsSee how AI is collapsing the exploit window, turning patches into attacker intelligence, and forcing security teams to rethink software risk.
ReversingLabs
@reversinglabs.com

ReversingLabs researchers uncovered a malicious npm package posing as an authorized Twilio bug bounty tool. The package targeted Twilio Account SIDs and Auth Tokens and exfiltrated them via webhook. We reported it to npm. It was removed within an hour. ⬇️ www.reversinglabs.com/blog/malicio...

reversinglabs.comMalicious npm campaign targets developers integrating Twilio | RL BlogThe package poses as a security tool targeting developers looking to integrate Internet-based apps with telecom networks using Twilio.
ReversingLabs
@reversinglabs.com

A behavioral verdict tells you what a process did. It doesn't tell you what the file is, what else it can do, or who else is running it. Spectra Analyze gives every CrowdStrike Falcon detection a second opinion that doesn't expire. Learn more: www.reversinglabs.com/blog/extend-... #SecOps

reversinglabs.comExtend CrowdStrike Falcon With Permanent Intelligence | RL BlogReversingLabs built a Spectra Analyze integration with CrowdStrike Falcon. The connector is available now as part of Spectra Analyze v9.6.0.
ReversingLabs
@reversinglabs.com

1/ Three infostealer families, one business model. AuraStealer, ACRStealer/Amatera, and Remus Stealer are all sold as malware-as-a-service, and ReversingLabs tracked all three across July and August.

ReversingLabs
@reversinglabs.com

2/ AuraStealer added virtualization this summer, going from ~600KB to 10MB to slow analysis. Remus uses EtherHiding to stash C2 domains in Ethereum smart contracts. ACRStealer rebranded as Amatera and kept running.

ReversingLabs
@reversinglabs.com

📢 New ReversingLabs research: Copy, Paste, Compromise: The Tale of ClickFix The complete #ClickFix attack chain, the MaaS economy behind it, and an open-source #YARA rule validated against 4K+ samples — 123 of them lures that evaded every #Antivirus engine. 👇 www.reversinglabs.com/clickfix

reversinglabs.comClickFix Threat Report: Copy, Paste, Compromise | ReversingLabs | ReversingLabsOriginal RL research on ClickFix: the attack chain, the MaaS economy behind it, and the YARA detection strategy that catches what AV and EDR miss.
ReversingLabs
@reversinglabs.com

Gartner just defined a new market — and that matters more than it sounds. ReversingLabs was named a Visionary in the new Gartner® Magic Quadrant™ for the category we helped build. www.reversinglabs.com/blog/gartner... #SoftwareSupplyChain

reversinglabs.comThis Report from Gartner Defines the Software Supply Chain Security Market | RL BlogExplore the new Gartner® Magic Quadrant™ for software supply chain security and learn why ReversingLabs is recognized.
ReversingLabs
@reversinglabs.com

npm v12 turns off install script execution by default — the vector Shai-Hulud, Mini Shai-Hulud, and Miasma all relied on. Security experts break down what it fixes and what attackers are already doing instead: www.reversinglabs.com/blog/npm-v12...

reversinglabs.comnpm v12 blocks install scripts: What it means for software supply chain security | RL BlogBy disabling install scripts by default, it closes the vector worms like Shai-Hulud rely on. Here's what the update fixes — and what it doesn't.
ReversingLabs
@reversinglabs.com

Threat actors are using #TikTok & #Instagram tutorials to deliver #Vidarstealer. One video hit 100K views and 1,700 saves — because attackers know which metrics move the algorithm. Research breakdown + IoCs: www.reversinglabs.com/blog/social-... #SocialEngineering #Phishing

reversinglabs.comPhishing Attacks Leverage TikTok, Instragram Reels | RL BlogRL has discovered two social engineering attack techniques targeting users via short-form videos. Here’s how they work.
ReversingLabs
@reversinglabs.com

48,000 CVEs in 2025. Only 58 posed a real, exploitable threat to enterprise supply chains. "Patch everything" is mathematically dead. The signal that matters: malware, tampering, exposed secrets. Go from noise to signal: www.reversinglabs.com/blog/noise-t... #AppSec #SoftwareSupplyChainSecurity

reversinglabs.comCVE noise drowns out software supply chain threats | RL Blog48,000 CVEs were reported in 2025 — but just 58 were critical. A new report highlights why signal-to-noise ratio matters for AppSec.
ReversingLabs
@reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

View full thread
ReversingLabs
@reversinglabs.com

Rotate all credentials, tokens, SSH keys, and secrets accessible from that environment. Audit your lock files for the exact malicious version pins and block the SHA-256 hashes in your artifact proxy.

ReversingLabs
@reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

View full thread
ReversingLabs
@reversinglabs.com

RECOMMENDATIONS If you ran "npm install" on June 1 between approximately 10:54–10:56 UTC and any of these packages appear in your dependency tree — directly or transitively — treat the build environment as compromised.

ReversingLabs
@reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

View full thread
ReversingLabs
@reversinglabs.com

SCOPE OF COMPROMISE The 31 packages span two separate GitHub source repositories ("RedHatInsights/frontend-components" and "RedHatInsights/javascript-clients"), confirming this was a scope-level npm credential compromise — not a per-repository breach.

ReversingLabs
@reversinglabs.com

Affected packages include widely used components: "frontend-components" (1.35M downloads), "frontend-components-utilities" (1.49M), "types" (1.28M), "rbac-client" (942K), "frontend-components-config-utilities" (874K), and "frontend-components-config" (788K), among others.

ReversingLabs
@reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

View full thread
ReversingLabs
@reversinglabs.com

The surgical precision confirms automated tooling. The obfuscation uses two stacked layers: a ROT-N caesar cipher decodes a first-stage JavaScript string, which then uses Node.js's built-in "crypto" module to perform AES-128-GCM decryption of the final payload.

ReversingLabs
@reversinglabs.com

The attacker generated 31 individually tailored payloads — each with its own rotation value, AES key, and IV — giving every "index.js" a unique SHA-256 hash.

ReversingLabs
@reversinglabs.com

🚨 Supply Chain Attack Alert! 🚨 31 @redhat-cloud-services hashtag#npm packages backdoored in 72 seconds! ReversingLabs has confirmed a large-scale, coordinated supply chain attack targeting the "@redhat-cloud-services" npm scope.

ReversingLabs
@reversinglabs.com

On June 1, an attacker published malicious versions of 31 packages in a 72-second automated scripted push — affecting approximately 9.8 million total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.

ReversingLabs
@reversinglabs.com

WHAT HAPPENED Every malicious version follows the same two-file modification pattern: "package.json" gained a "preinstall" hook pointing to "index.js," and "index.js" — the package's own entry point — was fully replaced with an obfuscated dropper. No other files were touched.

ReversingLabs
@reversinglabs.com

Megalodon compromised GitHub Actions YAML files across dozens of repos — base64-encoded credential stealer, C2 on RouterHosting LLC. RL retrohunted to a related campaign 2 weeks earlier. Same C2 pattern. Same adversary. IOCs + YARA rule published: hubs.ly/Q04hVW-v0

hubs.lyResearcher's Notebook: Hunting Megalodon Fossils | RL BlogAnalyzing C2 responses from compromised GitHub Actions linked a current threat to an earlier one, showing the value of retrohunting.
ReversingLabs
@reversinglabs.com

RL documented 163 samples of the Dirty Frag Linux exploit (formerly Copy Fail), active malware — and developed YARA rules for identification. Patch the kernel. Run the queries. Deploy the rules. The detection gap is now. www.reversinglabs.com/blog/dirtyfr...

reversinglabs.comHow Dirty Frag rose from the Linux exploit Copy Fail | RL BlogRL researchers documented 163 samples tied to CVE-2026-31431, identified active malware adoption — and developed YARA rules to identify them.
ReversingLabs
@reversinglabs.com

Is frontier #AI risk keeping your #AppSec team up at night? Doug Levin shares the facts on #ClaudeMythos. Doug also lays out the case for why a layered #AppSec framework is essential — and what it should look like. 👇 www.reversinglabs.com/blog/how-myt...

reversinglabs.comHow Claude Mythos changes the application security calculus | ReversingLabsHere are the facts on Mythos — and why your organization must adopt a layered security framework to match the new frontier models.
ReversingLabs
@reversinglabs.com

Malware is evolving—and targeting AI workflows. Our research on the PromptMink campaign shows how attackers are abusing AI coding agents like Claude to deliver crypto-stealing malware. This isn’t just prompt injection. It’s supply chain risk in a new form. Read: www.reversinglabs.com/blog/claude-...

reversinglabs.comClaude adds PromptMink malicious dependency to crypto agent | ReversingLabsThe malicious npm package has evolved into a dependency that allows attackers to access users’ crypto wallets and funds.
ReversingLabs
@reversinglabs.com

It’s no secret modern #AppDev relies on #OpenSource — what’s catching up is how teams secure it. RL’s free Spectra Assure Community helps teams make smarter decisions about the software they use and ship. 👇 www.reversinglabs.com/blog/why-rl-...

reversinglabs.comSecuring the Village: Why RL Built Spectra Assure Community | ReversingLabsReversingLabs built it to help development and AppSec teams secure open source dependencies, detect malware — and prevent supply chain attacks.
ReversingLabs
@reversinglabs.com

🚨 New RL #ThreatResearch: The #Graphalgo fake developer recruiter interview campaign is back. RL researchers have uncovered a broader network of fake companies tied to this fake recruiter operation — plus new attacker techniques. Read what the RL team found: www.reversinglabs.com/blog/graphal...

reversinglabs.comGraphalgo fake recruiter-test campaign respawned | ReversingLabsNK threat actors targeting crypto developers are back with an LLC and new techniques to hide malware. Here's RL's analysis.
ReversingLabs
@reversinglabs.com

The axios supply chain attack should be front an center for #AppSec teams given it's wide reach. Here's RL's immediate-response checklist — and best practices for ongoing defense. Also learn how RL’s xBOM and Spectra Assure Community can help. 👇 www.reversinglabs.com/blog/axios-a...

reversinglabs.comAxios supply chain attack: How AppSec teams should respond | ReversingLabsHere's an incident-response checklist and ongoing best practices. Plus: How RL’s xBOM and Spectra Assure Community can help.
ReversingLabs
@reversinglabs.com

At #RSAC, JPMorgan Chase CISO Patrick Opet revisited third-party risk — and the supplier changes that followed. Is your organization learning the lesson on “trust debt”? Learn how to move beyond blind trust: www.reversinglabs.com/blog/opet-jp...

reversinglabs.comHow JPMorgan Chase tackles third-party software ‘trust debt’ | ReversingLabsJPMC CISO Patrick Opet discussed his open letter on third-party software risk — and the changes suppliers have made since.
ReversingLabs
@reversinglabs.com

The compromise spread to PyPI and NuGet ecosystem through usage of JSII modules inside versions 0.0.194 of the jjrawlins-cdk-iam-policy-builder-helper packages. Packages depend on compromised versions of axios npm package. secure.software/pypi/package... secure.software/nuget/packag...

secure.softwarejjrawlins-cdk-iam-policy-builder-helper@0.0.194 - PyPI | ReversingLabs Spectra Assure CommunitySupply chain risk analysis for jjrawlins-cdk-iam-policy-builder-helper@0.0.194. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.
ReversingLabs
@reversinglabs.com

It is the latest victim in the ongoing TeamPCP supply chain campaign. Previous victims include Trivy, Checkmarx and LiteLLM.Ultimate goal is exfiltration of cloud secrets like observed in previous attacks. Malicious code is added to telnyx/_client.py file. New C2 server is 83[.]142.209.203

ReversingLabs
@reversinglabs.com

📢 Just dropped: New RL research! 👻 Ghost campaign returns via malicious #npm packages ⚠️ Phishes sudo passwords + hides behind fake install logs 🔍 www.reversinglabs.com/blog/npm-fak... 🛡️ Ask us about it — + Spectra Assure Community — at Booth #4328 #RSAC2026

reversinglabs.comMalicious npm packages use fake install logs to load RAT | ReversingLabsThe final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.
ReversingLabs
@reversinglabs.com

Security Advisory: our research team is tracking threat actor #TeamPCP, who hacked the #Trivy supply chain and infected over 140 npm packages with self-propagating malware #CanisterWorm. View our platform's analysis of a known infected package here: secure.software/npm/packages...

secure.software@teale.io/eslint-config@1.8.9 - npm | ReversingLabs Spectra Assure CommunitySupply chain risk analysis for @teale.io/eslint-config@1.8.9. Learn more about package security, deployment risks, vulnerabilities, popularity, versions, and more with ReversingLabs.

ReversingLabs reposted

Cyber Threat Alliance
@cyberalliance.bsky.social

"Ambiguous package names & fragmented tracking methods leave organizations vulnerable to sophisticated supply chain attacks. By demanding PURLs in your SBOMs, you enforce a strict standard of visibility and accountability" www.reversinglabs.com/blog/why-you... #cybersecurity #SBOM @reversinglabs.com

reversinglabs.comHow to Make Your SBOMs Actionable with PURLs | ReversingLabsPackage URLs give software components an exact address to improve vulnerability matching, which reduces alert fatigue and simplifies compliance.
ReversingLabs
@reversinglabs.com

🚨 RL researchers discovered a malicious package impersonating a legitimate Stripe package on #NuGet — marking a move away from blockchain-related targets while staying focused on financial development tools. Read here: www.reversinglabs.com/blog/malicio...

reversinglabs.comMalicious NuGet package targets Stripe | ReversingLabsIn this latest incident, threat actors target developers with a bogus package — a shift away from cryptocurrency development targets.