MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

thehackernews.com Oct 17, 2026

MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon

Curated by Shubham · TechCapsules · Oct 17, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers have identified a malicious npm package called imgdecode as part of the ongoing MALFEX software‑supply‑chain campaign. Uploaded on September 30, 2026 by the user malfexteste8, the package has been downloaded 979 times and remains publicly available. Its nine‑line JavaScript wrapper loads a compiled Windows DLL that fetches encrypted shellcode from a GitHub repository, decrypts it, and injects the code into a new dllhost.exe process. The DLL checks for image signatures to optionally disable execution. imgdecode is the latest addition to a series of eight malicious packages published under five publisher handles since August 2023, some of which acted as loaders for the Overlord RAT or a Node.js stealer. Versions 1.0.1 and 1.0.2 required the imgbundle dependency, while version 1.0.3 operates independently, removing the need for other MALFEX components.

💡 Why It Matters

· The package demonstrates how attackers can embed active payloads in seemingly innocuous Node.js addons, giving them a stealthy foothold on Windows development machines that run require('imgdecode').

Capsules Cybersecurity

Read full article on thehackernews.com

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365…

Cybersecurity researchers have identified an active campaign in which threat actors compromised a Microsoft 365 credential belonging to ConnectWise Cloud Backup, a service used by managed service providers to back up client data. Using the stolen credential, the attackers signed into 173 tenant environments between 06:13 and 08:34 UTC on 15 October, moving through tenants in GUID order with a scripted approach. The compromised app holds extensive permissions—including full mailbox, OneDrive, SharePoint, Teams, and directory access—allowing the adversary to read and modify data across all consented tenants. In at least one case, the attackers elevated the app to Global Administrator, injected new secrets into other privileged applications, and potentially extended access to additional customer environments. ConnectWise has temporarily disabled the Cloud Backup app and advises tenants to revoke tokens and rotate credentials, noting no evidence of backup data theft.

💡 The breach gives attackers native‑level access to thousands of corporate mailboxes and files, turning a trusted backup tool into a universal backdoor for MSP‑served organizations.

9to5mac.com · Oct 17

Security Bite: Americans are contradicting themselves around privacy

A new survey by data‑removal service Incogni reveals that 45 % of 1,517 U.S. adults say they are not concerned about their online privacy, despite a wave of high‑profile privacy controversies. The poll comes amid mounting public backlash against Ring’s discontinued “Search Party” doorbell feature, criticism of Flock camera practices, and revelations that data brokers continue to sell personal information. The contradictory attitudes highlight a gap between consumer awareness of privacy threats and personal risk perception. The findings were reported in 9to5Mac’s Security Bite, which also notes the growing prominence of privacy as a theme for the year and underscores the need for stronger security solutions for Apple devices.

💡 The gap shows that many Americans underestimate personal exposure, creating fertile ground for data‑harvesting businesses to operate unchecked.

thehackernews.com · Oct 16

Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a…

Attackers hijacked AOMEI Backupper’s update servers between May and July 2026, altering two text files for five‑to‑ten‑minute windows. Any Backupper instance that checked for updates during those windows downloaded a malicious backdoor, which ran with the AOMEI process’s privileges and installed a remote‑control payload. The compromise affected organizations in 11 countries, including IT services, telecommunications, and higher education. AOMEI has patched its servers, but infected machines remain compromised. The attack exploited the software’s lack of cryptographic verification.

💡 The incident shows how even minor server-side changes can weaponize widely used backup tools, turning routine update checks into a covert delivery channel for ransomware‑style implants. It underscores the need for vendors to enforce signed, integrity‑checked update mechanisms.

thehackernews.com · Oct 16

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

A local privilege‑escalation exploit released today gains root on OpenBSD 7.9 by chaining a 37‑year‑old integer overflow in the shmat(4) attach function with a newer reference‑count use‑after‑free bug. The overflow, fixed in errata 018 on September 14, allows an attacker to wrap the 16‑bit shm_nattch counter by creating 127 shared‑memory segments and forking 259 processes, producing a negative count. A race condition then triggers the use‑after‑free, leading to an out‑of‑bounds write that corrupts multicast‑membership counters and, when a socket closes, alters page‑table entries to bypass SMAP and SMEP. The exploit overwrites a predictable kernel function pointer, executing arbitrary code despite OpenBSD’s KARL randomization. Both flaws were patched in September via syspatch; no CVEs have been assigned and no known attacks have used them.

💡 The chain proves that deterministic kernel allocators can undermine even strong address‑randomization schemes, exposing a fundamental hardening gap in OpenBSD’s security model.

thehackernews.com · Oct 16

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed…

Drupal’s core Field UI module contains a critical flaw (CVE‑2026‑108097) that allows unauthenticated remote code execution through certain contributed modules. The vulnerability, rated 19/25 by Drupal, was fixed in releases 11.4.10, 11.3.19, and 10.6.19 on October 14. At least one exploit path requires no login, and 28.5% of sites reporting their core version were affected. Sites unable to update immediately can uninstall the Field UI module for temporary protection. The advisory warns that exploits may emerge quickly.

💡 The flaw exposes a high‑risk entry point that bypasses authentication, enabling attackers to run arbitrary code on vulnerable Drupal installations. Prompt patching is essential to prevent potential data breaches and system compromise.

thehackernews.com · Oct 16

China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

A China‑linked espionage group known as Armory Castle (formerly UNC5221/Warp Panda) exploited a newly disclosed zero‑day in BeyondTrust Remote Support (CVE‑2026‑102764, CVSS 9.3) on August 29, 2026. The flaw, an improper origin validation in an internal messaging component, allowed remote file operations on self‑hosted appliances. After a second public exploitation on September 27, 2026, BeyondTrust issued patches for SaaS customers on October 9 and urged self‑hosted users of versions 24.3.1‑26.2.3 to apply the BT26‑05‑RS update, while older versions must upgrade. Mandiant detailed that the attackers deployed a lightweight PHP web shell (SAWFLY) to gain encrypted C2, elevate privileges, steal stored credentials, and move laterally. The group has a track record of zero‑day attacks on Citrix and Ivanti devices, targeting high‑value sectors for long‑term intelligence gathering.

💡 The breach shows how state‑aligned actors can weaponize unpatched remote‑support tools to infiltrate critical infrastructure, forcing organizations to reassess exposure of legacy appliances on the internet.