Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

thehackernews.com Oct 8, 2026

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Curated by Shubham · TechCapsules · Oct 8, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers exposed a long‑running npm supply‑chain attack dubbed MALFEX, orchestrated by a lone threat actor. Twelve malicious packages, including “function‑flag,” “tlxbnhd,” and “img‑to‑native,” were published since August 2023, collectively downloaded 40,767 times. The packages use post‑install hooks to download and execute Windows executables or Go binaries that deliver an Overlord RAT or a Node.js stealer. The operator’s Portuguese‑language commits and Brazilian handle suggest a Brazilian origin, but the attack targets are global.

💡 Why It Matters

· The campaign demonstrates how seemingly benign npm packages can become sophisticated delivery mechanisms for remote‑access trojans and data stealers, expanding the threat surface for developers and enterprises alike.

Capsules Cybersecurity

Read full article on thehackernews.com

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google…

Attackers compromised the .gh, .sl, and .as country‑code top‑level domains, issuing unauthorized HTTPS certificates for several Google and YouTube names. Google’s systems were untouched, but the hijacked domains could allow attackers to impersonate Google sites and intercept encrypted traffic. Chrome immediately blocked the rogue certificates via CRLSets, and Google worked with Let's Encrypt, ZeroSSL, and other CAs to revoke the 12 certificates logged between September 22 and 27. The incident also exposed other global brands, though specifics remain undisclosed.

💡 The breach shows how DNS hijacks can undermine even the most secure sites, revealing that certificate authorities can be tricked into issuing valid keys for compromised domains. It underscores the need for stricter DNS and CAA controls to prevent future exploitation.

financialpost.com · Oct 8

Print Infrastructure Is the Biggest Zero Trust Gap CIOs Haven’t Closed, Survey…

Vasion’s latest research, released in St. George, Utah, shows that document and print workflows remain the weakest link in enterprise Zero Trust strategies. The survey of chief information officers and senior IT leaders found 54 percent consider the risk to these workflows “known and accepted,” yet only 16 percent have actually incorporated printing devices into a Zero Trust architecture. Respondents cited legacy hardware, fragmented management tools and limited visibility as barriers to securing print infrastructure. The study also highlighted that most organizations continue to rely on traditional perimeter defenses, leaving printers and multifunction devices exposed to credential theft and data leakage. Vasion warns that the unchecked gap could undermine broader cybersecurity investments. Without remediation, attackers can pivot from printers to network assets.

💡 Overlooked printers give hackers a foothold that can quickly expand into a full‑scale network breach.

thehackernews.com · Oct 7

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT‑UA uncovered over 100 compromised sites that inject malicious JavaScript to deliver LunexStealer, a data‑stealing malware. The attacks, linked to threat cluster UAC‑0277, use forged Cloudflare verification pages to prompt users to run a command that downloads an MSI package via ClickFix. The malware installs a browser extension, LUNARAXE, and a native messaging host, NAIVEMESS, enabling file system access and remote command execution. CERT‑UA recommends restricting MSI execution, blocking vulnerable drivers, and limiting browser extensions.

💡 The campaign demonstrates how attackers blend social engineering with blockchain‑based command retrieval, expanding the attack surface for credential theft and remote control.

amny.com · Oct 7

Data privacy and cybersecurity in the age of AI: Attorney Jean-Marc Appolon…

Attorney Jean‑Marc Appolon, a privacy and cybersecurity specialist at Labaton Keller Sucharow LLP, is leading efforts to safeguard New Yorkers’ personal data amid rising AI‑driven threats. He conducts external audits of corporate data‑handling practices, testing whether publicly stated privacy policies match actual behavior and ensuring compliance with city, state and federal regulations. When violations are uncovered, Appolon initiates litigation to hold companies accountable for illegal or improper use of personally identifying information. He emphasizes the shift from traditional voyeurism to sophisticated internet stalking and mass data exploitation for profit. By combining technical scrutiny with legal action, Appolon aims to reinforce the “wall” protecting residents from data breaches and unauthorized surveillance in an increasingly digital landscape.

💡 Appolon’s proactive legal strategy confronts the expanding scope of AI‑enabled data abuse, forcing companies to align practices with evolving privacy standards before harm reaches consumers.

thehackernews.com · Oct 7

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and…

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise their traffic as email security tools SpamSniper and ShareTech to evade detection. Rapid7 identified new BPFDoor variants that mimic SpamSniper’s PID file and rotate through ten Linux daemon names, while a separate implant, AVERAT, is delivered via an ELF dropper that encrypts itself with a key derived from “ShareTech.” The malware uses BPF to trigger on HTTPS POST requests, TinyShell for command execution, and SMTP for C2, demonstrating adaptive evasion tactics.

💡 The attackers’ use of legitimate product names and standard telecom protocols shows a sophisticated strategy to bypass both signature‑based and behavioral defenses, raising the threat level for critical infrastructure operators in the region.

tomsguide.com · Oct 6

AI scams are getting scary realistic — 4 red flags to watch…

AI‑generated scams are becoming indistinguishable from legitimate communications, prompting a surge in fraud losses. The FBI reports Americans lost $893 million to AI‑driven scams in 2025, and experts warn the figure could rise as deep‑fake voice, text and image tools improve. Scammers exploit urgency (“RIGHT NOW”), impersonate courts, government agencies or loved ones, and craft emails that mimic official account alerts. Victims are urged to verify requests through trusted channels, such as calling the courthouse directly or using known contact numbers, rather than responding to the unsolicited message. The article outlines four red flags—pressuring urgency, false authority claims, realistic account‑related emails, and deceptive personalization—to help consumers spot and avoid these increasingly sophisticated attacks.

💡 As AI lowers the barrier to produce convincing fraud, everyday users face a heightened risk of losing money and personal data, turning what was once a niche crime into a mainstream threat.