SlowMist: The macOS malware "MacSync Stealer" is active and highly destructive.
Related
New Mac malware, PamStealer, disguises itself as a clipboard tool to steal passwords.
PANews reported on July 6th that, according to Decrypt, cybersecurity firm Jamf Threat Labs discovered a new Mac information stealer called PamStealer, which spreads by posing as a fake version of the open-source clipboard manager Maccy. This malware tricks users into running AppleScript files containing malicious code via phishing websites, authenticating through macOS's pluggable authentication module and stealing user passwords. To evade security tool detection, PamStealer uses JavaScript and the macOS API to download a second-stage payload. This second stage is a Rust-based binary masquerading as Finder or Software Update, capable of stealing browser credentials and Keychain data, monitoring clipboard content, and establishing persistence.
SlowMist: A new family of malware has emerged in the Go module ecosystem, targeting the developer environment of the Cosmos SDK project.
According to Foresight News , blockchain security company SlowMist tweeted that the Mini Shai-Hulud, Miasma, and Hades malware families have expanded from npm to the Go module ecosystem. The affected projects are specific versions based on the Cosmos SDK L1 project verana-labs/verana. The malicious code is hidden in an obfuscated form in the .claude/ directory and uses workflow hooks in VS Code and AI assistants, such as .claude/setup.mjs and .vscode/setup.mjs, to trigger execution when the developer opens the repository. This attack was not a traditional build-time supply chain attack, but rather an attack targeting the developer's local environment. The risk lies in the misuse of IDE automation and AI-assisted tools. Developers are advised to avoid opening untrusted repositories when IDE automation is enabled, and to focus on auditing .claude and .vscode related files, while also rotating potentially compromised credentials.
SlowMist: A new malware variant has emerged in the npm ecosystem, affecting 408 GitHub repositories.
According to Foresight News , the SlowMist security team has issued an alert regarding a new variant of the Shai-Hulud/Miasma/Hades malware linked to the compromised developer account czirker within the npm ecosystem. This attack campaign triggers malicious code during the `npm install` process via a pre-configured file containing the string `binding.gyp`. A total of 23 packages have been confirmed to be affected, with leo-logger experiencing a staggering 3140 downloads per week. As of the time of this report, 408 compromised GitHub repositories containing the stolen credentials have been discovered. Potential attack behaviors include GitHub token theft, npm token theft, AWS/GCP/Azure cloud credential theft, on-premises data breaches, malicious abuse of GitHub Actions workflows, and further proliferation through the npm supply chain. SlowMist recommends that security teams immediately review locked files and package history, downgrade or remove affected packages, and rotate npm, GitHub, cloud services, CI/CD, and application keys, while also enforcing two-factor authentication (2FA).
The malware Reaper steals encrypted wallet data by hijacking the macOS script editor.
PANews reported on June 9th that, according to Cryptopolitan, a new type of macOS malware called Reaper is spreading through fake download pages for apps like WeChat and Miro, targeting the theft of cryptocurrency wallet data, browser passwords, and sensitive documents. This malware uses AppleScript URLs to trigger the system's built-in script editor, hiding malicious code with ASCII art and spaces. After clicking the run button, a fake Apple security update pop-up tricks the victim into entering their computer password. Reaper targets desktop encryption applications such as Ledger Live, Trezor Suite, and Exodus, modifying the wallet's internal code to intercept future transactions and redirect funds.
SlowMist: A new Rust supply chain malware, IronWorm, is attacking the Web3 ecosystem via npm packages.
PANews reported on June 4th that, according to SlowMist monitoring, a new Rust supply chain malware campaign called IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attacks include credential theft, wallet seed phrase and password theft, GitHub repository tampering, malicious package distribution, CI/CD confidentiality leaks, Tor-based command control, and eBPF rootkit stealth. Security teams should audit backtracking commits, suspicious branches, unexpected build hooks, and commits using automated identities such as claude, dependabot, renovate, or github-actions in repositories.
Security Alert: Red Hat Cloud Services npm packages are under attack by an active supply chain; stolen credentials found in over 300 GitHub repositories.
According to Mars Finance, on June 2nd, SlowMist issued a security alert detecting an active npm supply chain attack targeting packages related to @redhat-cloud-services. Currently, over 31 packages have been confirmed affected, with approximately 116,000 downloads per week, and stolen credentials found in over 300 GitHub repositories. This attack method is highly similar to the previous "Shai-Hulud" npm attack, including credential theft, creation of malicious repositories, and automated secret leaks. New suspicious repositories continue to emerge, indicating the attack is ongoing and developers are still being infected. Potential harms include: stolen GitHub/npm tokens, leakage of AWS/GCP/Azure cloud credentials, secret collection of SSH keys and Kubernetes data, leakage of local environment and wallet data, malicious repository creation and persistence operations, and even potentially destructive behavior after token revocation. It is recommended to immediately remove or downgrade the affected @redhat-cloud-services package version, conduct a comprehensive audit of CI/CD workflows and dependency installations, rotate all GitHub, npm, cloud service, SSH and wallet-related keys, retain logs, and rebuild exposed developer machines or runners from clean images, while remaining highly vigilant.