Tag: javascript obfuscation

5 Attack Reports | 0 Vulnerabilities

Attack reports

Analyzing a Malicious Compiled HTML Help File Delivering Agent Tesla

This analysis examines an attack chain utilizing malicious compiled HTML help (.chm) files for initial payload delivery. The attack begins with a 7zip compressed file containing a weaponized CHM file that displays a decoy window while executing obfuscated JavaScript code. This JavaScript launches P…

information stealer

ftp exfiltration

javascript obfuscation

anti-analysis techniques

compiled html help

Published: April 23, 2026

Linked vulnerabilities : CVE-2022-1388, CVE-2025-55182 (CVSS 10.0)

Downloadable IOCs: 6

Tracking an OtterCookie Infostealer Campaign Across npm

Between April 6-9, 2026, multiple obfuscated malicious npm packages were identified as variants of the OtterCookie infostealer attributed to North Korean threat actors. The campaign employs a two-layer distribution strategy where benign wrapper packages clone legitimate libraries like big.js while …

credential theft

contagious interview

invisibleferret

javascript obfuscation

Published: April 13, 2026

Downloadable IOCs: 9

LummaStealer dropped via fake updates from itch.io and Patreon

A malicious campaign targeting indie game platforms like Itch.io and Patreon has been discovered. Attackers are using newly created accounts to spam comments on legitimate games, claiming to offer game updates through Patreon links. These links lead to downloads containing LummaStealer malware. The…

javascript obfuscation

Published: December 8, 2025

Downloadable IOCs: 5

Malicious pull request infects VS Code extension

A VS Code extension for Ethereum smart contract development, ETHcode, was compromised through a GitHub pull request. The attacker, using a newly created account, submitted a PR that introduced a malicious dependency and code to execute it. The compromise was subtle, involving only two lines of code…

supply chain attack

javascript obfuscation

keythereum-utils

Published: July 9, 2025

Downloadable IOCs: 0

Remcos RAT Malware Disguised as Major Carrier's Waybill

A sophisticated malware campaign has been discovered, utilizing the Remcos RAT disguised as a shipping company waybill. The attack begins with an email containing an HTML script, which when executed, downloads a JavaScript file. This file creates and downloads several components, including a config…

persistence techniques

shellcode injection

javascript obfuscation

waybill disguise

Published: April 1, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports