Daily Writeups
@Daily_Writeups
4.09K subscribers
4 photos
138K links
Daily Bug Bounty / Cybersecurity Writeups
Source Code : https://github.com/Spix0r/writeup-miner
Download Telegram
About
Blog
Apps
Platform
Join
Daily Writeups
4.09K subscribers
Daily Writeups
⤷ Title: Waking the Sleepers: The BufferZoneCorp Campaign Poisoning Ruby and Go Ecosystems
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 02 May 2026 03:23:31 +0000
════════════════════════
⌗ Tags: #Malware #BufferZoneCorp #CI/CD security #Credential Theft #cybersecurity #Go Modules #infosec #knot_theory #malware #RubyGems #Socket #supply chain attack
Daily CyberSecurity
Waking the Sleepers: The BufferZoneCorp Campaign Poisoning Ruby and Go Ecosystems
Socket uncovers a BufferZoneCorp "sleeper" campaign targeting Ruby and Go. Malicious packages steal SSH keys and subvert CI/CD pipelines. Patch now!
17 views
Daily Writeups
⤷ Title: The Worm Turns to PHP: Mini Shai-Hulud’s 20-Million-Install Hijack of Intercom
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 02 May 2026 02:52:05 +0000
════════════════════════
⌗ Tags: #Malware #Bun runtime #Composer Exploit #cybersecurity #infosec #Intercom_PHP #Mini Shai_Hulud #Packagist #PHP Malware #Secret Theft #Socket #supply chain attack
Daily CyberSecurity
The Worm Turns to PHP: Mini Shai-Hulud’s 20-Million-Install Hijack of Intercom
Socket uncovers a massive Mini Shai-Hulud breach in the Intercom PHP SDK. Malicious version 5.0.2 steals cloud secrets and GitHub tokens. Rotate keys now!
20 views
Daily Writeups
⤷ Title: Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Tue, 12 May 2026 01:37:03 +0000
════════════════════════
⌗ Tags: #Malware #@tanstack/react_router #CI/CD security #credential stealer #GitHub Actions #infosec #JavaScript Security #Malware Analysis #npm Security #Socket Threat Research #supply chain attack #TanStack
Daily CyberSecurity
Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets
Urgent: 84 TanStack npm packages hijacked to harvest GitHub Actions secrets. Over 12M weekly downloads impacted. Audit your CI/CD pipelines and rotate tokens.
22 views
Daily Writeups
⤷ Title: GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 13 May 2026 04:21:32 +0000
════════════════════════
⌗ Tags: #Malware #Cyber Security #data exfiltration #GemStuffer #infosec #Malware Analysis #ModernGov #Ruby Security #RubyGems #Socket #supply chain attack #UK Council Security
Daily CyberSecurity
GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping
GemStuffer exploits RubyGems as an illicit data transport to scrape UK council portals. Discover how this supply chain attack bypasses standard defenses.
26 views
Daily Writeups
⤷ Title: Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Sat, 23 May 2026 04:32:47 +0000
════════════════════════
⌗ Tags: #Malware #CI/CD Poisoning #Cross_Ecosystem Malice #Cyber Security #devdojo/wave #GitHub Actions Backdoor #infosec #package.json Exploit #PHP Composer #Postinstall Script #Socket Security #Starter Kits #supply chain attack
Daily CyberSecurity
Malicious JS Lifecycle Hooks Found Hiding Inside PHP Composer Packages
Socket exposes a clever cross-ecosystem supply chain attack targeting PHP packages by hiding a malicious JS postinstall backdoor inside package.json.
13 views
Daily Writeups
⤷ Title: Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Mon, 25 May 2026 09:01:53 +0000
════════════════════════
⌗ Tags: #Malware #DNS TXT backdoor #Go module #proxy.golang.org #rce #Remote Code Execution #shopspring/decimal #shopsprint/decimal #Socket Security #supply chain attack #typosquat
Daily CyberSecurity
Poisoned Code: Stealthy Malicious Go Module Backdoor Discovered in Long-Running Typosquat
Security researchers have exposed a malicious Go module backdoor hidden inside the shopsprint/decimal package that executes code using stealthy DNS TXT records.
20 views
Daily Writeups
⤷ Title: Sicoob SDK Banking Malware Exploits NuGet Developer Channels
════════════════════════
𐀪 Author: Ddos
════════════════════════
ⴵ Time: Wed, 03 Jun 2026 08:12:31 +0000
════════════════════════
⌗ Tags: #Malware #Financial Cybercrime #NuGet Malware #Sicoob.Sdk #Socket Security #supply chain attack
Daily CyberSecurity
Sicoob SDK Banking Malware Exploits NuGet Developer Channels
A dangerous Sicoob SDK banking malware campaign triggers a major NuGet supply chain attack. Learn how it exfiltrates private financial certificates.
30 views
Daily Writeups
⤷ Title: Malicious Chrome Extensions Exposed in Mass Production Traffic Fraud Scheme
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Sat, 13 Jun 2026 02:34:42 +0000
════════════════════════
⌗ Tags: #Malware #adware #browser security #Chrome extensions #Socket #traffic fraud
Daily CyberSecurity
Malicious Chrome Extensions Exposed in Mass Production Traffic Fraud Scheme
Discover how malicious Chrome extensions engage in traffic laundering while lying to users about collecting data on the official store.
10 views
Daily Writeups
⤷ Title: 152 Chrome Wallpaper Extensions Hid Ad Tracking
════════════════════════
𐀪 Author: ddos
════════════════════════
ⴵ Time: Tue, 16 Jun 2026 03:27:13 +0000
════════════════════════
⌗ Tags: #Malware #Ad Tracking #Browser Malware #Chrome extensions #Chrome Web Store #Live Wallpaper #Socket Security
Information Security News
152 Chrome Wallpaper Extensions Hid Ad Tracking
Socket found 152 Chrome live wallpaper extensions secretly faking Google search traffic and harvesting user data for ad networks.
12 views
Daily Writeups
⤷ Title: Mastra Supply Chain Attack Compromises 140+ npm Packages
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 17 Jun 2026 08:04:43 +0000
════════════════════════
⌗ Tags: #Malware #easy_day_js #Infostealer #Mastra #npm #Socket #supply chain attack #Typosquatting
Daily CyberSecurity
Mastra Supply Chain Attack Compromises 140+ npm Packages
A Mastra supply chain attack compromised 140+ npm packages, using the typosquatted easy-day-js dependency to drop a crypto-stealing infostealer.
18 views
Daily Writeups
⤷ Title: 152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Fake Search Clicks
════════════════════════
𐀪 Author: Waqas
════════════════════════
ⴵ Time: Wed, 17 Jun 2026 12:24:28 +0000
════════════════════════
⌗ Tags: #Security #Scams and Fraud #Chrome #Cybersecurity #Fraud #Google #google search #Malware #Scam #Socket #Wallpaper
Hackread
152 Chrome Live Wallpaper Extensions Hid Ad Tracking and Fake Search Clicks
Socket says the extensions worked as wallpaper tools, but also logged user data, disguised install traffic as Google clicks, and fed ad sites.
22 views
Daily Writeups
⤷ Title: North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Thu, 09 Jul 2026 07:53:40 +0000
════════════════════════
⌗ Tags: #Cybercriminals #Contagious Interview #DEV#POPPER #Famous Chollima #North Korean hackers #npm #Packagist #PolinRider #Socket #supply chain attack
Daily CyberSecurity
North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source
At a Glance Actor / group Suspected North Korean actors in the Contagious Interview / Famous Chollima cluster (Socket assessment) Activity type Open-source supply chain campaign; hidden JavaScript…
14 views
Daily Writeups
⤷ Title: Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 15 Jul 2026 14:00:11 +0000
════════════════════════
⌗ Tags: #Malware #.NET malware #Braintree.Net #Credit Card Skimmer #DependencyInjector.Core #NuGet #Socket #supply chain attack #typosquat
Daily CyberSecurity
Fake Braintree NuGet Package Skims Credit Cards and Steals Merchant API Keys
At a Glance Malware family Braintree.Net typosquat, a multi-stage .NET implant with a companion harvester (DependencyInjector.Core) Threat actor Unattributed; financially motivated (suspected) Tar…
17 views
Daily Writeups
⤷ Title: Malicious Go Module Exposes a 222-Repository GitHub Lure Network
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 15 Jul 2026 07:11:10 +0000
════════════════════════
⌗ Tags: #Cybercriminals #AsyncRAT #GitHub lure network #malicious Go module #Operation Muck and Load #Socket #Software Supply Chain #Vidar Infostealer
Daily CyberSecurity
Malicious Go Module Exposes a 222-Repository GitHub Lure Network
Actor / group Unnamed actor tracked as “Operation Muck and Load”; overlaps with the ischhfd83 cluster Activity type Software supply-chain lures and Windows malware staging Targets / vi…
9 views
Daily Writeups
⤷ Title: npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 03 Aug 2026 08:03:44 +0000
════════════════════════
⌗ Tags: #Malware #Alibaba #Cross_Platform RAT #DingTalk #malicious npm packages #npm Supply Chain Attack #Socket #Supply Chain Security
Daily CyberSecurity
npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers
At a glance Malware family Unnamed cross-platform RAT (final payload “aone-cli”) Threat actor Unattributed; suspected Chinese-speaking actor Target Developers at Alibaba Group units, i…
13 views
Daily Writeups
⤷ Title: Malicious Browser Extensions Drain Crypto Wallets
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 02 Sep 2026 08:04:41 +0000
════════════════════════
⌗ Tags: #Malware #Chrome extensions #crypto drainer #Malicious Extensions #Socket #Wallet Security
Daily CyberSecurity
Malicious Browser Extensions Drain Crypto Wallets
At a Glance Malware family “Superior” campaign (crypto wallet drainer / infostealer) Threat actor Unnamed; suspected link to a campaign tracked since February 2024 Targets / victims Cr…
15 views
Daily Writeups
⤷ Title: Fake Chrome VPN Extensions: 737 Linked to One Operation
════════════════════════
𐀪 Author: Nam Phong
════════════════════════
ⴵ Time: Tue, 29 Sep 2026 11:49:07 +0000
════════════════════════
⌗ Tags: #Malware #Brand Impersonation #browser security #Chrome extensions #Chrome Web Store #DNS over HTTPS #Fake VPN #Socket Security #SOCKS5 Proxy
Information Security News
Fake Chrome VPN Extensions: 737 Linked to One Operation
A Free VPN With a Hidden Network Behind It A user installs a free VPN and clicks “Connect.” The familiar message of protection appears. Behind hundreds of different names, however, sat…
26 views
Daily Writeups
⤷ Title: Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Mon, 05 Oct 2026 01:45:06 +0000
════════════════════════
⌗ Tags: #Malware #developer security #GlassWorm #Malicious Extensions #Open VSX #Socket #Solana #supply chain attack #VS Code
Daily CyberSecurity
Socket Links Popular VS Code Color Themes to the GlassWorm Supply Chain Campaign
At a Glance Malware family GlassWorm loader; a separate Windows downloader Threat actor GlassWorm operators (high confidence for one extension; suspected for the wider cluster) Targets Developers …
27 views
Daily Writeups
⤷ Title: 16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Fri, 09 Oct 2026 08:00:05 +0000
════════════════════════
⌗ Tags: #Malware #crypto wallet #firefox #Malicious Extensions #OKX Wallet #Rabby Wallet #Seed Phrase #Socket
Daily CyberSecurity
16 Fake Rabby and OKX Firefox Extensions Stole Crypto Wallet Recovery Phrases
At a Glance Malware family Fake wallet extensions in two families: Rabby clones and OKX clones Threat actor Unnamed; linked with high confidence to an August 2026 Socket campaign Targets Firefox u…
11 views
Daily Writeups
⤷ Title: LiteLLM 1.107.0 Compromised to Steal Cloud, AI Tool and Developer Credentials
════════════════════════
𐀪 Author: Do Son
════════════════════════
ⴵ Time: Wed, 21 Oct 2026 15:12:48 +0000
════════════════════════
⌗ Tags: #Malware #AI security #Credential Theft #LiteLLM #LiteLLM supply chain attack #PyPI #PyPI credential stealer #Socket #Software Supply Chain #Upwind
Daily CyberSecurity
LiteLLM 1.107.0 Compromised to Steal Cloud, AI Tool and Developer Credentials
At a glance Malware family “privcollect” credential stealer plus a remote Python loader Threat actor Unknown; no attribution Targets Users of LiteLLM 1.107.0 on PyPI and its container …
20 views