Atomic and Exodus crypto wallets targeted in malicious npm campaign

A malicious npm package named pdf-to-office was discovered targeting cryptocurrency wallets. The package, posing as a PDF to Office converter, injects malicious code into locally installed Atomic and Exodus wallets. This attack modifies legitimate files to redirect crypto funds to the attacker's wallet. The campaign shows persistence, as removing the malicious package doesn't remove the injected code from the wallets. Multiple versions of both wallets were targeted, with the attackers adapting their code accordingly. This incident highlights the growing scope of software supply chain risks, particularly in the cryptocurrency industry, and emphasizes the need for improved monitoring of both source code repositories and locally deployed applications.

Pulse ID: 67fd41f7af4b02a0fd75fb69
Pulse Link: https://otx.alienvault.com/pulse/67fd41f7af4b02a0fd75fb69
Pulse Author: AlienVault
Created: 2025-04-14 17:12:23

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

https://www.europesays.com/1992027/ I’m a Cybertruck Owner Who Paid for Self-Defense After Threats #advertising #america #Branding #business #BusinessInsider #BusinessOwner #call #CybertruckOwner #lot #medicare #office #people #Phone #RecentHarassment #retirement #StrongPoliticalStance #UnitedStates #UnitedStatesOfAmerica #US #USA #VEHICLE

Office 2016 devient inutilisable avec la mise à jour d’avril 2025 : voici un nouveau correctif en urgence ! https://www.it-connect.fr/office-2016-devient-inutilisable-avec-la-mise-a-jour-avril-2025-solution/ #Logiciel-OS #Microsoft #Miseàjour #Office

Atomic and Exodus crypto wallets targeted in malicious npm campaign

Threat actors are employing new techniques to target the cryptocurrency community by uploading packages to popular open source repositories that apply malicious 'patches' to local versions of legitimate libraries. A recent campaign launched on April 1 published a package called 'pdf-to-office' on npm, which injected malicious code into locally installed Atomic Wallet and Exodus crypto wallet software. This attack overwrote existing files, allowing attackers to swap out intended wallet destination addresses with their own. The malicious package was designed to target specific versions of the wallets and included persistence mechanisms. This campaign is part of a larger trend of sophisticated software supply chain attacks targeting the cryptocurrency industry, highlighting the need for improved monitoring and security measures in both commercial and open-source software.

Pulse ID: 67f80a491ab75c1a71050453
Pulse Link: https://otx.alienvault.com/pulse/67f80a491ab75c1a71050453
Pulse Author: AlienVault
Created: 2025-04-10 18:13:29

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Fake #Microsoft #Office add-in tools push #malware via #SourceForge

https://www.bleepingcomputer.com/news/security/fake-microsoft-office-add-in-tools-push-malware-via-sourceforge/

Microsoft 365 Family-Nutzer erleben Lizenzprobleme: Trotz gültiger Abonnements werden #Office-Anwendungen als "beendet" angezeigt. Microsoft bestätigt den Fehler und arbeitet an einer Lösung. #Microsoft365 https://winfuture.de/news,150253.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

Für alle denen ihr MS Office gerade um die Ohren fliegt https://www.libreoffice.org/ Gemeinsam mit https://www.thunderbird.net/
könnte eine Brauchbare schnell eingerichtete Lösung sein die ohne Outlook Konto auskommt und nicht rum meckert, man möge sich jetzt endlich einen MS 365 Account anlegen.
#MS #Office #Mail #outlook

don't delay, order https://exactcode.com #Paperless #office #software today! (Before there will also be tariffs on digital software downloads, ... :-) #ocrkit #exactscan #pdf #recompress

Hi @CollaboraOffice, since software and software services from the United States seem to be less a secure and sustainable option than ever lately, I wanted to ask you if you see an increasing demand for open office suite solutions?

Pick your Poison - A Double-Edged Email Attack

A sophisticated cyber-attack has been identified by the Cofense Phishing Defense Center, combining phishing techniques targeting Office365 credentials with malware delivery. The campaign uses a file deletion reminder as bait, exploiting a legitimate file-sharing service to increase credibility. Users are led to a fake Microsoft login page or prompted to download malware disguised as a OneDrive installer. The attack employs ConnectWise RAT, a legitimate remote administration tool exploited for malicious purposes. The malware establishes persistence through system services and registry modifications, highlighting the need for enhanced user awareness and education to combat such dual-threat approaches.

Pulse ID: 67f59820a8fab9815ec86721
Pulse Link: https://otx.alienvault.com/pulse/67f59820a8fab9815ec86721
Pulse Author: AlienVault
Created: 2025-04-08 21:41:51

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

Manchmal ist die Bundeswehr fortschrittlich: https://www.heise.de/news/Rahmenvertrag-MS-365-Alternative-OpenDesk-soll-die-Bundeswehr-erobern-10342327.html
#opendesk #Bundeswehr #Office #unplugtrump #independent