Researchers have discovered North Korea’s Lazarus Group once again infiltrating the npm ecosystem. This time Lazarus is deploying six new malicious packages, which have been downloaded 330 times. The packages are designed to compromise developer environments, steal credentials, extract cryptocurrency data, and deploy a backdoor.
You can go into the weeds by reading this: https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages
Ensar Seker, CSO at cybersecurity company SOCRadar had this comment:
“This attack follows their well-documented pattern of targeting developers and software supply chains to infiltrate organizations. Lazarus has previously compromised trading platforms, financial institutions, and software repositories to distribute backdoors and credential stealers. Malicious npm packages are a particularly effective attack vector because developers often trust open-source repositories without thorough scrutiny. Attackers are embedding malicious code in dependencies, ensuring the malware spreads every time an unsuspecting developer installs or updates the package.
The fact that these packages are designed to steal cryptocurrency-related data aligns with North Korea’s state-backed cybercrime objectives, which involve financial theft to fund regime activities. Lazarus has a long history of targeting crypto wallets, exchanges, and fintech companies. Once installed, these backdoored packages could give Lazarus access to developer credentials, SSH keys, and cloud access tokens, allowing lateral movement across entire organizations, not just individual victims.
Attackers will shift further upstream, embedding malware in popular CI/CD tools, container images, and code repositories, making it harder to detect. They use AI to automate malicious package creation, obfuscate payloads, and dynamically evade detection in package repositories.
They may also poison internal package registries or execute dependency confusion attacks, where private company packages are mimicked in public repositories. Security teams will be forced to adopt stricter SBOM (Software Bill of Materials) practices, conduct routine package audits, and limit dependencies to trusted sources.”
Security teams need to work with developers to cut off this method of entry for groups like Lazarus. Otherwise, you’ll start to see that it will be difficult if not impossible to stop threat actors from going wild so to speak.
UPDATE: Jim Routh, Chief Trust Officer at cybersecurity company Saviynt, commented:
“Sophisticated threat actors are pivoting from 0-day vulnerability exploitation to the harvest of log-in credentials monetized in various ways through various criminal organizations as a method for increasing persistence.
The discovery of the six malicious packages uncovered by the Socket Research team confirms this shift in tactics. The discovery of similar evidence found on GitHub and PyPi reinforces the business case for enterprises to increase their commitment to:
- Improve authentication, moving away from OTP and toward passwordless options readily available today
- Recognize that Identity Security is a great deal more today than provisioning and deprovisioning. It is an opportunity to use account activity data to both establish risk profiles for all users (internal and external) and to enable triggers from pattern deviation applied directly to automated workflow representing risk management and remediation without depending on humans
- Increase investment in privilege user management (PAM) adding behavioral data to continuously verify privilege users by their patterns and revoking privilege based on pattern deviation that meets a threshold
- Revoke all user entitlements not used within 90 days to shrink the attack surface and lower operating costs
- Harvest identity security intelligence to recognize bad actor behaviors (internal and external) and initiate automated risk management workflow
- Give your cloud service providers your enterprise requirements for authentication rather than accepting what they determine to be the norm”
Over 110,000 iOS apps expose user data research finds
Posted in Commentary with tags Cybernews on March 12, 2025 by itnerdApple’s App Store is considered the gold standard for security, but Cybernews researchers analyzed 156,080 randomly selected iOS apps – around 8% of the apps present on the App Store – and uncovered a massive oversight: 71% of them expose sensitive data, including API keys, cloud storage credentials, and financial information.
The security of iOS apps remains under-researched, and this is the first research of this kind at scale.
Key findings of this research:
Potential consequences:
Methodology
The researchers analyzed iOS app versions available from October 2-16, 2024 using OSINT and Reverse Engineering techniques. Without de-obfuscating or decompiling, researchers found a massive number of plaintext secrets stored in IPA archives. They also examined cloud bucket and Firebase endpoints for authentication gaps. The research was conducted between July 2024 – January 2025.
What are hardcoded secrets?
They are sensitive pieces of information – like passwords, API keys, or encryption keys – that are embedded directly into an app’s code instead of being stored securely. This makes them easy for hackers to find and exploit, potentially leading to data breaches, unauthorized access, and financial fraud.
Why this matters:
Please find the full Cybernews research article here.
1 Comment »