VulnHub

Real-time Cybersecurity News

New Npm 'Ghost Campaign' Uses Fake Install Logs to Hide Malware

Infosecurity Magazine
Actively Exploited
Malware

Overview

The 'Ghost Campaign' is a new attack targeting users of the npm package manager. Attackers are creating fake install logs to disguise their malicious activity, which includes stealing sudo passwords and deploying Remote Access Trojans (RATs). These RATs are designed to loot cryptocurrency and sensitive data from affected systems. Developers and users of npm packages should be particularly vigilant, as the campaign exploits trust in the package manager system to facilitate these attacks. The potential fallout includes significant financial loss and compromised user data, making it crucial for users to be cautious when installing packages and to verify their sources.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: npm packages, sudo passwords, cryptocurrency wallets
  • Action Required: Users should verify the sources of npm packages and ensure they are installing from trusted repositories.
  • Timeline: Newly disclosed

Original Article Summary

Ghost npm campaign fakes install logs to steal sudo passwords and drop RATs that loot crypto and data

Impact

npm packages, sudo passwords, cryptocurrency wallets

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should verify the sources of npm packages and ensure they are installing from trusted repositories. Regularly updating passwords and using two-factor authentication can help mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

FBI Warns of Iran’s Handala Hack Group Using Fake Apps to Spy on Windows Users

Hackread – Cybersecurity News, Data Breaches, AI and More

The FBI has issued a warning about the Handala Hack Group, which has ties to Iran and is targeting Windows users by distributing fake versions of popular messaging apps, WhatsApp and Telegram. These counterfeit applications are designed to spy on users and potentially steal sensitive information. The attackers are using social engineering tactics to trick individuals into downloading the malicious software, which can lead to significant privacy breaches. This situation is particularly concerning as it underscores the risks associated with downloading apps from unofficial sources. Users are advised to only download applications from trusted sources and to remain vigilant about the permissions they grant to software.

Mar 24, 2026

Treasury asks whether terrorism risk insurance program should bolster cyber coverage

CyberScoop

The U.S. Treasury Department is seeking public input on the potential expansion of cyber coverage within the Terrorism Risk Insurance Act (TRIA) established in 2002. This program currently provides financial assistance for insurance claims related to terrorist attacks, but the Treasury is considering whether it should also include cyber incidents. As cyber threats continue to increase and evolve, there is a growing concern about how these risks are insured. The public comment period allows stakeholders, including insurers, businesses, and cybersecurity experts, to voice their opinions on this critical issue. The outcome could significantly impact how cyber risks are managed and insured in the future, especially for organizations vulnerable to cyberattacks.

Mar 24, 2026

Citrix Urges Immediate Patching for Critical NetScaler Vulnerabilities

Infosecurity Magazine

Citrix has issued an urgent warning regarding a critical vulnerability found in its NetScaler products. This flaw allows attackers without authentication to access sensitive data from the device's memory. Organizations using affected NetScaler appliances are at risk of data breaches that could expose confidential information. Citrix is urging all users to apply patches immediately to secure their systems. Addressing this vulnerability is crucial to prevent potential exploitation, which could lead to severe security incidents.

Mar 24, 2026

Zero Trust: Bridging the Gap Between Authentication and Trust

BleepingComputer

The article discusses the limitations of multi-factor authentication (MFA) in securing user sessions against attacks. It explains that even if users pass MFA checks, attackers can still hijack authentication tokens and bypass identity verification. Specops Software advocates for a Zero Trust approach, which requires organizations to continuously verify both the identity of users and the health of their devices. This method is crucial because it helps prevent unauthorized access and ensures that not just any authenticated user can gain entry to sensitive systems. The piece emphasizes the need for companies to adopt these security measures to better protect themselves from potential breaches.

Mar 24, 2026

How a Large Bank Uses AI Digital Twins for Threat Hunting

darkreading

JPMorgan Chase is utilizing advanced AI technologies, specifically digital twins and digital fingerprints, to enhance its cybersecurity efforts. These tools help the bank identify online attackers and detect malicious activities while significantly reducing false alerts that can overwhelm security teams. By creating a virtual replica of its systems, the bank can monitor for unusual behavior more effectively. This approach not only improves threat detection but also allows for a more streamlined response to potential security incidents. As cyber threats continue to evolve, banks like JPMorgan Chase are adopting innovative solutions to protect sensitive customer information and maintain trust.

Mar 24, 2026

Enterprise Cybersecurity Software Fails 20% of the Time, Warns Absolute Security

Infosecurity Magazine

A recent report from Absolute Security reveals that enterprise cybersecurity software is failing to protect organizations about 20% of the time. This failure stems from issues like poor patch management, the growing complexity of IT environments, and the continued reliance on outdated software. These factors put companies at increased risk of cyber threats, potentially leading to data breaches and financial losses. The findings suggest that many organizations may not be adequately prepared to defend against evolving cyber attacks, emphasizing the need for improved security practices. As companies continue to face sophisticated threats, addressing these vulnerabilities becomes increasingly urgent.

Mar 24, 2026