Vikas Kundu

A naturally curious mind driven by the need to understand how things work and how to make them better. Passionate about learning, experimenting, and exploring new ideas across technology and security.

Blogs & Articles

Read all Blogs from this Author

GHAPPIER - One loader, sixty-five repositories, twenty-two accounts: an unreported loader family beside DPRK's PolinRider campaign

CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions.

BRIDGEHEAD : An npm typosquatting campaign that crosses from WSL into Windows to plant a crypto-wallet stealer

CloudSEK’s BRIDGEHEAD investigation exposes a 40-package npm typosquatting campaign that abuses WSL to reach Windows hosts and deploy a concealed Rust-based stealer. The malware targets cryptocurrency wallets, browser credentials, cookies and Telegram sessions, while executing largely in memory and using public infrastructure for reconnaissance and exfiltration, making detection and takedown significantly harder.

Whitepapers and Reports

Read all Whitepapers and reports from this Author

The Anatomy of an Attack: Pakistan Based Infostealer Delivery Network Exposed

Beyond the Storefront: E-commerce and Retail Threat Insights

The report "Beyond the Storefront: E-commerce and Retail Threat Insights" highlights the growing cyber threats to the e-commerce and retail sectors, including a surge in ransomware attacks, hacktivist activities, and data breaches. It emphasizes the need for enhanced security measures as these industries face increasing risks from financially motivated attacks and politically driven hacktivism.

MichaMichaBot: Unveiling the Exploitation of Missing "X-Frame-Options" HTTP Headers in Phishing Attacks

The report "MichaMichaBot: Unmasking the Threats Exploiting Missing 'X-Frame-Options' Headers" reveals how cybercriminals exploit this vulnerability to launch phishing attacks by embedding legitimate websites in iframes with fake login panels. It provides insights into these attack methods and practical strategies to secure digital assets against such threats.

Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware

Our whitepaper, "Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware," explores the sophisticated methods and impacts of Maorrisbot malware, offering insights and strategies to protect your devices. Download it to learn how to safeguard against this significant Android threat.

Knowledge Base

Read all knowledge base articles from this Author

No Knowledge base articles found.