Karma-X Blog

Trojanized LiteLLM releases on PyPI enabled data exfiltration with Kubernetes persistence—here’s the full attack chain and how to check if you’re affected.

Axios npm package compromised—attackers hijacked the maintainer’s account and injected a phantom dependency that dropped a cross-platform RAT. Here’s the full attack chain.

Check Point found ChatGPT’s code sandbox could leak data via DNS. Separately, Codex’s branch name field allowed command injection to steal GitHub tokens.

A custom .NET RAT dubbed CTRL uses weaponized Windows shortcuts to hijack RDP sessions via FRP tunnels—here’s the full attack chain and how to defend against it.

Red Menshen’s upgraded BPFdoor backdoor embeds kernel-level sleeper cells in telecom networks worldwide. Here’s how it works and how to detect it.

Uncover the decade‑long MSS‑backed campaign targeting Southeast Asian critical infrastructure—USBFect, Bronze Mohawk, and more.

Telegram zero‑click RCE flaw (ZDI‑CAN‑30207) exposes users to full system compromise—update now or disable media auto‑download.

Handala Hack exposes how Iranian actors leveraged Intune admin rights and Telegram C2 to wipe 200k systems—here’s the technical deep dive.

Critical n8n RCE vulnerabilities expose workflows to backdoors—patch now.

Discover how attackers use Windows Terminal to deploy Lumma Stealer via ClickFix – a deep dive into the latest file‑less, LOLBin attack chain.