Cloud Security Research & Threat Intelligence

Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Executive Summary A supply-chain attack targeting npm developers has been active since August 2023, distributing eight malicious packages that collectively received over 40,767 downloads. Discovered by CloudSEK and Checkmarx, the campaign — dubbed MALFEX — delivers three distinct malware families to Windows systems: the Overlord RAT, the “movinlike” Node.js credential stealer, and rotating downloader payloads. …

October 08, 2026
By The Orca Research Pod

Latest

All Latest

Explore

Discovered Vulnerabilities

Digital illustration of a winding data stream that splits into two paths, one continuing with glowing blue particles and the other filled with glowing red particles.

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

TL;DR When a critical nginx vulnerability hits the headlines, security teams patch nginx. But what if the same vulnerable code is running somewhere they’re not looking? While the rest of the industry was busy patching nginx, Orca’s Threat Research Team was asking a different question and the answer led us straight to Tengine. Tengine, Alibaba’s …

June 16, 2026
By Daniel Ufliand & Yonatan Levi

Cyber-themed illustration of a Linux SMB3 server with a broken padlock, symbolizing a missing lock vulnerability in ksmbd.

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

April 08, 2026

A stylized graphic of a pickle smashing into a pipeline

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

March 11, 2026

Stylized 3D visualization of an active cybersecurity exploit featuring glowing red computer code fragments and a central target aperture.

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

February 23, 2026

A stylized graphic of ominous clouds with a digitized skull on top

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

February 16, 2026

All Discovered Vulnerabilities

In the News

All In the News

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Get the Report

Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Latest

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Explore

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Introducing The Builder Exchange: Inside Security Stories From the Companies Building Fastest With AI

Amazing and Terrifying: Securing an App Built By AI in a Weekend

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

In the News

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations

Featured

Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Latest

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Discovered Vulnerabilities

How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers All Running Vulnerable Code

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Pickle in the Pipeline: Critical RCE Vulnerabilities in SGLang’s LLM Serving Framework

Actively Exploited Chrome Zero-Day May Impact Enterprise, Developer, and Automation Environments

RoguePilot: Exploiting GitHub Copilot for a Repository Takeover

‘Orca Watch’ Series

Malicious npm Campaign “MALFEX” Delivers RAT and Stealer via Eight Packages with 40,000+ Downloads

Critical Atlassian Path Traversal Exposes Sensitive Files Across 8 Products

Citrix NetScaler Zero-Day Exploited in the Wild Crashes SAML Authentication Services

Critical Citrix NetScaler Zero-Days Under Active Exploitation

WordPress “Comment2Shell” XSS-to-RCE Chain Lets Unauthenticated Attackers Compromise Servers via Malicious Comments

Technical Deep Dives

SOC Automation: AI-Driven Tools and Best Practices

Agentic AI Security: Risks, Controls & Framework

CVE-2026-23226: How a Missing Lock in ksmbd’s Channel List Exposes Your Linux SMB3 Server

Supply Chain Attack on Axios Delivers Cross-Platform RAT via Compromised npm Account

Post-Exploitation at Scale: The Rise of AILM

Thought Leadership

Introducing The Builder Exchange: Inside Security Stories From the Companies Building Fastest With AI

Amazing and Terrifying: Securing an App Built By AI in a Weekend

Building Orca’s Partner Portal: What Happens When a Non-Engineer Builds With AI

It Was Not a Warning Shot. It Was the First of Many.

Cloud Security LIVE 2026 Recap: What Security Practitioners Are Actually Doing With AI

The 10 Hottest Cybersecurity Tools And Products Of 2025 (So Far)

From ’Shadow AI’ To Agentic Anarchy, AI-SPM Is Key To Visibility: Experts

Cloud security faces mounting threats, Orca warns

2026 State of AI Security Report: AI Security Findings from 1,200+ Production Organizations